My mother-in-law fell for a Windows scam. Apparently a window popped up telling her that her computer had a virus, and she should call this number where they would clean it up for her. To cut a long story short, she gave them her credit card number and enabled remote access.
Credit cards have now been cancelled and we're going to (on another computer) change mother-in-law's password for every web service.
The laptop is now shut down and in my physical possession. I do not want to boot it up: they could have installed anything (trojans, keyloggers), which even Avast may not be able to defend against, right?
My plan is to remove the hard drive, mount it on another machine, and copy off any important files.
After that, what's the safest way of resurrecting it? Can I reinstall Windows on the drive without first booting it up? Or is it safe to boot up for the sole purpose of initiating a factory reset?
What other steps should I be considering?