Computer scam advice.

[colly]

This is going to sound like going to the doctors and asking about a 'friend' who has a problem.

In fact it is a pal of mine who this afternoon spent TWO hours on the phone to 'Microsoft' after he got a message on his computer say there was a fault and if he calls this number they will sort it out for him. Obviously a scam but he fell hook line and sinker for their patter. God only knows what they will have installed on his machine because he gave them full access to it.

He is convinced they were the real deal because in his words 'they knew their stuff'.

Anyway I told him to look out for any unusual activity and to get the computer scanned to see if there is any stuff installed that will poach his personal information/passwords etc.
He has only had this computer a week or so.

So what should he look out for and what can he expect will be the targets of any malware?
Are there any genuine programs he can download and use to seek anything nasty out and get rid of it?

First off though I have to convince him he has been had.

 

[Glenn]

I would suggest that he formats the drive and re-installs Windows.

 

[swee'pea99]

I'm sure better qualified people than me will be along soon, but if it was me I'd get him to download and install Malwarebytes and Spybot, then disconnect from the internet and run full scans. Oh, but first check to make sure his firewall is on.

 

[swee'pea99]

Format & reinstall sounds good, if he has the means (ie Cds) to do it.

 

[Berk on a Bike]

Tell him to download Malwarebytes and run a full scan with it. If he's divulged any bank details he should inform his bank to stop any payments.

 

[ColinJ]

A friend of mine fell for the same scam. By the time she realised that she had been had they had already scrambled her HDD and changed her Windows password! She ended up taking the machine to a shop and paying them to reinstall everything.

 

[colly]

Format and reinstall ? That bad ?

Tech savvy he isn't. I'll tell him to take it back to the shop he got it from. First job is to convince him .

 

[Glenn]

You don't know what keylogging or monitoring software has been installed, better to restart with a clean slate imo.

 

[classic33]

Don't connect it to the internet in the meantime.

 

[LetMeEatCake]

From my limited experience of dealing with other people's infested machines it's usually much quicker to wipe and reinstall. You can spend an age running scans and trying to weed out the dodgy stuff, only to end up in a position where nothing's working properly and you're still not sure if the machine is clean.

 

[classic33]

Format and reinstall ? That bad ?

Tech savvy he isn't. I'll tell him to take it back to the shop he got it from. First job is to convince him .

If bank details were/are on it, first thing to do would be to get in touch with them. Most have 24 numbers available.

 

[accountantpete]

If he has given them the passwords to enter into his pc they could have gotten everything they need via SSH - mainly stored passwords - in Chrome you just go into Advanced settings and Manage Passwords to get a list of all the saved passwords it is that easy. I doubt they wou;ld leave anything.

If he has logged in on any financial sites with a stored password (paypal or ebay etc) he needs to change the passwords PDQ. Also change the email address.

Bank log ins usually only have a sample of a larger password so he should be ok there.

 

[mjr]

Yep, reinstall time and recover documents from backups: you're not dealing with a program on a logged system but a person with complete administrator access who doesn't want what they added to be found.

 

[colly]

If he has given them the passwords to enter into his pc they could have gotten everything they need via SSH - mainly stored passwords - in Chrome you just go into Advanced settings and Manage Passwords to get a list of all the saved passwords it is that easy. I doubt they wou;ld leave anything.

If he has logged in on any financial sites with a stored password (paypal or ebay etc) he needs to change the passwords PDQ. Also change the email address.

Bank log ins usually only have a sample of a larger password so he should be ok there.

Hmm... well I'm pretty sure he won't be using Paypal or ebay but I know he does use online banking but as you say they usually ask for only partial information.

 

[classic33]

Still contact the bank. The sooner its reported to them, the sooner they can stop any transactions. Your friend will also be covered by their systems sooner should anything happen.
Flip side of that is why did (s)he delay in letting them know. The bank will open a new account taking over control of the old one.