Remote control and hacking of an hp pc by a technician

[JoeGuilian]

Hello, 

I bought a used HP PRO 3500 MT pc from an IT technician.

This person was a little shady (I will skip the details of this case). 

On the computer, all secure boot options and lan boot were enabled. 

Could it be possible for the person who sold it to me to take control of the machine remotely or sniff my network?

Thanks.

[WAWood]

@JoeGuilian 

In  a word -- yes.  You would need to disable LAN boot for a start.

Then, if the person setup things to enable remote access, you need to disable those.  We are not Info Security folks, so we have no tutorials on the specifics, so you would have to do online searches, but at a minimum, you would need to disable all Windows services that allow remote access, make sure you have a firewall in place, and in your router, enable the ability to include only specific Mac addresses.

[savvy2]

 not really!!!!

he fails to know what PXEs do and failed to  turn if off,  very common error for sure , new coin cell battery day

only you know if all PC folders are clean, and no other persons have accounts ,(users)

look first. (or reload w10 fresh and clean ) as he should have done, I can do mine in 30minutes work and not doing 3 hour long file inspections and any refurb dust off PC.

secure boot is just as it states, why question that, in fact all new PCs come new that way, for  sure 2020 up.

or w8 up. even.

we can not inspect any PC in a text box.

you home has at least 2 fire walls,  and both are port closed from wan to lan.

in the router that is deafault

as in the w10 firewall same

so there is no take over.

run firefox new and it blocks vast dangerous sites as will malware bytes.

[JoeGuilian]

For windows no problem, I will reinstall it and deactivate the remote desktop and remote assistance. But beyond that, are there any tools specific to HP, directly stored in the motherboard, which could allow him to hack me?

[WAWood · Accepted solution]

@JoeGuilian 

I only mention all these things because, if this was a new PC that you bought and you just created your own account, the account and service defaults would be sufficient to protect you running inside your own network behind a router.

But ... seeing as how this was an IT person's PC, there is really no way to know what remote access they enabled, including opening ports through any firewalls.

So, the safest thing to do is reinstall Windows from scratch.

And no, there is nothing in the hardware that will facilitate remote access.

If you're faced with reinstalling Windows 10 onto your PC, there are several options, not all of which necessarily will be available to you:
- Factory reset using internal HP image
- Factory reset using external HP image you make
- Factory reset using external HP image you buy
- Windows reinstall using media you make

Each of these is discussed in some detail below ...

---------- Factory reset using internal HP image ----------
HP preloads most PCs with a compressed Windows Image that can be used to completely restore the PC to its original condition. This image is contained in the Recovery partition, and if it is intact, it will generally work well.

To do this, you press the Esc key repeatedly while rebooting and when the HP Startup Menu appears, you select the option to do the reset -- usually F11. This will take a couple of hours or more to complete and when done, your PC will start over with initial setup screens. That means that EVERYTHING previously on your PC will have been erased: accounts, settings, personal data, applications, drivers.

NOTE that the disk drive has to be in excellent condition or this will fail. So, BEFORE you do this, instead of pressing F11 as above, press F2 to run diagnostics. If the disk test passes, you should be able to run the reset.

---------- Factory reset using external HP image you make ----------
HP provides a Cloud Recovery tool that you can use, together with a 32GB USB stick, to create your on HP reset media.

Here is the link: https://support.hp.com/us-en/document/c06162205

This works the same as the factory reset described above.

---------- Factory reset using external HP image you buy ----------
For those PCs not supported by the Cloud Recovery, in some cases, HP offers Recover Media for sale. This can not be downloaded; instead, it must be ordered from HP.

HP Recovery Media is a set of DVDs and a CD, or USB stick, that will erase the hard drive (removing all data, settings, and applications, reinstall the original OS, drivers, and some HP Utilities.

In some cases, you may be able to order a USB stick instead of disks.

You can look online for Recovery Media starting with the linked paged: http://support.hp.com/us-en/drivers

Once there, input your Product name or number. On your Software and Drivers Download page, select your Operating System and and Version. Click &quot;Update&quot;.<br><br>If HP Recovery Media is available for your machine, down near the bottom of the page, you will see an entry for Order Recovery Media-CD/DVD/USB. Click the &quot;+&quot; symbol to expand that entry and click on Order Media for details.

Or, if you prefer, you can do the same by contacting HP Customer Support.

HP contact info: https://support.hp.com/us-en/contact-hp?openCLC=true

If HP no longer carries the media you need, another site you should check for HP Recovery Media is: http://www.computersurgeons.com/

These work the same as the factory reset described above.

---------- Windows reinstall using media you make ----------
If there is no HP recovery media and Cloud Recovery is not an option, then your only option is to creating your own media using the Microsoft Media Creation Tool (MCT).

Use this link to download and create that media: https://www.microsoft.com/en-us/software-download/windows10

You may see the option to download an ISO file or create media; choose the option to create media. This will take a while because it has to download over 4GB of data and then has to format and create installation media from those files.

Insert that media into your PC, boot from it, and run through the installation. When you get the window asking for a product key, look down near the bottom of the window for the link you can click to skip that step.

When done (the PC will restart several times), you boot into Windows and you get back online, it will contact the MS activation servers and automatically reactivate Win10.