Reset system after online hack

[jhg_1]

I have an all-in-one desktop that was hacked and I need to nuke and pave it and be sure any infection is removed.

It was being used by a non-tech individual and they got a "warning" saying the system was hacked and they needed to call a number to resolve the problem (standard phishing attack).  Unfortunately they DID call the number and allowed the "tech support" person to login remotely.  They realized what they'd done just afterwards, but by then it was too late.

I am concerned that the system reset function provided could itself have been tampered with.  Is it necessary to install from external media, or is it likely the built-in "system restore" image will be usable?  Does the "system restore" function have any integrity checking built in to detect if it has been compromised?

[Paul_Tikkanen]

Hi:

I don't believe that the scammer was able to alter the recovery manager factory reset system.

There is no integrity checking that I know of in the recovery manager.

It will delete all partition, format the hard drive, recreate new partitions and basically put the hard drive in its 'out of the box' condition.

Alternatively, you can always clean install W10 by using the Media creation tool at the link below.

https://www.microsoft.com/en-us/software-download/windows10

You can create a USB installation flash drive.  You will need an 8 GB flash drive for this.

W10 will install and automatically activate once you are connected to the internet.

Then you can install the drivers and available software from your PC's support page.

https://support.hp.com/us-en/drivers/selfservice/hp-24-f0000-all-in-one-desktop-pc-series/19391008

[jhg_1]

Thanks for the quick reply

I already have a W10 install image on USB downloaded from Microsoft.

How would I provide the W10 license key since it is not listed anywhere in the materials that came with the PC?

Would a non-HP install image be able to re-create the recovery partition as well as install the OS?

I'd rather not spend $55 for the HP recovery media if I can accomplish the same thing with a standard MS image.

[Paul_Tikkanen · Accepted solution]

You're very welcome.

A clean install of W10 will not re-create the recovery partition.

It will just install the OS.

You don't need the product key to install W10.

The key is in the BIOS and is automatically picked up during the installation process.

When I clean install any version of Windows, I delete all partitions, create one large partition and install the OS.

There is no point in having partitions that don't work anymore without the HP factory image and recovery manager software installed.

[mdklassen]

> How would I provide the W10 license key since it is not listed anywhere in the materials that came with the PC?

When you first connected Windows 10 to the Internet, it "called home" and "activated" your copy of Windows.

What you also received is a "digital entitlement" to reinstall Windows 10, at no cost, at any time, onto the same computer.

So, there are three possibilities:

1. The product-key is electronically embedded on the motherboard, and will be fetched from there.

2. if you install from HP Media, onto genuine HP hardware, the OEM product-key embedded in the installer will be used. 

That key identifies the computer as not needing "activation" at all.

3. When installing from Microsoft's "generic" installer, when prompted to enter the 25-character product-key, click "I do not have one". Windows will continue to install. When Windows "calls home", it will leverage your entitlement to automatically activate.

Over all, this is much better than trying to read the product-key from a scratched-up decal on a Windows XP/Vista/7 computer.