comput. was scammed

[cn-74]

my comp. was scammed/called 855 # let them goto assist/they had control of it/is comp. compromised in any way now or any other devices that are sync to it?

[IT_WinSec]

Hello @cn-74

Thank you for posting in the HP Support forum. Welcome !

There is no way for me or anyone else to know what exactly the scammers did and if the PC is compromized (still compromized) now. Best security practises suggest and recommend that you reimage the device immediately (a.k.a. perform HP Recovery - reinstall Windows).

If this is too much, I could help you perform some basic checks.

Let me know which one you prefer - perform HP Recovery, reinstall Windows and everything and start from scratch

or just perform checks with the currect setup ?

I will guide you in the one you prefer.

[cn-74]

can we start easy? and work or way to pain in the butt

[IT_WinSec]

Sure, we can.

1. Restart the computer

2. After restart, start Task Manager - here is how >> https://www.howtogeek.com/66622/stupid-geek-tricks-6-ways-to-open-windows-task-manager/

Check for any running processes or programs such as Team Viewer , LogMeIn, Ammyy Admin, Go To Assist, etc...

If any, stop/terminate them

3. Go to Control Panel > Programs and features

Check for any programs suspicious, installed such as  Team Viewer , LogMeIn, Ammyy Admin, Go To Assist, etc.

Uninstall them if any

4. Scan your PC for threats with these free tools :

ESET Online Scanner > http://download.eset.com/special/eos/esetonlinescanner_enu.exe

Kaspersky TDSS Killer > http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe

perform full scan and remove any threats found

5. Download Speccy from Piriform > https://www.piriform.com/speccy

Install it, start it, perform a scan

When ready, click on File and save a log

Upload this log file somewhere - like in a free file sharing service such as Dropbox / Google Drive / One Drive / Box ... and give me a link (URL) to see this file

We have more additional steps but let's first complete with these.

Looking forward to your reply.

[cn-74]

thanks...I'll give it a go now

[mdklassen · Accepted solution]

Read: https://technet.microsoft.com/library/cc512587.aspx

Help: I Got Hacked. Now What Do I Do?

Published: May 7, 2004

Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+I
Security Program Manager, Microsoft Corporation

His statement is that the only 100%-sure way to "de-compromise" your computer is to "flatten-and-rebuild".

You might consider purchasing a new disk-drive (faster, with warranty, larger capacity), and reinstalling Windows to it,

and then copying all your files from "old" to "new". [Compare it to installing new automobile tires before the current tires "blow" unexpectedly/disasterously.]

[cn-74]

thanks IT  followed instr. and all seems fine...will try to upload that for your info. and go from there

[cn-74]

thanks...trying not to buy anything for right now...last resort

[IT_WinSec]

Hello @cn-74

You are very welcome.

Looking forward to your reply. You don't have to buy anything - everything in my instructions is completely free.

Cheers.

[mdklassen]

> 1. Restart the computer

Only after disconnecting from the Internet, to prevent any "remote" sessions from being re-connected.

> 2.  Check for any running processes or programs such as Team Viewer , LogMeIn, Ammyy Admin, Go To Assist, etc...

If any, stop/terminate them

Watch out for "rogue" programs masquerading as the names of legitimate tasks.

Cross your fingers, and hope that you will be "lucky" to find them all.

> 3. Go to Control Panel > Programs and features

Check for any programs suspicious, installed such as  Team Viewer , LogMeIn, Ammyy Admin, Go To Assist, etc.

Uninstall them if any

Watch out for "rogue" uninstaller-programs that will install more rogue software, while purporting to uninstall.

Good luck. 

> 4. Scan your PC for threats with these free tools :

> perform full scan and remove any threats found

Good luck.  Anything not detected can still be malicious.

Most anti-virus software cannot detect changes to settings, like lowering the default security of Internet Explorer, or shutting-down any firewall software, or sabotaging the currently-installed anti-virus software, or other ways of making a "once-compromised" computer easier to be compromised over and over.

> 5. Download Speccy from Piriform > https://www.piriform.com/speccy    Install it, start it, perform a scan

Watch out for malicious software that may block such downloads.  Good luck.

> free

Leverage the NEED to reinstall to take the opportunity to upgrade onto a newly-purchased SSD device.

The files on the "old" disk-drive can easily be copied to the "new" disk-drive.