friend scammed

Hello @compiler7,

compiler7 said:

W10 ver 1909

My friend knows very little about computers He fell for the Microsoft scam where he had to call their “support line.” They took control of his computer. He realized just in time that there was a problem and managed to hang up and shut down. But, when I had him check things, we found Go To Assist Customer from Logmein on his computer. When we tried to UNINSTALL it said there were other users on. We continued anyway but it asked for a password. How do we eliminate the program?

[1] DON'T let him connect to the Internet!
[2] Has he got a recent System Image?
[3] Has he got a recent System Restore Point?
[4] Can he see either Go To Assist Customer or LogMeIn under Programs on his computer?

I hope this helps!

Like vampires, those are the kind that only come in if you invite them.

Hello @compiler7,

compiler7 said:

But this story has a happy ending. He called his anti-virus company, Mcaffee, and they were able to remove it.

That is good news!

Perhaps you could sit down with him and show him how to create a System Image, they are worth their weight in gold.

I will add though, if it was me, I would backup all my files etc and perform a clean install. The reason I say this is because you DON'T really know what else they have done or installed on the HDD. They could already have usernames, passwords, credit card details, bank account numbers, sort codes, names, addresses etc [ you get the point ]. He needs to change ALL his usernames and passwords IMMEDIATELY. Things like eBay, PayPal, FaceBook, Bank, Forums etc.

It could be like waiting for a time bomb to go off without knowing quite when!

compiler7 said:

How do we eliminate the program?

Assuming you (they) have backups (and hopefully they do) wipe the PC and start fresh. Simple.

If they don't have backups they could create one before wiping the PC, but I'm not a fan of creating backups "after" a PC has been compromised as who knows where the malware went. In this case they'd have to make a decision.

My two cents.

Once you realize you have been compromised, it's too late. Whatever was going to happen had already happened. Unfortunately, these sleezeballs and scumbags are very good at what they do. They have the attack well rehearsed and honed. They've had plenty of victims to practice on and work out their bugs. The really good ones are killing machines. Only a few milliseconds and they have enough to do damage.

If it sounds like I'm being melodramatic and trying to scare you (your friend), I am.

The only safe recourse for you and your friend is a complete wipe of that drive and a clean install, along with a painful and time consuming password change on all aspects of your electronic life.

If you believe there was any chance that CC or bank PWs were compromised, contact the credit card and/or bank immediately and tell them so they can freeze the accounts and re-issue cards.

My 2 cents worth.......

compiler7 said:

I agree with you guys totally.
He has no clue what backing up is!

He says he has no compromising stuff on his computer.
He has one bank account, which has amazingly 2-factor authorization.

Mel

Introduce him to the world of Backup.

Macrium Software | Macrium Reflect Free