Spyware, viruses, & security forum: My friend got scammed; please help make her PC safe again

if the india lady had full access to the pc - then there could be more things hidden than
the usual virus programs can get to.
I,, personally,, would format the drive and reload all !
you should be done in about an hour - depending on how many other programs she
has/had on there - that she wants to keep/use.
then download Avast Free from Cnet and she should be good to go.

Reformat and Re-install windows it is the only truly safe way to clean a used computer.

Most folks don't have a zero fill utility that will avoid destroying the recovery partition, that is so prevalent in most PCs now. Also - what was called "zero fill" or "low level formatting" has changed. Modern hard drives mostly use utilities called "diagnostics" that do what is essentially the same thing. I read, for example, on the Western Digital web site, that modern drive controllers are geared to work with the Windows operating system installation process to format hard drives. So folks may find it hard to find the perfect solution.

I like Darik's Boot and Nuke, but I've never tried it on a system with a factory restore image that needs protecting. Research on the web doesn't help here, as it seems no one has the expertise to understand not only problems like this, but also what the state of the art in drive geometry is at this point. It can be a confusing situation to even the most experienced of us.

It depends on what the computer was originally used for, and what might already have been installed by the previous user.
Also, the version or brand of OS software installed. You didn't mention whether it was a Apple/Mac, or an IBM-based computer. Assuming it is IBM, remote access can be turned off in Windows, and these people are busy making money off of unsuspecting naive users so once you do that, all that is left is to run virus scanning software to clear out any malware that may have been installed.
Also, assuming it's a Windows OS, you can do a "System Restore", that will usually remove registry changes if that restore done for a date PRIOR to the remote access.

Like many have said, to do a full disc zero data format, and then reinstall the OS does give her the best chance of having trouble free use of that computer. Late-Model computers have the Operating System Media on the hard drive already (usually marked as drive "D" "Restore Partition" for example), and so a full format would possibly erase that so be careful.

If the computer came with physical DVD/CD's for the OS, then even better. I have a feeling not.

In advising someone like your friend, it would very much depend on how the computer is being used, and then if any suspicious activity is occurring after the remote access. As I said, remote access can be blocked, (do a google search for her particular OS regarding the settings). System Restore, and then keep malware and virus protection software up to date.

...the friend is very naive. If she got herself into this problem, she certainly won't be able to get herself out of it. She needs to get herself & her PC to a professional & have it wiped & reinstalled - period.Then she should sell the computer immediately & not bother with one again until she takes a class or 2 in how to use it.

...It's the only way to be sure."

Whilst Lt. Ripley is discussing the ideal way of handling a swarm of rampaging aliens, the intent is still the same:

The only way to be absolutely certain your friend's computer is safe to use again, is to scrub the hard drive of all data, and start over with a clean installation of an operating system.

You, Your friend, Us, the Computer Geek next door, or the IT Pro in town; none of us know exactly what was done to that computer while the remote control session was active, so can never be sure that everything was reversed or neutralised if the machine is worked on in an "As Is" state.

If the machine is a brand name, you or your friend can try speaking with the vendor support teams about using the Recovery/Restore Discs that hopefully came with it to perform a full "format you PC and lose all of your data" type Factory Restore, otherwise the best thing to do is to get that machine into the hands of someone competent in computer servicing for restoration.

If the PC was running Windows, recovery can be made that bit longer/more expensive if the machine does not have a Windows Key and Certificate of Authenticity on or with it, as a new license would be required for legal purposes.
Fortunately Windows Vista and 7 allow themselves to be installed and operated for a limited time without a license to trial the operating system and acquire a license later, older editions are not so friendly.

Run a recovery on the computer to put it back in the condition it was in when it left the factory. This will leave it with a clean operating system and all the programs installed at the factory. Get a friend to help. as I recall, one starts the safe mode process and chooses this option from a menu. George

Get the salesperson to reformat the Hard Drive and (re)install Windows7; then get *good* internet security software (Norton, MacAfee, AVG...). Your computer should be as good as new.

"I would like to know how this person in India was able to find out that you bought a used computer and your phone number."

They don't have to. Use the built-in dialler in Windows, and feed it a set from a text file. About the posession of a computer? How many people do you know who don't have one?

This scam is prevalent in Oz, and we have frequent fun with the leeches, by stringing them along and wasting their time -- we once had them tied up for an hour, "following" their instructions, then when we got bored, we simply told the idiot "we don't have a computer!" He wasn't very amused...

Fix? Format C drive, partition to C: and D:, re-install Windows. Most current versions will allow moving "Documents and Settings" to D:\, so backup is not such a problem.

If there isn't a CD, just buy one from Ebay or Amazon, they don't cost much and most are genuine. This offers the chance to get the latest SP slipstreamed in.

Gordon.

The scammers just don't stop... They keep calling and calling and calling!.How or where they get your number is irrelevant. 99% of all the calls I receive that ask me to log on to some website or another, are of east Indian Accent. After they tell me who they are and why they are calling, I simply ask them to "PROVE IT!" PROVE who you are!!! There is simply nothing they are able to say on the phone that can prove anything. NOTHING!
I have personally had conversations with genuine MicroSoft Technical support (Calls that I made) and believe me when I tell you: Microsoft does NOT, nor will ever make phone calls to consumers about error issues and furthermore... any error messages are logged, and logged only. They are not followed up. Can you imagine trying to follow up all the error messages from the few billion computers on the planet? NOT!
You can check your own error messages - simply type in "eventvwr.exe" in the run command.

I did notice that very few people who are recommending to re-format the hard drive and re-install the OS, are failing to mention to delete the partition and create another. (Some programs include that step... others don't)
Another recent phone scam is the calls from various Banks looking for your personal information. Under no circumstances do you give out information over the phone! Even if they really are genuine banking personel !

Reinstall Windows. You have have gotten restore discs with the computer... but if not she can buy retail discs and just reinstall whatever OS is on there.

Since she is new, you could also have her learn computing from scratch without all the hassle and just install Ubuntu Linux on the system. Its available at:
http://ubuntu.com
She wouldn't need to learn how Ubuntu works if she went to reinstall since she never had to "learn" how to use Windows. Ubuntu is very user friendly and has a large user community and great help in the forums. Everything is on the site on how to get it going.
Good luck

Hello Janet, I think I finally understand what you mean by "make her computer safe again"... I was fairly certain that your friend had no intention of letting anyone "take over" her computer again, so perhaps you're thinking that the woman from India still has access and can use it anytime? Or it's a tiny language blip and "again" sort of means "from now on"....Is this about right?

It's a brand new computer isn't it Janet? Though it is written "bought her first used computer", it would therefore make no sense that a woman would be calling from India - actually, that could still completely make sense, People from India call Canada a lot too....but going back to the vendor on a second hand computer was a little harder to sort out.
And I don't care what he said, "don't put personal information on the computer" is as useful, advice-wise, as "do not breathe while using web-based software".

What matters is how your friend's personal information is protected. The only way to know what protection is best is by finding out what she's doing with her PC. Is she the only user, at home, maybe sends email now and then...
does she live with six other women who each have seven credit cards, fifteen bank accounts, investments.....(that's a LAN I'd like to put together). Is it a desktop or does it get to go out and play? If so, is she also using iit for/at work.
I promise that if you write back with more information the users her can build her a veritable fortress.

I won't give information over the phone either....I love these jerks who call me and ask me my birthday or some other way of verifying my i.d. Are we really so dumb that we haven't caught on that the more checks and balances exist to prove that we exist, the more little bits of potential fraud we create....We wouldn' be constantly hearing "dont use your birthday as your SIN/Pswd if our darned birthdays weren't in our wallets in the first place.

Where I live, blue photo i.d. means you can't drink, you need a green card to drink....okay, now I need a drink,,,, but Janet, here's what we need from your friend.:

Desktop or Laptop
Windows, Mac
what version of above - what sort of modem WLAN, DSL, cable wireless
does she share it with anyone at home or at work?
what other devices can access it (mobile, work computer...you know - the Cloud)
What software came with the PC
How does she do her backups?
Is she online and what does she do there. That doesn't sound nosy... I mean is she doing a lot of downloading (if so, what kind of file....music, pic, doc,

If you had any banking or personal information on your computer, you should also go to your bank's web site once you have a clean computer and change your password. Do this with any passwords you had for any site that is critical, as depending on your browser and practices you may have had some stored. I don't know what they may have gotten, but be safe. Do NOT log into any secure sites until you clean the PC, in case they put a key-capture program on there to catch your passwords as you type them.
Be sure to monitor your banking and credit reports carefully for the next while, to make sure nothing has been done in your name.

Lisa

The question was how to make the computer safe again. Well you can not really make a computer safe anymore, when folks are using them for shopping and banking. Paypal can protect you from careless vendors, but what if the crooks read your hard drive? What if they read you keyboard or make screen shots?

Three things you can find here on CNET that will add more protection for folks that do these things online can help. Bear in mind that with today's threats - there are malware that are almost impossible to find. I will list three free utilities that can help protect you even if you are infected with a banking trojan like Zeus or some similar variant.

1. Rapport can prevent session riding into your bank site once logged in. Is supposed to block keyloggers.
2. Keyscrambler can prevent screenshots and keylogging, and has more visual feedback than Rapport.
3. LastPass can encrypt all private information that is used to fill forms, or passwords and user IDs.

The first two work at near the kernel level and are very difficult to defeat, the last one keeps any private information off the hard drive without encrypting it first. And if you have to uninstall the operating system again, for any reason you can get all your information back from the cloud without compromise. Providing you use the second solution as well.

PC security cannot begin to reduce the threat until you use a blended defense, that takes many technologies and combines them to keep the criminals from bypassing every attempt to thwart them. The only paid solution I can truly recommend is Emisoft's Anti-malware. The paid version has a zero day behavioral blocker that I have tested, and is at minimum 95% successful at stopping even unknown malware, if properly setup and configured. Don't listen to me - watch the test footage at youtube, it will make a believer out of you. I am not affiliated with any company or person to make a living off selling or recommending anything on the web. I don't fly that way.

I still say Avast has the second best heuristic engine of any anti-virus; it may not find all the bugs, but if they make a move, Avast will slap it into quarantine until it can find a definition for it that identifies it as a friend or foe. Now days a good behavioral engine is more important than a good scanner. Beware all the good points AV comparatives and the other independent testers give many AV products - they concentrate on scanning success. If you wait until your scanner catches the miscreant, the damage is already do to you.

Avast is the oldest commercially successful AV since 1988, and their track record speaks for itself - you do have to password protect the console or malware can manipulate the settings if they get into the administrative side. But many AV products are just as vulnerable to this. When some of the first really hard to find viruses came out in 2005, I found that I could scan with an online anti-virus, and Avast would slam dunk the culprit as soon as it made any moves to hide from the scanner, whether it used alternate data streaming or whatever. One must think differently and use many of the solutions here on CNET - just read the reviews and make your own decisions. I really can't say enough about having a good software firewall like Comodo or OnLine Armor - just another rivet in the armor that is blended defense. I could go on, but it would be even more boring that this rant, so I will end it here, and wish Janet and her friend the best of luck!