My mother's Windows 10 PC infected help via TeamViewer

[Viv[MumsPC2017]]

Hello Malware Removal kind helpers.

My mother's PC in another province has been infected by the Computer on Lockdown, fake tech help ransomware virus. Unfortunately she could not reach me for an hour when this happened 10 days ago, so she phoned the number on the screen and the fake tech guy got her to give him her credit card number and they got her for USD 275.00! So we have cancelled credit cards, notified banks and fraud police. They must not have got all the info they wanted after getting her to let them into her system settings, because they phone 3 times a day to say that the tech support she started is not complete and they want her to call a toll free number to let them into her system again. Per the RCMP advice, she is not responding to any calls or voice mail from them.

I have backed up her documents and pictures to my local PC via TeamViewer. Because she has a password on her laptop, each time I help she has to be there to type that in, start in safe mode and connect to the Internet manually.

In safemode with networking I have managed to download malwarebytes free software which found nothing. McAfee found nothing. We tried to go to installing Windows 10 via her Settings and Security the quick way, but that got hung up on a black screen, in the midst of which it disconnected her from the Internet so that I was not able to monitor via TeamViewer.

Is there any way I can clean her computer? She is 80 years old and doing well with following my instructions so I think I can get her to the point of FRST logs, etc. via telephone, but just want to know if there is anything I can do via TeamViewer and if Teamviewer itself violates your terms of helping her rid her PC of this terrible invasion?

Thank you in advance for any help you can give me.



P.S. As this is a holiday weekend in Canada, we will likely not get to a Teamviewer session until Monday or Tuesday evening ATLANTIC time.

[NonSuch]

We're sorry to hear of your mother's terrible experience with scammers. Although we do our best to help everyone, sometimes it just isn't possible. In this case, your mother's computer has been compromised by someone tricking her into giving them complete and unfettered access. Unfortunately, there is no way to know what changes may have been made to the system and/or its settings in order to permit the perpetrators a way back in. Even if we had physical access to the computer, there would be nothing we could do to make certain that the computer was safe and secure for use again.

Given this computer's compromised condition, the only viable option is a reformat and reinstallation of the Windows operating system. If you are unable to walk your mother through this process via telephone, then the computer should be taken to a reliable local repair shop where the work can be done.

[Viv[MumsPC2017]]

Thank you so much for your kind response, Nonsuch. This is also what my husband suspected would have to be done. Would you suggest as my sister is now visiting for the next 2 days that they find a way to install clean Windows 10 via external source like DVD or cloud or USB stick? Not from within her computer System Settings then?

[NonSuch]

You're very welcome.

Although Windows 10 can be reinstalled via settings, it's quite likely that some if not all current system settings would be retained, which is exactly what you don't want. It would therefore be prudent to wipe the drive and reinstall Windows 10 from an external source.

See this topic for additional information: https://www.malwareremoval.com/forum/vi ... p?p=613789

[Viv[MumsPC2017]]

We downloaded a tool and reinstalled from Microsoft which removed all apps, and although we asked to keep her files, she lost all her documents but retained all photos. Looking at your link to topic for additional information now. Thanks again.

[NonSuch]

You're most welcome.

Actually, it's best to do a back-up of important documents prior to wiping the drive and reinstalling the operating system. Files residing on the computer should be wiped, e.g., what you want is a "destructive" restore not a non-destructive restore. Otherwise, you cannot possibly be certain that something malicious does not remain.

[Viv[MumsPC2017]]

Fortunately, I have all her documents which I back up to an old laptop here via TeamViewer. I will delete her photos and do a destructive restore as you advise. I will also make sure her security updates are set to install automatically. Thank you very much for your help.

[NonSuch]

You're welcome. Your mother is fortunate to have a family that is both willing and capable of providing assistance for her computer problems.

[Viv[MumsPC2017]]

[NonSuch]

As it appears there are no additional questions, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.