Help idiot fell for scam!

hubert_cumberdale

change all off your password as they will have them for any logins you have typed on the net

i explorer creates hidden caches of entered passwords and they are extracted easily in about 2 seconds any login that requires username & password

ones with security codes and such like wont be grabable as of yet unless you get your comp cleaned

aliEnRIK

DeltaTwo wrote: »

It shouldn't really be necessary to rip everything up and start again, as long as you're confident in disabling the 'Ammyy Admin' Service and deleting the files, then running your normal scans.

Just check first in Task Manager, 'Processes' for 'AAMMYY_Admin.exe'
(to make sure that .exe is running before you start)

Theres no way on this planet you know for 'certain' that even IF that exe file is running, that the computer would be safe after following your instructions

Marauder999

If you havent reinstalled your HDD yet you could try and uninstall the software by downloading something like CCleaner which will list all the software installed. Simply select the software and click uninstall, its that easy.

Not sure if it would uninstall all other associated software though but could give it a try.

aliEnRIK

DeltaTwo wrote: »

Which is precisely why i suggested locating & killing the 'Team Viewer' before running the normal scans.

This scam is all about getting the mark to hand over their card details (un)willingly over the phone.

Sadly, Medieval apothecaries' cures often found it necessary to kill the patient to effect the cure!

So 'your' advice is to risk the computer and all saved information?

Raggs_2

Remember not to change login info until you've cleaned your computer (personally I'd go with the format myself).

Best bet could be to change the login info using another computer asap, then get on with formatting.

Mid_2

I would also suggest you wipe the computer.

Only if you can assume these people will only install remote access software and you're certain that they wouldn't do anything dishonorable like installing trojans and other viruses, sure you could just kill the remote access application, backup your clean data and do a scan.

Personally, I wouldn't trust them to be so honest.

Unfortunately, backing up your data is going to be a little more complicated.

If your computer is compromised, you can't reliably do anything on it. Backing up your data might be backing up a virus/trojan too.

It's probably way too late now but my advice would be to not plug in your external hard drive whilst your infected Windows is running.

Instead, use the Desktop version of this as a boot CD - http://www.ubuntu.com/desktop/get-ubuntu/download

Copy your files across with that THEN reinstall your PC.

You're not done yet though. Once your PC is all installed, updated and has a virus killer running, you can then re-attach your external HD and scan all your data files.

Or alternatively, to avoid all this hassle in the future - just install Ubuntu. It's not for everyone but I've found not having to worry about viruses is worth the trouble to learn a new OS.

aarrgghh

Why all the advice for extreme action. "Clean install" is a major task. To be safe you cannot use any backups so every update and every installation will have to be downloaded and installed again. In the end there is no guarantee that every threat has been removed unless you carefully wipe everything, and what about the bios? Surely you might as well try to clean everything out with multiple online deep scanners. Use a download called "Everything" to search for remnants. It's worth a try, then if that fails I would take it into the shop and have the job done professionally, or buy a new pc.
ps: Ubuntu is not immune to virus infection.

Toxteth_OGrady

Another scenario where an incremental disk imaging back-up strategy would have made the cure very straightforward.

:cool:

TOG

aliEnRIK

aarrgghh wrote: »

Why all the advice for extreme action. "Clean install" is a major task.

Please - lets hear your advice

aarrgghh

aliEnRIK wrote: »

Please - lets hear your advice

Suggest you read my post first before commenting. I do give advice. Perhaps you do not understand the concept of trying less dramatic measures first. Is this beyond your usual "malwarebytes and highjack this" cure?