Microsoft called me and fixed my computer

UncleZen

OK, well, it wasn't me. It was someone I know.
They got the Microsoft scam call and fell for it. Got charged $150 to "fix" their computer.

My advice to him is to disconnect it from the internet and take it to a specialist that has all the right tools to check for rootkits, viruses and malware etc.Oh, yes, and cancel the card he used to make the payment.

Now, my question is, what is the likleyhood that they have left something nasty on his computer?

Tropez

Depending on which variant it is, they may have already taken copies of files that were on his system looking for personally identifiable information (name and address in letterheads, D-o-B written somewhere etc.)

The scammers once called up Jerome Segura, who just happens to be one of the senior developers at MalwareBytes. Since he knows his stuff he decided to play along with them so that he could get a better understanding of how the scam works. After a while, having granted remote access, the scammers became impatient due to Segura deliberately providing incorrect payment information (for obvious reasons) and deleted a whole host of files from his PC. If the scammers can delete them, they can also make copies and collect them.

But yes, it is very likely if they haven't collected files, they've left a keylogger or something similar on there.

grumbler

Normally, cancelling a card doesn't stop pre-authorised transactions.
If it appears in the statement it's worth trying to report it as a fraudulent/unauthorised.

shaun_from_Africa

UncleZen wrote: »

Now, my question is, what is the likleyhood that they have left something nasty on his computer?

Your friend must assume that something has been left behind and act accordingly.
It would also be worth them contacting their card issuer and requesting a chargeback (or section 75 claim if a credit card was used and the cost in Stg was over £100).

bsod

UncleZen wrote: »

Now, my question is, what is the likleyhood that they have left something nasty on his computer?

Very unlikely, they were after $150, and they got it, job done. If it was a credit card payment, the bank will most likely refund it, if asked.

A 'specialist' will charge them more money to do something anyone can do easily, adding to this persons woe's

They can scan with malwarebytes, do system restore, restore from backup or re-install windows if they are paranoid, there is no need to pay anyone to do this.

googler

UncleZen wrote: »

My advice to him is to disconnect it from the internet and take it to a specialist that has all the right tools to check for rootkits, viruses and malware etc.Oh, yes, and cancel the card he used to make the payment.

Now, my question is, what is the likleyhood that they have left something nasty on his computer?

It's likely to be cheaper and easier to remove the HDD from the machine, and install a new one, with a fresh operating system.

If there are any files on the old one which are needed, put it in a USB caddy and copy/paste them across. Accessing selected files this way will bypass any malware which has attached itself to the OS.

bsod

replacing the hard disk because someone conned you into making a card payment on the phone would be complete overkill.

spannerzone

I think people are giving these scammers too much credit and skill capability, they want to fleece you a load of money by doing very little, I've not seen any evidence anywhere that they plant viruses, rootkits, steal info or other nefarious deeds.

yes they're lying, cheating, deceiful scumbags but can anyone show any evidence they actually steal your personal data - those that get caught by the scam willingly give their credit card number and that's likely all they want from the scammee.

Of course it is prudent to check for infections but it may be better to remove the PC from the user entirely

googler

bsod wrote: »

replacing the hard disk because someone conned you into making a card payment on the phone would be complete overkill.

My point was that it may well be cheaper than the suggestion in the post I quoted...

GunJack

spannerzone wrote: »

I think people are giving these scammers too much credit and skill capability, they want to fleece you a load of money by doing very little, I've not seen any evidence anywhere that they plant viruses, rootkits, steal info or other nefarious deeds.

Well, actually, I have - I've been called to 2, no 3 such machines after the scammers placed keyloggers and rootkits on them during the time they had been given remote access (and had forked out to them). Granted not all of them will, but you don't know which will and which won't, so best get it checked over if you feel it's beyond your capabilities. As long as it's not an encryption-type infection, most other things are retrieveable without resorting to new hdd/clean install.

pendragon_arther

bsod wrote: »

replacing the hard disk because someone conned you into making a card payment on the phone would be complete overkill.

But it was more than that, the rsoles had access to the entire hd/s. Maybe the OP isn't competent enough to wipe the hd themselves, and even if you reinstall the os nasties can still lurk in the boot sector.