Earlier this week I attended a customer (elderly man) who said he had received a phone call from “Micro$oft Support” urging him to “fix infections” on his Win7 SP1 computer.
I quizzed the customer about the call, and what eventuated from it, but the answers I received from the customer were not very helpful. That is not unusual, since the scammers depend largely on ordinary users’ ignorance about the technical details of Windows. But it did seem the scammers were trying to get the customer’s credit card or PayPal details. The customer mentioned sums demanded >$900 but was adamant he did not agree to supply such details or to pay.
Nevertheless, it was apparent that the customer had allowed the scammers remote access to his computer (further explanation of this below).
Desktop PC, booted normally through POST to the Win10 startup logo then the Win10 login screen. Two user accounts listed in the lower-left of the login screen, but any attempt to login to either account with any password the customer could suggest failed w/ “incorrect password” error (cust. did not have a password set in the single admin-level account in Win7).
Tried the Shift-Restart/Troubleshoot options but choosing any option (Reset, Refresh, Command Prompt, etc.) simply resulted in the login screen demanding a password. Also tried booting from a Windows Repair CD with same result (password demanded to access any advanced repair options).
Back in May 2015 I had worked on the same customer’s PC to remove malware and had created a system image of his C: drive ( http://www.terabyteunlimited.com/bootit-bare-metal.htm ) so was able to connect his PC to my workbench, image his Win10 partition, and then restore the previous Win7 partition.
After that, when I accessed the Win10 image (tbiMount, included w/ BootItBM) it was clear that the customer had downloaded “TeamViewer” at the time the scammers accessed his system.
I also extracted his up-to-date user files incl. email then restored the Win7 partition and the up-to-date user files.
Fixed any remaining problems w/ the restored Win7, and the WLM email database, and the customer is now good-to-go.
After all above ran “GWX Control Panel” from: http://ultimateoutsider.com/downloads/ to disable the auto-upgrade to Win10. More info at: http://blog.ultimateoutsider.com/