Friend allowed scammers on laptop - help!

  bob dob 15:23 31 May 2017
Locked

Hi all. A good friend told me yesterday that he's been trying to get BT out to fix his router. Unfortunately he was phoned on the weekend by some scammers who claimed they were from BT and he allowed them remote access to his laptop and they downloaded some software. At the point that they asked him to log on to his internet banking he hung up and uninstalled the software.

I urged him to update and run Malwarebytes and SuperAntiSpyware as well as his Avast antivirus.

He's told me that he ran the MalwareBytes scan and it didn't find anything but it then asked him to update it. He did, then it asked him to reboot. He did and upon restart it is asked him for the admin password, he put it in but now can't get it to safe mode or to progress in to windows at all.

Any ideas, please?

  bob dob 18:25 05 Jun 2017

Sorry for the naivety but not sure how to?

  Fruit Bat /\0/\ 19:26 05 Jun 2017

If you have booted from the windows 10 iso on the usb

read click here from the part that says Booting to Recovery Environment with Windows 10 installation media or Recovery Drive/System Repair Disc

  bob dob 19:31 05 Jun 2017

Thank you, I've booted from the CD. I'll get on this tonight....

Still got it then, Fruit Bat...

  bob dob 13:30 18 Jun 2017

Hi all, So sorry for the delay...but I'm keen to do this today, if anyone can help? I'm not having any luck with following the advice but I see this on the laptop, there shouldn't be more than one Windows installations, right? click here

  [DELETED] 15:03 18 Jun 2017

Not sure why you have two 'D' recovery partitions?

This is your image,

Easier than linking to Photobucket and might help others for suggestions.

  bob dob 17:02 18 Jun 2017

Oh thank you for that, I'm not sure how to get it to show images? I hate Photobucket anyway. I have no idea why my friend has 2 recovery partitions? What shall I do?

  [DELETED] 17:35 18 Jun 2017

I'm puzzled here. Fat 32 and WINRE and the last 'D'recovery partitions look OK. 'E' is the optical drive so that's OK. This volume 2 is a mystery for me. It's showing as a duplicate. I'm not sure but it's possible that's your problem. I'm not qualified enough to suggest removing that partition in case all hell breaks lose or it fixes the problem. Sorry can't help further but maybe someone more proficient in partition management will come along with more knowledge.

  Fruit Bat /\0/\ 18:49 18 Jun 2017

C: is windows as normal D: recovery windows sets up a small recovery drive when you install, I'm guessing that win 10 was an upgrade from a windows 8 or 8.1 originally on the machine hence the two recovery drives, these are normally hidden.

E: is the DVD drive

Vol 3 is likely to be the system reserve partition where all the boot files are located for win 8 or 10

Vol 4 win RE is where windows puts its tools so you can boot to the recover environment and do things like start up repair, system restore or reset the computer.

Did it not find an installation to repair?

  [DELETED] 19:15 18 Jun 2017

*Fruit Bat /\0/* check again. Vol 2 and 5. Don't you find it strange?

  Fruit Bat /\0/\ 19:29 18 Jun 2017

Surprised both showing as D: with one hidden but looking again 14GB is too big for the normal win recovery so must be a recovery partition set up for the laptop containing a disk image.

Untill he can get back in windows its hard to tell

I would be tempted to connect laptop to another machine extracted any data required (photos docs emails etc.) then use diskpart to completley wipe the drive and do a freh install from the boot media. That way he can be certain there is no lingering malware, trojans, keyloggers, etc.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Samsung Galaxy Tab S5e Release Date, Price & Spec

Rob Hunter talks animating his magical storybook style for a spacey Jon Hopkins music video

Best iPhone & iPad games 2019

Samsung Galaxy X : date de sortie, prix et fiche technique