Friend allowed scammers on laptop - help!

  bob dob 15:23 31 May 2017
Locked

Hi all. A good friend told me yesterday that he's been trying to get BT out to fix his router. Unfortunately he was phoned on the weekend by some scammers who claimed they were from BT and he allowed them remote access to his laptop and they downloaded some software. At the point that they asked him to log on to his internet banking he hung up and uninstalled the software.

I urged him to update and run Malwarebytes and SuperAntiSpyware as well as his Avast antivirus.

He's told me that he ran the MalwareBytes scan and it didn't find anything but it then asked him to update it. He did, then it asked him to reboot. He did and upon restart it is asked him for the admin password, he put it in but now can't get it to safe mode or to progress in to windows at all.

Any ideas, please?

  bob dob 17:02 18 Jun 2017

Oh thank you for that, I'm not sure how to get it to show images? I hate Photobucket anyway. I have no idea why my friend has 2 recovery partitions? What shall I do?

  Fruit Bat /\0/\ 18:49 18 Jun 2017

C: is windows as normal D: recovery windows sets up a small recovery drive when you install, I'm guessing that win 10 was an upgrade from a windows 8 or 8.1 originally on the machine hence the two recovery drives, these are normally hidden.

E: is the DVD drive

Vol 3 is likely to be the system reserve partition where all the boot files are located for win 8 or 10

Vol 4 win RE is where windows puts its tools so you can boot to the recover environment and do things like start up repair, system restore or reset the computer.

Did it not find an installation to repair?

  Fruit Bat /\0/\ 19:29 18 Jun 2017

Surprised both showing as D: with one hidden but looking again 14GB is too big for the normal win recovery so must be a recovery partition set up for the laptop containing a disk image.

Untill he can get back in windows its hard to tell

I would be tempted to connect laptop to another machine extracted any data required (photos docs emails etc.) then use diskpart to completley wipe the drive and do a freh install from the boot media. That way he can be certain there is no lingering malware, trojans, keyloggers, etc.

  bob dob 19:40 18 Jun 2017

Apologies for the delay, yes, it found two Windows installations....

  Fruit Bat /\0/\ 22:31 18 Jun 2017

Possibly found the windows.old after an update

select the top one and see if it will repair and boot

  bob dob 23:12 18 Jun 2017

Hello. I have and it won't :(

  Fruit Bat /\0/\ 11:26 19 Jun 2017

HAve you tried the second? I assume you have and that won't repair either.

  bob dob 21:34 19 Jun 2017

I'm afraid so...... My friend says that there is no important data on there so which way would you advise going ahead with regarding a complete reinstall?

  Archonar 09:01 20 Jun 2017

To reinstall windows in this case I would say the best way is to use the windows 10 media on a cd / usb. That way you know you are getting a completely clean install. Click here for the download link.

I would also say that it would be a good idea to completely clean the hard drive first if there is definitely no important data. that way you won't get any lingering partitions. You can access the command prompt from the installation media I linked earlier, then follow this guide to clean the disk. Once that is complete restart the pc and you can reinstall a completely fresh copy of windows from the usb. This will remove all data completely so make sure they are happy with this being done before you do it!

To get to command prompt from the installation media, click "repair this pc" when the install screen comes up, then "troubleshoot", it may be under "advanced options". You can run diskpart from there.

  bob dob 18:32 25 Jun 2017

Great! I have now installed it, thanks to you. However - one problem now remains: It is asking for the Windows product key and there is no sticker on the HP laptop.....

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Elephone U2 Review

Ichijo Hikaru's riso print pop art is a celebration of the female body

New iPhone 11 (2019) release date, price & specs rumours

Les bons plans audio (2019)