HN Explorer

Ask HN: Dad fell for tech support scam. How to help him several states away?

8 points by chrisgd ↗ HN
We already called his credit card company to dispute the charge and get a new credit card? It is a new computer that I helped him pick out. Somehow, he got on the phone with someone claiming to be from microsoft, gave them access to his computer. Would a full windows reinstall be enough to remove any software installed?

10 comments

[ 3.2 ms ] story [ 33.6 ms ] thread
leesalminen
Yes, most likely a full HDD wipe would suffice.

I'd do a quick google on the make/model/OS of the system to see if it ships with a restore volume. If not, walk him through the DVD restore.

brudgers
The degree of compromise depends on the sophistication of the attackers. It might just be unnecessary credit card charges. It might be that plus full system control.

My take is that the only way to assess the level of compromise is to see if Intel's Asset Management Technology [1] has been enabled. That means looking at the BIOS. It might be easier to ship the computer back and forth than to walk through diagnosis and repair.

Good luck.

[1]: https://en.m.wikipedia.org/wiki/Intel_Active_Management_Tech...

paulcole
The idea of the hassle of shipping a computer back and forth plus fritzing around with it? I'd just buy my dad a new computer and call it a day. Plus I'd tell him this is his mulligan :)
brudgers
I was going to suggest that as an option, but it wouldn't be viable for everyone, or make economic sense for a high end Windows box. So I didn't.
saluki
Is it still in the return window where you could return it and start new fresh out of the box?
chrisgd
Good question. I will have to find out. Thanks for responding.
vonklaus
This happened to me and you can see the community response in my submission history. First, this totally fucking sucks and I am sorry this happened. The short term technical fix is pretty trivial, but there are some important gotchas:

* depending on what data was there it may be possible to file an early tax-return, thus they could capture your fathers tax credit if applicable. File on the appropriate date.

* monitor his credit. This can be done for rather cheap or you can pull them manually.

* often, they will capture the contacts of all of your fathers correspondents. This is often a vector for follow on scams. They typically use this as an infection vector or to ask for money in the typical :relative in danger abroad" type scam.

* reinfecting the computer periodically and asking for follow on help.

As mentioned, it is probably a good idea to dump the entire hard drive and reinstall the operating system after backing up only necessary files/data. I ended up buying a mac for my grandmother, but others suggested google chrome / chromeOS type operating systems as they often limit the users ability to compromise the machine but have a limited tradeoff vs. their actual requirements.

If you have any follow on issues, as someone who had to deal with this like 2 months ago, feel free to shoot me an email if you have any other issues: klevvver@icloud.com

chrisgd
really appreciate your offer. We did a full reinstall of Windows 10 and are looking into his credit monitoring options. Thanks