3 ms·

After doing this, on the technical side: 1. Disconnect the hard disk, and image it using a clean host machine. Since the attackers had full admin-access, you'

After doing this, on the technical side: 1. Disconnect the hard disk, and image it using a clean host machine. Since the attackers had full admin-access, you'll want an image in case they deleted anything (and to perform forensics if you care). 2. Wipe the hard disk and re-install Windows 10, there is no other best practice here. As others have said, there are too many places to hide trojans and malware, and all bets are off now that the machine was compromised.

vonklaus 10y ago
hahah thanks. It's funny, i look at it the same way. I am fairly technical. I feel confident I could fix the issue technically(install new reformatted HD & RAM, security programs, ect) but I am more concerned with: * Was this the whole attack? Or was this stage 1, and they are going to sell/use data for identity theft. * Use contacts info to try and scam friends/family * Worth reporting to build narrative for the future if needed to prove identity theft leter? * What a 'typical' scammer business model is * If there is a simple way to check if they have active malware installed. I could never be comfortable with the old hardware, but I would suggest credit monitoring ect if I could verify 100% they either downloaded all the data or backdoored it. I could do this on mac/linux and probably figure it out on windows, i just don't want to freak her out. Do you think it is worth trying to tcpdump and look at the sys logs and stuff and trying to diagnose that they did more than just scam? If I knew they did, I would get lifelock for her or something, but when the friendly support rep(the hacker) told her there were 26 hackers currently on her computer and he was fixing it for her, she was obviously super concerned.
- optimiz3 10y ago
  You can always re-use the hard-drive after you've created an image of it - but the image gives everyone peace of mind if you ever need to recover/investigate something after the hard-drive is wiped. This way you can also put the image on a flash drive or Blu-Ray so you don't have to keep physical possession of hard drive/data which sounds like it is important. I believe tcpdump only helps you if the attack is ongoing, since this is after-the-fact, having an image you can analyze later is probably your best bet.
  - vonklaus 10y ago
    yeah that was my thought. I don't have a sata, but I do have a compatible HD with a windows install laying around, so I put as much of her data as I could into the cloud and maxed out a MS OneCloud 5gb for backup, then swapped drives. she couldn't handles the windows 10 upgrade, so I had to swap back, but I was thinking that keeping the drive as a backup/diagnostics would be best bet. Also, I wanted to replace the ram chips incase they persisted malware to them, but I was holding off to see how serious everyone on here thought it was. What is the windows equiv of stuff like: $ tcpdump $ ps aux ect. and the system level process directories like /Library/PrivilegedHelperTools /Library/LaunchDaemons ect. I guess, i'll just take a peak now. It would be worth spending an hour or so if I could know without a reasonable doubt that they did install malware. If I can't find something obvious, I'll still do clean install.
    - wiseleo 10y ago
      Definitely no need to replace RAM. Reading cold RAM chips is a valid attack, but it doesn't apply in your case. :)
- projectramo 10y ago
  Oh yeah, and email her friends and family asking them not to wire money to her in Ireland when the scammer claims she has gone on a trip there and has fallen ill in a few months.

vonklaus 10y ago

hahah thanks. It's funny, i look at it the same way. I am fairly technical. I feel confident I could fix the issue technically(install new reformatted HD & RAM, security programs, ect) but I am more concerned with: * Was this the whole attack? Or was this stage 1, and they are going to sell/use data for identity theft. * Use contacts info to try and scam friends/family * Worth reporting to build narrative for the future if needed to prove identity theft leter? * What a 'typical' scammer business model is * If there is a simple way to check if they have active malware installed. I could never be comfortable with the old hardware, but I would suggest credit monitoring ect if I could verify 100% they either downloaded all the data or backdoored it. I could do this on mac/linux and probably figure it out on windows, i just don't want to freak her out. Do you think it is worth trying to tcpdump and look at the sys logs and stuff and trying to diagnose that they did more than just scam? If I knew they did, I would get lifelock for her or something, but when the friendly support rep(the hacker) told her there were 26 hackers currently on her computer and he was fixing it for her, she was obviously super concerned.

optimiz3 10y ago
You can always re-use the hard-drive after you've created an image of it - but the image gives everyone peace of mind if you ever need to recover/investigate something after the hard-drive is wiped. This way you can also put the image on a flash drive or Blu-Ray so you don't have to keep physical possession of hard drive/data which sounds like it is important. I believe tcpdump only helps you if the attack is ongoing, since this is after-the-fact, having an image you can analyze later is probably your best bet.
- vonklaus 10y ago
  yeah that was my thought. I don't have a sata, but I do have a compatible HD with a windows install laying around, so I put as much of her data as I could into the cloud and maxed out a MS OneCloud 5gb for backup, then swapped drives. she couldn't handles the windows 10 upgrade, so I had to swap back, but I was thinking that keeping the drive as a backup/diagnostics would be best bet. Also, I wanted to replace the ram chips incase they persisted malware to them, but I was holding off to see how serious everyone on here thought it was. What is the windows equiv of stuff like: $ tcpdump $ ps aux ect. and the system level process directories like /Library/PrivilegedHelperTools /Library/LaunchDaemons ect. I guess, i'll just take a peak now. It would be worth spending an hour or so if I could know without a reasonable doubt that they did install malware. If I can't find something obvious, I'll still do clean install.
  - wiseleo 10y ago
    Definitely no need to replace RAM. Reading cold RAM chips is a valid attack, but it doesn't apply in your case. :)
projectramo 10y ago
Oh yeah, and email her friends and family asking them not to wire money to her in Ireland when the scammer claims she has gone on a trip there and has fallen ill in a few months.