Will a recovery disk wipe my hijacked pc completely?

[McScooter]

Hi .. I need your help and guidance please. My idiot son took a bogus call from people saying they are from our ISP and they could improve our network speed if they could access our system remotely.
Yes, you guessed it, he let them in via “letmein123” and I’m sure they have installed loggers and whatever nonsense they install to get our details. So, I’ve now contacted the banks etc and got my banking stuff fixed and blocked.

I want to reload his Win7 64bit from scratch and want to know if a recovery disk will enable this. I’m not bothered about saving data, such as media files as he will need to feel the pain of being stuuupid. What I need to feel is safe and secure from a new reload that I’m going to completely wipe any files/programs they have installed.

So my question to the experts, if this happened to you how would you deal with it?

I have no doubt someone else on the forum will have posted a similar issue, maybe you can point me in the correct direction.

 

[logicearth]

So my question to the experts, if this happened to you how would you deal with it?

Format and install clean (Or from a known clean image). That is what I would do.

 

[Ivan the SoSo]

use this Eraser - Free software downloads and software reviews - CNET Download.com

 

[Imperfect1]

So sorry this happened to you McScooter. Don't forget to change all of your internet passwords as well as dealing with formatting and uninstalling/reinstalling, because the hijackers will probably have access to all of your original passwords and security information as well as all of your other data. And you may have to go so far as to change your credit card and banking accounts too, if that information was available in your system. The most important thing is to think carefully about what security information you have/had in your system, and anticipate that the hijackers could use that information to gain access to your accounts -- after all, that's probably why they did what they did!!!!

By the way, I've had my credit card and bank account hijacked several times in the last year (once through PayPay, which is supposed to be one of the most secure payment processing sites in the world!) -- so I'm very sensitive to and aware of just how aggressive and devious hijackers and other 'thieves' can be!!!!

 

[Julio Cortez]

Yes, Imperfect1 holds a good point: first of all, if you don't need to do backups, you may want to think about what you had on the HD that was sensitive and then give a call to the bank/credit card issuer/ISP to have your accounts checked.

Then, wipe your HD. I don't know if you have the time (and maybe it's also an overkill) but in case of malware attacks I always performed a "one-pass zeros" wiping before reinstalling (I worked as a PC techie for a small company so I had the chance to let it run overnight, because it may take also 3 or 4 hours for a 1TB drive).

Then I'd suggest you to re-install Windows creating two different profiles. An administrative one that you'll use yourself and a standard one, subjected to UAC, to let your son use the PC reducing the risk of being hit again.
I use a limited user account myself even if I also am the owner of the administrative one, so you may want to create also a standard account for yourself.

Then, change all of your passwords (no matter what they are for) as you'd be better safe than sorry.

 

[McScooter]

Thanks to everyone for the excellent posts, you have confirmed I need to wipe the image to a clean hardfile with not data and start again.

So, if I create a recovery disk from my system that has the same Win7 installed will that be sufficient to create a new image and from that I can reload my sons system?
Will I need to take a note of the product key or can I use the COA?

 

[mikedl]

Hi, McScooter! Welcome to the Seven Forums!

Use the COA.

Install clean from a Win 7 install DVD, however, since you haven't mentioned having a Win 7 install DVD am I to assume you do not? Is there a recovery partition on your son's PC?

 

[McScooter]

Hi There ... Yes, His Acer (Aspire 5738ZG) offers a recovery partition options. When you boot and press F10 it gives the following options -
Acer eRecovery:

• Plug in the AC adapter and battery, then turn the system on
• Immediately, press ALT on the keyboard and start tapping F10. Continue holding ALT and tapping F10 as the unit boots up.
• A screen stating "Starting Acer Erecovery" should appear. (Release ALT and stop tapping F10 at this point)
• There will be 4 options:
  1. Restore system to factory default
  2. Restore system from user backup
  3. Restore system from cd/dvd
  4. Exit

The first option looks the best, but will that give me confidence to know that the system really is clean?

 

[McScooter]

when i look at the first option in more detail it mentions -->

1. This action will erase all existing data on the c: drive.
2. This option will return your computer to a factory setting. All files, settings, updates and software installed since the computer was first used will be deleted.
3. We recommend this recovery if your computer is infected by a persostent virus or malware, or if other recovery options fail.

 

[Hopalong X]

Mc Scooter

That is the one you want.

Mike

 

[Ivan the SoSo]

After erecovery....Use malwarebytes and MSE scans to make sure your computer is clean... some of those problems can write themselves into the recovery partition

 

[McScooter]

Hi Mike ... Sorry if i'm asking dumb questions but is there no chance of the recovery files being corrupted by the hijackers?

I need to be 100% sure they will not be able to access remotly when i blitz and reinstall the Win & preload.

 

[Golden]

Hi McScooter,

Sorry to hear about your misfortune - you have definately come to the right place to get it fixed.

Mike is correct : run Option 1. The default factory setting will wipe all existing data from the partition, and then "reinstall" everything back to the partition that was current the day you bought the laptop. Since this pre-dates the trouble you had, it is unlikely that there will then be traces of the “letmein123” on the system.

However, Ivan has a good point : in the case of complex dialers/keyloggers it is possible that the recovery partition may have been infected. As Ivan suggested, you should scan the laptop once you have recovered from the factory settings. To do this please follow these steps:

1. Download and install MSE here http://www.microsoft.com/security_essentials/ - run a FULL scan
2. Also, as an added layer of protection, run this online virus scanner here Free ESET Online Antivirus Scanner
3. Download and install MBAM here Malwarebytes - run both the FLASH, and the FULL scan

Please ensure the virus/malware database are up to date before running the scans (there will be an option in MSE and MBAM to update to the latest definitions).


Please post back here once you have recovered to factory settings and performed those scan. There is one other security check I would like you to run after you have been able to recover and scan.

Regards,
Golden

EDIT : Also perform these same scans on any backup devices (external USB drives for example) once you get to the point where you want to attach them to your laptop again.

 

[gregrocker]

Yes there is a possibility the Recovery Partition itself is corrupted, but the factory bloatware itself is another form of corruption which slows Win7 from being the feather light instantaneous OS it is.

Here are suggested steps to getting a purrfect clean reinstall without the factory bloatware - allowing you to wipe the entire HD with zeroes to overwrite all factory code, corruption and infection: http://www.sevenforums.com/installation-setup/125874-re-install-windows-7-a.html#post1086729et

If you need more time to find a clean installer and want to proceed with the Factory Recovery for now, here are tips to tame the bloatware until you can get completely clean: http://www.sevenforums.com/installa...p-all-four-primary-partitions.html#post952573

You can also ask Acer Tech Support for a clean copy Win7 Installation DVD as they are actually required under their agreement with MS to provide one but find ways to avoid it so they can enforce the sponsored bloatware which provides their profit margin. Some have reported success by asking, however. If they take a hard line, then don't tell them if you clean reinstall so you can continue getting tech support.

 

[McScooter]

Hi Golden .... I've ran all the scans and the good news is nothing has appeared ... So, what next please?

 

[Golden]

Excellent.

Please remember that you need to make the worst assumption that every USB device (external drives, thumb drives, sticks etc.) plugged into the PC are potentially also infected and should be also scanned with the same rigour as the PC. Likewise, if you had other laptops/PC's connected to the same network.

The last test I would like you to run is a vulnerability check to intrusion on the ports of your router. To do this, please follow these steps:

1. Open this web page https://www.grc.com/x/ne.dll?bh0bkyd2
2. Select Proceed
3. Select All Service Ports

The site will now check whether you have any open ports on the router that can be used to gain access to your system. If you get the results as shown in the image, your system is locked down tight, which is the way you want it.

The last thing I think we should do, is ask one of the security experts here to have a look at my suggestions to make sure we haven't missed anything - I'll ask if anyone is available to do that for you.

Please keep the following up and running at all times:
1. Windows Firewall
2. MSE
3. MBAM (consider a purchase to have it resident in memory and auto updating)

Regards,
Golden

 

[Hopalong X]

I have had HP computers in the past with recovery. I never had anything enter the recovery section.
99.9% safe.

Turn on Windows Firewall and download MSE. That will give you active protection
Then a run of Malwarebytes etc. when done installing is a good idea just for peace of mind if nothing else.

Golden's above posting is right in ext HD or Flash drive being infected is highly likely.

Mike

 

[McScooter]

Hi Golden ... So i ran the app and all ports were found to be in stealth mode .. Good.
However Trustealth failed as a ping reply was received back. IS that an issue i should worry about.

Results from scan of ports: 0-1055

0 Ports Open
0 Ports Closed
1056 Ports Stealth
---------------------
1056 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: FAILED - ALL tested ports were STEALTH,
- NO unsolicited packets were received,
A PING REPLY (ICMP Echo) WAS RECEIVED


Rgds ,,, Stuart

 

[Golden]

Hi Stuart,

No, I don't think its a big issue, but I wouldn't mind a second opinion on that.

Am I right in saying you got your router from your ISP (or maybe they helped you set it up)? They leave these ports open so they can ping your router when you ring them for support. I close mine entirely so that I don't even seem to exist - its the equivalent of removing your telephone number from the directory to avoid cold calls. If you want to place them into stealth, we can do that via the router - what make & model router do you use?

Apart from that, you are locked down nice and tight now - its looking good. Whilst we wait for a security expert just to review this, I suggest starting a scan of all your external USB devices.

Regards,
Golden

 

[McScooter]

Hi Golden .... You are correct i have a BT 2wire HUB (2700HGV Business HUB) and if it is possible i would like to be in complete stealth mode. The bad news is i now need to start on my WD NAS drive which was connected at the time, i work from home a lot and use this to link in if i'm away on business. Fingers crossed it's not infected ... b