Teamviewer scam - beware

ang said:

... He had already downloaded TeamViewer and given them the ID and passcode.
~~~
And if it is on the computer, can they still access the computer at any time or does TeamViewer generate a new passcode once the computer has been shut down?
~~~
I'm also not in the same state anymore, so I'm not able to look at the computer myself.) I'd appreciate any help you can offer.

Thank you!

Welcome to the Seven Forums.

As others have mentioned: the password/passcode that TeamViewer creates is indeed a temporary one. So, yes, TeamViewer generates a new password/passcode each time that TeamViewer starts. You don't even have to shut the computer down or even log off, just exit TeamViewer. When you restart TeamViewer, it will have a new password/passcode. Also, a remote person cannot run thru all 9999 possible codes to get back in. TeamViewer prevents such action really well.

However, TeamViewer can be configured to start whenever Windows starts. If TeamViewer is set to do this, it will ask for a new (permanent) password. The scammers might have set such a password and told TeamViewer to always start. It sounds like the Geek Squad uninstalled TeamViewer for you. Unfortunately, we do not know if the Geek Squad told the uninstall process to remove TeamViewer's settings. If TeamViewer's settings remain on the computer, then those old settings would be used again if TeamViewer ever got installed again. (The computer ID will most likely remain the same each time TeamViewer is installed.)

I would suggest that you call and have them re-install TeamViewer. Then you install TeamViewer for mac (Free TeamViewer Download for Mac). When they run into trouble, you can see what they see and maybe help them out a bit. You might not be totally up to speed on various Windows things, but we are here to help you with that.

If they install TeamViewer again, ask them if the password/passcode is four numbers. If it is, then TeamViewer is NOT set to start each time Windows starts. If TeamViewer is set to always start, then the temporary password/passcode that users see on the main TeamViewer screen will be changed to use 6 characters (a mixture of numbers and letters).

If you set TeamViewer to run all of the time on their computer - then you connect (and control it) at your convenience - thus allowing us to help you to help them. If you put TeamViewer in this mode, you will be selecting a password of your own to use. Please pick a good one

Thanks so much for the replies! That eases my mind.

I realize TeamViewer is a legitimate program, which is why I figured the Best Buy team would not have removed it. I just wasn't sure if it generated new passwords or if they could easily reconnect using the old one. When the scammer was controlling the computer, I clicked on a "terminate this session" or something similar, and it was just automatically reconnecting. That was when I turned off the computer.

Thanks for the warning about the Mac. I know they're no longer safe to viruses and scams. Though had I been the recipient of this phone call, I would have immediately known it was a scam and hung up. I just mentioned it because I've been out of the Windows world since XP and there have been a lot of changes with each subsequent operating system. I'm still quite unfamiliar with Windows 7 and where to look for installed programs.

Thank you Username Issues. I will call and have them re-install it and take a look at the passcode.

Actually, I just thought of something else. If he clicked "Join Remote Session" and only downloaded the Quick Support file instead of clicking the large Download button and installing the full program, that could be the reason it didn't show up in the program files. If he was just using the Quick Support, it couldn't be configured to start when Windows starts, could it?

My guess is that Geek Squad uninstalled TeamViewer once you told them that story about the scam.

You are correct, TeamViewer's QuickSupport app does not show in the list of installed apps and cannot (easily*) be configured to start when Windows starts... but it also does not go away on its own. The QuickSupport app installs into this folder...
C:\Users\username\AppData\Local\Temp\TeamViewer\Version9
...and remains there until it is deleted.

I would think that the Geek Squad's automated tools would have emptied the temp files.

*In theory, Windows could be told to automatically start this app in many ways - but this is very unlikely to have been done by the scammers - given their boiler room style of operating. They don't wish to spend much time with each user. They just want the money and run. Also, as far as I know, TeamViewer's QuickSupport app cannot be set to use only one password.


Edit: I should have offered a reason why TeamViewer does not remove its QuickSupport files from the temp folder once the QuickSupport app exits. The support tech (or scammer) using the TeamViewer can tell the remote computer (which is using the QuickSupport app) to reboot and automatically reconnect the remote control session. It can also reboot the computer into the safe mode and automatically reconnect the remote control session. One manual reboot by the computer being worked on will stop subsequent automatic reconnects by the QuickSupport app (or by the full TeamViewer app).

Was this...

robinb9 said:

That is true and not, you can set teamviewer to have a static password so everythime you log on, you do not have to put a new password in. As long as it is out of program and features it is gone but i would recomment your parents to change the computers password immediately just in case they put a program onthrough teamviwer and they are controlling it through this program

...in reference to to me saying this:
Also, as far as I know, TeamViewer's QuickSupport app cannot be set to use only one password.

Our new member (ang) first asked about TeamViewer in post #128 and how it acts on the computer being worked on. Britton30 answered ang's question while I was composing my long post and testing things

Then ang asked how TeamViewer's QuickSupport app would act on the computer being worked on. See post #134. As far as I know, TeamViewer's QuickSupport app cannot be set to make use of a static password. If this can be done, I would love to know how since TeamViewer's QuickSupport app has a much smaller footprint than the full install of TeamViewer. I would love to only install TeamViewer's QuickSupport app on the dozen's of computers that I support via remote control. As it is, I have TeamViewer's full app installed on each remote computer.


When the scammers took control of ang's parent's computer - they could have removed TeamViewer from the list of installed applications but not actually uninstalled it. ang wisely asked her parents to also look in the two program file areas. TeamViewer is nowhere to be found... so they are probably safe. I highly doubt that the scammers spend the time to walk their victims thru the process of installing TeamViewer into a non-standard folder location.

The scammers have little interest in breaking back in later. Their goal is to swindle the end user and move on to the next potential victim. Of course, a scammer could be working two jobs:
1) scamming folks
2) setting up bots
:-(


Thanks for suggesting that the user account password be changed. I should have thought of that