Fake Microsoft phone call

[DextrousDave]

Hi All

I read the following post : Fake Microsoft PhoneCalls - Page 3 - Tech Support Guy Forums
on the Microsoft Phone scams. Now in this post Eddie5659 posted about running OTL on the infected PC... but that was basically where the physical tech support ended...

My brother had a similar call, but what is different about this one, is that they actually had remote access over the PC, without my brother allowing them ANY remote access as with Windows Remote Assistance and Remote Desktop...

They called him, and told him they will show him his PC is affected with viruses and that his windows has expired (which is not the case...) and they remotely installed PC tuneup software etc. without Any computer consent

Now, since he is using Windows 7 Home Basic, Remote Desktop connection is not possible TO my brothers PC, and Remote Assistance needs to be authenticated by my brother first. Now the only way I think they got access is either via a trojan horse or they hacked his WiFi, which was not password protected, and the Router had 'admin' and 'admin' for username and passw. He had windows firewall enabled as well as MS Security Essentials at the time of the hack

Now, what I would like to know is, how can I close off their access to my brothers PC? I did the following: Restored the PC to 2 weeks earlier, secured the Router with an admin username and good password and I changed the WiFi security to WPA-2.

What else can I do to remove any malware they might have installed like rootkits/backdoors/trojans etc? I did a virus scan with Security Essentials, but nothing found...

Thank You!!

 

[Jacee]

Take a look and see if there are any strange 'services', or unknown 'services' running at start-up.

 

[DextrousDave]

Cool thank you. But there are many services, and some of them look strange, while they are not, like for instance the csrss.exe process...Anything more specific I can look for or maybe some kind of scanner and list to check against for known trusted services?

Thank you