Notice of using someone else's connection does not go away...

[cottonball]

Hi, folks!

Would appreciate your thoughts on the following...

Have a friend (senior citizen) who has Charter as his ISP, and on Monday he was on the web looking for some info. A notice appeared on the screen (he thought it was from Charter) that the computer was heavily infected, and he needed to get the infection removed. Of course, remote access to the computer was necessary, and he agreed. He was shown a group of locations where the malware was, and then was asked for $149 to do the removal. This is when he realied he had been taken. He shut down the computer, and did not return to the machine for a few hours.

However, later on, whenever he attempted to get on the Internet, a notice came up saying that he is using someone else's connection. He has not been able to use the computer without this notice coming up, and he has no clue as to how to get rid of it. Normally, when this notice comes up, you are connecting to the service of someone who is within range.

Any suggestions as to how to get rid of this notice?

Thanks in advance for your help.

 

[Layback Bear]

I would start with shutting down the computer, modem and router.

Then I would boot the modem, then the router and boot the computer.

Then I would look in msconfig Startup and Services and see if their is anything strange.
You might have something that is starting with every boot.

Is it possible when this little pop up happens to right tick and select properties and see if any information can be found. Possible just hover the cursor over the popup and get some information.

What anti virus program is being used on this computer?

Their is a very good chance the phone call crook got remote access and installed something and the that something is calling home.

You could use this tutorial by Brink and check and see if all remote access in
Services are set to default.

http://www.sevenforums.com/tutorials/236709-services-restore-default-services-windows-7-a.html

If nothing else a Clean Install would solve the problem if the problem is in the computer and not in the router or modem.

 

[cottonball]

Thanks for the info, LB!

There was no phone call, everything happened online, and, remote access was obtained. Also, the crook apparently knows the IP address.

The question is, could something wrong with the router or modem bring about the notice of using someone else's connection? If so, what could be wrong with either of these two devices?

 

[Layback Bear]

I'm not expert on routers but I have PM some one I think can help.
Better safe than sorry. I really don't know all the things that can be done by a crook with remote access.

I highly recommend changing all password to everything. If the computer has any financial information I would call all credit card companies and banks and inform them the computer has been hacked.

I don't use wifi in any way. Not even across the room to a printer. So I bow to those who do and let them give guidance.


Note:
I don't believe a modem or router problem would display a pop up on your desktop.
The anti virus program might be displaying the pop up.
The anti virus program logs may give some clue.

 

[2xg]

Hi cottonball,

Ladyback bear has some good suggestions, but personally I'd do a clean install if his computer has been hacked. As soon as his computer is all up and running, have him install a great Security program and he needs to be educated on internet cyber attacks and security precautions/preventions.

Hope this helps.

Ray

 

[Barman58]

Cottenball,

One thing that could perhaps find the actual issues that is causing the pop-up(s) [ I am almost certain that this will be something on the actual system not a router hack], is to treat it as any other malware infection, as these scams are aimed at less experienced users it's often the case that the actual hijack is not that sophisticated - I would leave the choice of the monitor/ log application to you if you decide to go this way

One tool I use extensively is actually from Microsoft - Autoruns - You can consider this as a sort of MSConfig on steroids It has full documentation on the linked page and will allow you to disable or remove anything that starts with windows - this includes addons for browsers which are often the cause of this sort of hijack It is not designed as a malware removal tool but due to the team that built it's vast knowledge of how windows operates it can be usefull.

 

[Layback Bear]

Just a thought but probably not likely.

Is it possible for a hacker with remote access to change the router password and settings?
I also believe this is a low level attack and it's on the system somewhere.

The safest way and the quickest would be a Clean Install.

My reasoning for the Clean Install is because if a infection has got on a system and found you have a good idea what is was designed to do. When remote access has happened you don't know what that person has done, therefore less than a Clean Install always leaves a little doubt if everything has been found.