Troubleshoot someone remoted in without allowing them access

[Rozesky2]

my friend was using her browser when a page popped up on her screen saying that she had a virus, and to call a number. She did call the number and of course they said she had a bad virus and wanted money. She said no but then they took over her computer and used the mouse. They Told her what her passwords were for places. She hung up on them BUT how did they get into her computer? She did no allow access



I am going to run a recovery on her computer. Are they getting into her computer through the adobe flash hack? Is running a recovery the best way to fix this problem? This is actually the 2nd friend this happened too. The hackers were in her computer without her allow remote access. I find this very scary.



Please advise me what to do to fix this and how to stop this from happening a gain if I can

 

[shmu26]

Returning to an earler Windows restore point is not guaranteed to eradicate the problem.

 

[Rozesky2]

That is a good point which is why I am doing a recovery reinstalling Windows 7

 

[Amelith Nargothrond]

If you have no earlier image backups, i suggest to format the system partition and reinstall windows, although you could also try to run an on-demand scanner in safe mode, but i wouldn't feel safe with the latter.

 

[Rozesky2]

If you have no earlier image backups, i suggest to format the system partition and reinstall windows, although you could also try to run an on-demand scanner in safe mode, but i wouldn't feel safe with the latter.

Yes a reinstall is what I am going to do.
I wonder if this happened because of the adobe flash problem?? how does a hacker get into a computer remotely without someone giving them access

 

[Amelith Nargothrond]

Yes a reinstall is what I am going to do.
I wonder if this happened because of the adobe flash problem?? how does a hacker get into a computer remotely without someone giving them access

Exactly how they did it (the method) i could not know. But i'm guessing they exploited some flash (if it was flash) vulnerability you had (they got lucky somehow, or they have some new exploits) and detonated a payload. The payload is what they used to remotely connect (if this is what they did). I can look for some vulnerabilities if you want too.

 

[shmu26]

There are plenty of ways for hackers to get into a computer. It's hard to know on someone else's computer what the reason was, we can't know what they did wrong.

A reinstall is the right way to deal with it.

In order to prevent it from happening again, the very first step is to keep the operating system and software updated.
The second step is to teach the user proper computer habits.
The third step is to install proper security software, and educate the user not to ignore warnings from their security software.

If they are click-happy, then you have to put them in a lockdown setup, for instance, Voodooshield on automatic pilot, or Comodo firewall with autosandbox enabled, or Avast hardened mode/aggressive + disabling the wscript files.

And don't use Windows XP. It is too hard to make it secure. Windows 10 is the most secure Windows operating system, so if you have a choice, show a preference for Win 10.

 

[Amelith Nargothrond]

Off topic:
@shmu26 , are we allowed to post here (malware removal assistance)? last time i think i was not allowed (when i joined MT). 10x

 

[Rozesky2]

Off topic:
@shmu26 , are we allowed to post here (malware removal assistance)? last time i think i was not allowed (when i joined MT). 10x

Well I really wasnt looking for malware removal , just how to the computer was remoted into, I am doing a reformat to take care of the issue.
I was just really bothered by the fact my friends computer was taken over and she did not allow remote access. They even told her passwords for accounts. I was hoping to find out if they happened because of the adobe flash vulnerability?

 

[shmu26]

Off topic:
@shmu26 , are we allowed to post here (malware removal assistance)? last time i think i was not allowed (when i joined MT). 10x

Forgot about that...
In this case, the OP is not going to remove malware, so I hope my comments were not too intrusive.

 

[Rozesky2]

There are plenty of ways for hackers to get into a computer. It's hard to know on someone else's computer what the reason was, we can't know what they did wrong.

A reinstall is the right way to deal with it.

In order to prevent it from happening again, the very first step is to keep the operating system and software updated.
The second step is to teach the user proper computer habits.
The third step is to install proper security software, and educate the user not to ignore warnings from their security software.

If they are click-happy, then you have to put them in a lockdown setup, for instance, Voodooshield on automatic pilot, or Comodo firewall with autosandbox enabled, or Avast hardened mode/aggressive + disabling the wscript files.

And don't use Windows XP. It is too hard to make it secure. Windows 10 is the most secure Windows operating system, so if you have a choice, show a preference for Windows 10.

There are plenty of ways for hackers to get into a computer. It's hard to know on someone else's computer what the reason was, we can't know what they did wrong.

A reinstall is the right way to deal with it.

In order to prevent it from happening again, the very first step is to keep the operating system and software updated.
The second step is to teach the user proper computer habits.
The third step is to install proper security software, and educate the user not to ignore warnings from their security software.

If they are click-happy, then you have to put them in a lockdown setup, for instance, Voodooshield on automatic pilot, or Comodo firewall with autosandbox enabled, or Avast hardened mode/aggressive + disabling the wscript files.

And don't use Windows XP. It is too hard to make it secure. Windows 10 is the most secure Windows operating system, so if you have a choice, show a preference for Windows 10.

Thank you after the reinstall I will make sure everything is up to date

 

[Ink]

Off topic:
@shmu26 , are we allowed to post here (malware removal assistance)? last time i think i was not allowed (when i joined MT). 10x

You cannot post under MRA, see the Guidelines. However thread was moved to Troubleshooting.