Dealing With a Computer Which Is Likely to Have Been Compromised

by Dennis Halnon of TAB Computer Systems, cohost of Computer Talk with TAB

By “compromised,” I mean a computer that malefactors are known to have connected to in some way. They may have directly accessed it using remote-connection software, or may have been invited in by a user, or something else may have allowed them access.

The general approach is to secure the computer, remove any malware that may have been left behind, and secure any online accounts they had an interest in.

Note: This guide is intended for home computers. Business computers that may have been compromised should be handled by I.T. professionals, according to company policies and based on security tools in place on the device and the company’s network.

Plan of Attack (In Summation)

1. Remove the affected computer from any network.
2. Find access to the Internet from another safe computer.
3. Get a USB stick.
4. On the safe computer, download one or two tools to clean the affected computer.
5. Use USB stick to move it/them to the affected computer.
6. Install tools to clean the affected computer and run them.
7. Connect affected computer to network and Internet.
8. Run malware scanner a second time.
9. Once computer is clear of malware, change user account password.
10. Also change any online credentials the malefactor may have been interested in.

Procedure to Do All of the Above

An Initial Consideration — Before Doing Anything Else

Before undertaking this procedure, consider simply reformatting the computer and starting over. Do this, if:

• You have very few applications installed on the PC and possess installers for any you do have.
• You have a good backup of your own user data and have tested restoring it, so you know it can be retrieved reliably.
• or, you already keep most or all of your user data “in the cloud” (on Onedrive, Google Drive, etc.) or on an external or networked drive.

It’s possible to go through the process of “cleaning” the computer — which I get to below — but a more efficient way to ensure the malefactor will no longer have access to your computer or have any malware left behind on it, may be to reset it, clear out all data on it, and start over fresh.

• Microsoft has a tech support article on this process, if you want to go this route: https://support.microsoft.com/en-us/windows/give-your-pc-a-fresh-start-0ef73740-b927-549b-b7c9-e6f2b48d275e
• Your computer’s manufacturer may also have a tech support article you can consult.
• If the computer is under warranty, you might want to work with tech support from the manufacturer, in order to complete this process.
• Once you’ve finished factory-resetting the computer, thus locking out the malefactor, continue with securing your online accounts (steps 22 and 23 below).

Continuing With the Process

Assuming you don’t want to factory-reset the computer, here’s how to proceed.

1. Disconnect the affected computer from the Internet and any network it’s on.
   1. Wired connections: Unplug the Ethernet cable.
   2. Wireless connections: Click on the wifi symbol at lower-right of your screen. Then click on your wifi connection name and Disconnect. Or click on the Airplane symbol to turn on Airplane mode.
      1. If you can’t get into the computer at all or don’t wish to attempt using it, change the wifi password on your router, access point, firewall, etc. in order to cut the compromised computer off from it.
2. Obtain a USB stick, and access to another, known-secure computer that has an active Internet connection.
3. Plug USB stick into the safe computer and download Malwarebytes installer via the following: https://www.malwarebytes.com/mwb-download/thankyou
4. Do the following two steps only if you interacted with malefactor and he/she used remote-connection software to get on it, and it wasn’t “Quick Assist” which is built into Windows.
1. Make a note of the name of the program the malefactor used to get into the computer.
2. Download Revo Uninstaller via the following: https://www.revouninstaller.com/start-freeware-download/
5. Both of these are direct download links that will leave files in your Downloads on the secure computer you’re using.
6. Copy Malwarebytes installer, and Revo installer if needed, to the USB stick. Remove it, then plug it into the affected computer.
7. Only if you had to download Revo Uninstaller because the malefactor may have interacted with your computer:
   1. On the USB stick in the affected computer, run the Revo installer program.
   2. Open Revo Uninstaller and wait while it completes its list of installed programs.
   3. Click on the name of the program used by the malefactor to get onto the computer, then click Uninstall in the toolbar at the top of Revo window.
   4. Click Continue; this will create a restore point then launch that program’s uninstaller. You will probably have to respond to prompts to confirm removal of the program.
      1. I can’t tell you in advance what those prompts will be (if there are any). Just respond in whatever way allows the uninstallation to finish.
   5. One that’s finished, back in Revo, click on the Advanced button in “Scanning modes” then click Scan.
   6. You may be presented with one or more lists of leftover items. For each of these windows that come up, check off all the boxes next to the items, then click the Delete button. Confirm you want them deleted.
      1. The number of lists you’ll see may vary. You’ll likely see a list of registry entries, then a list of files and directories. There might be others.
      2. Whatever is listed, should be removed. Don’t hold back.
   7. When the last window has come up and all leftover items have been removed, click Finish.
   8. Also remove any other remote-access programs that Revo has found. Some of them are: TeamViewer, AnyDesk, GotoMyPC, Logmein, Join.Me, RustDesk, Google Remote Desktop, and VNC. Some of these may have extra words in their names, particularly VNC (there’s UltraVNC, TightVNC, etc.) Remove any of those in the same way as above (steps c through g).
   9. This will cut off any software the malefactor may have left behind to get back onto it later.
8. From the USB stick on the affected computer, run the installer for Malwarebytes.
9. Click the option for Home users (because that’s what you are). You won’t need to allow installation of any added components (such as their browser extension). Confirm you want to use the software.
10. Run Malwarebytes (it should have invited you to launch it at the end of install process).
11. In its Dashboard, click Scan.
    1. It may warn you that you don’t have the latest definitions; that’s OK for the moment, you’ll scan later, a second time, once you can update them.
12. Allow Malwarebytes to finish. Have it quarantine everything it finds (it might not find anything). Note, not everything it does find may relate to this incursion, or even be particularly dangerous, but quarantine everything it finds, anyway.
13. It will likely tell you to reboot in order to complete removal; do so.
    1. In fact, reboot even if it finishes without telling you to do so.
14. Reconnect the affected computer to its network, either by turning off Airplane mode and reconnecting to wifi, or plugging the Ethernet cable back in.
    1. Be prepared to disconnect from the network quickly, if you should see anything unusual come up.
15. Wait a few minutes (up to 5) to allow the computer to connect to the Internet.
16. Open Malwarebytes and run a scan again. By default it should start by updating its definitions and will tell you it’s doing so.
17. As before, once the scan is complete, have it quarantine everything it finds, assuming it did find anything to remove (it might not).
18. Reboot the affected computer even if it doesn’t tell you to, and uninstall Malwarebytes. You no longer need it and it might prevent Windows Defender from working correctly.
19. If neither of the two scans turned up any threats, consider using an online scanner to give a second opinion; choose from one of these:
    1. ESET Online Scanner, via https://www.eset.com/int/eset-online-scanner/. Click “SCAN NOW,” run the downloaded file, then follow prompts.
    2. Trend Micro HouseCall, via https://www.trendmicro.com/en_ca/forHome/products/housecall.html. Click “Windows/Mac,” run the downloaded file, then follow prompts.
    3. Whichever of these you use, have it do as thorough a scan as possible. These scans may take a long time, so be patient.
    4. As with Malwarebytes, have the tool quarantine or remove everything it finds. Reboot when finished.
    5. If the program installed itself to your PC, use Revo Uninstaller to remove it. (As with Malwarebytes, you no longer need it.)
20. On the affected computer, change your local user-account password. Microsoft has a tech support page about doing this: https://support.microsoft.com/en-us/windows/change-or-reset-your-windows-password-8271d17c-9f9e-443f-835a-8318c8f68b9c
    1. You may think you should have changed your local password from the very start. That would have been unwise, however, if the computer were still compromised at the time you change it. Best to reset passwords after removing any compromises.
21. This may entail changing your Microsoft Online account password and PIN if you use one to login.
    1. Yes, reset both password and PIN.
22. That in turn might affect other devices you connect to that account with (smartphone, tablet, etc.) so carefully note your new password — in writing — in a safe place, and update password manager if you use one.
    1. If you have a Microsoft Online account that you connect to on your computer at all, such as to activate Office applications or sync Onedrive, you should reset that account password anyway.
23. Also change passwords for any and all accounts the malefactor was interested in, including email accounts, banking accounts, e-commerce accounts (Amazon, etc.).
24. If you haven’t already done so, configure multi-factor authentication for all of those accounts as well as your Microsoft Online account if you use one to login to the computer.
    1. Consult https://2fa.directory/us/ to find out how this is done for each site or service you use.
    2. Microsoft’s 2FA can be set up from here: https://support.microsoft.com/en-us/account-billing/change-your-two-step-verification-method-and-settings-c801d5ad-e0fc-4711-94d5-33ad5d4630f7
    3. I recommend using Microsoft’s own authenticator app for this.
    4. If you have a Google/Gmail account, use Google’s own authenticator.
    5. Yahoo/AT&T/snet.net/SBCGlobal accounts can use any of the Yahoo apps for this (Yahoo News, Yahoo Sports, Yahoo Mail, etc).
    6. Yes, your phone may end up with an array of authenticator apps. Note that some can be used for multiple services, so you may be able to limit the number that are needed on your device.
    7. As with passwords, write down the 2FA method used with each service. Also write down (as in step 21) any offline or bypass codes that may be generated.
    8. For more information about setting up and managing two-factor or multi-factor authentication on your accounts, see my guide on the subject.

Desired End Result

The goal here is to prevent the malefactor from accessing the machine again; remove any malware he or she may have left behind on it; reset passwords on the computer itself; and reset passwords and lock down other accounts using 2FA, so malefactor can’t access those.

If all of this sounds intimidating, I apologize, but these steps are all necessary, especially the last ones. Your accounts will need to be re-secured in order to lock out the malefactor.

Back up to the Tech Advice Web Site