An acquaintance of mine got a call from an alleged Microsoft employee and provided him access to his Windows 10 computer via team viewer (commonly known as the tech support scam). But when the scammer wanted to send him a file he got suspicious and immediately shut down the computer before anything could be sent. He did not give away his credit card number or any other personal information. Afterwards he immediately changed his passwords from another computer and did not connect the affected computer to the internet since. He asked me for help now, but I am not sure which steps are necessary.
- Do you think the computer could be infected? A team viewer remote session was active, but as I told, no file was sent. Is it still possible to infect a computer?
- My plan is to start a live CD and run a virus scan, but I am not sure if it is necessary to erase the whole disk. Would be the safer way, but also much more time consuming.
- Is it possible that the router could have been infected? I want to check the DNS settings, is there anything else I should check? Or should I completly reset the router?
Would be nice if someone gave me some hints and advice. I don't think the question is a duplicate of these two:
- what to do after a "tech support" scam
- Help! My home PC has been infected by a virus! What do I do now?
Because I'm more interested if it was possible to infect the computer without sending a file rather than about what to do if there is a virus on the computer.
PS I'm from Germany, it seems like the tech support scam has reached non English speaking countries as well...