About 4 years ago I was having a problem with my Microsoft Windows system so I went to Google and searched "Microsoft tech support phone number" to see the results and got the number from some random site and I didn't check it to verify. (Yes I know it was a bad idea, but that's not the question.)

One the phone I detailed my problem and the agent downloaded a program and was doing some remote repair operations some was taking long so to pass the time he decided to have more of a friendly type conversation with me asking things like "What school was I going?", "What are your grades" and other personal information not related to tech support or my problem.

Is this friendly conversation really a trick he was using to get me to build my trust with him so he can social engnieer me into giving more sensitive information?

  • 2
    Reinstall your operating system. Your computer is likely compromised. – forest Feb 20 at 3:58

Major Problem Potential

First, you need to determine whether or not that phone number was a legitimate Microsoft support line. I suspect it wasn't because Microsoft doesn't normally remote into your machine.

Second, if you didn't pay for him to fix your computer then you're already in trouble. No one works for free. That includes major corporations and scammers.

If you gave an unknown person access to your machine, you have already been the victim of a social engineering attack. He doesn't really need to come back later, as he's already done everything he needs to.

Probable Event

Most tech support scammers do one of two things: convince you to pay them money or install a backdoor that gives them continuous access to your machine. Some of them do both. If this was not an actual Microsoft person, this has almost certainly occurred.

Different attackers have different goals, so there is no way to guess what his malware will do. Ultimately, you'll have to assume the worst and address all possibilities.

There are, however, a number of common outcomes:

  1. Your PC becomes a member of the attacker's botnet. It will attack web sites, send spam emails, and take other actions as directed by his command and control servers.
  2. Your PC has a remote access trojan/tool (RAT) installed, and the attacker will personally use your computer in some way---spying, stealing account info, using as an intermediary when hacking other systems.
  3. The attacker has installed cryptoware, and your files will eventually become inaccessible unless you pay him.
  4. The attacker installed adware/spyware, which tracks your activity and loads/embeds ads into web pages in order to generate revenue.

It is definitely possible to mix and match from this list, and there are other possibilities. These things offer the most payback.

Responding to the Event

In the very likely case that this person was not a Microsoft employee, you need to act immediately to preserve your data, sanitize your system, and secure your accounts. This may take some time and money, depending on your personal habits.

Preserve your data. Create new backups of important files, preferably on write-once media like CD-R, DVD-R, or BD-R. USB drives are an acceptable alternative, but I wouldn't connect any device with "untainted" files to this computer. Cryptoware will encrypt anything it finds, so old copies of your files should not be made available to this machine until it is sanitized.

Sanitize your system. You will basically want to wipe everything and reinstall Windows from scratch. Installation discs can be ordered from the manufacturer if you don't have them handy. You can also download a bare Windows 10 installer from Microsoft, but you should do so from another PC---one that is presumably clean.

Secure your accounts. You will need a clean computer for this. Use another machine right away if you have one, or do it from this PC after you've wiped it. Log into all of your accounts and change your passwords. This includes email, social media, bank accounts, etc. If possible, kill all other active sessions. E.g., Facebook lets you see where you're logged in and terminate those sessions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.