My wife had a popup on her old Windows Vista laptop (which I've been threatening to switch to Ubuntu Linux). It appeared to come from our ISP, and informed her that she was hacked, and to call a number. An Indian guy answered, told her to go to a site (lmi1.com), gave her a code, and told her to input it to download a program and run it, which she did. He told her she was hacked and it would cost lots of money to fix.

That was when she finally decided to call me at work, and after she finally told me about downloading the program, I immediately told her to disconnect it from the internet and turn it off. I told her to call our ISP to confirm that it was a scam/hack. They confirmed that it was not associated with them. We have an always on connection, which might explain why they targeted us.

She told me she was already logged in to her gmail account, but didn't log into any accounts after her interaction with this hacker.

I've been to the bank to shut down internet access for our bank accounts until we can deal with this further, and confirmed that the accounts were not accessed online since well before the attack.

We're going to back up her files (via a Linux live-desktop), and she's getting a bright shiny new operating system by the end of the weekend, and she won't be using the laptop until then.

My question is: What should we do now?

We don't need new bank account numbers, I think that would be an impotent action regardless, right?

It's conceivable they accessed her email from her computer (since she was logged in).

It's possible they downloaded files. I don't know if she had anything with social security numbers on it, but she might.

It's possible they began encrypting her files for the purpose of blackmailing her with their possible destruction, and she may have lost some of them.

I've told her to change her passwords on her email accounts. She mostly uses Google Chrome, not sure if that makes a difference.

Ancillary question: why doesn't the FBI shut down sites like lmi1.com?

Update: they called her back, and hung up after being challenged to give their address. I'm not sure what their angle is. If it's just an outright scam, that's it, no harm done. But they could try to mess with us. I don't think anyone would go to this much trouble to set up a zombie for a bot-net, would they? I wish I knew.

Update I understand lmi1.com is a legit website, but wouldn't they still have the opportunity to use the connection to surreptitiously install malware?

2nd Update My wife informed me she watched him download and install a file she called "system configuration" so they installed something. Don't know what.

closed as off-topic by schroeder, Lucas Kauffman, Scott Pack, TildalWave, Jens Erat Feb 2 '15 at 0:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Lucas Kauffman, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    lmei.com (aka LogMeIn Rescue) is a perfectly legitimate site. What it does is let you give someone who you trust access to your computer to fix problems; it's quite similar to TeamViewer. The FBI doesn't shut them down because they are doing literally nothing wrong. On the flip side, being a legitimate service, they have a report abuse page. – cpast Jan 30 '15 at 22:06
  • 4
    Additionally, being on Linux would not protect against this attack -- what the person did was to get your wife to give him remote access to the computer, and no desktop OS will protect against the user deciding to give someone access. Once he has access, Linux isn't magically immune to using that access to install other malware. – cpast Jan 30 '15 at 22:10
  • 1
    I don't expect her to do this again, I just don't want to deal with Vista or Microsoft any more. – Aaron Hall Jan 30 '15 at 22:12
  • 1
    Let's shut down stackoverflow as well because some codesnippets could be used to hack people... – Lucas Kauffman Jan 30 '15 at 22:37
  • 3
    If you can get the original malware executable, there are lots of people (myself included) who'll have lots of fun taking it apart and figuring out what exactly could or did it do to your stuff (and maybe even find ways to fix it!). =) – Mints97 Feb 10 '15 at 18:08
up vote 5 down vote accepted

See the FTC page on Tech Support Scams:

In a recent twist, scam artists are using the phone to try to break into your computer. They call, claiming to be computer techs associated with well-known companies like Microsoft. They say that they’ve detected viruses or other malware on your computer to trick you into giving them remote access or paying for software you don’t need.

These scammers take advantage of your reasonable concerns about viruses and other threats. They know that computer users have heard time and again that it’s important to install security software. But the purpose behind their elaborate scheme isn’t to protect your computer; it’s to make money.

They document this class of scam thoroughly, and the page includes good information on how to act effectively in the event that you have already fallen victim. I have mirrored the content of that section below, but show your wife that page so she doesn't feel stupid.

If You’ve Responded to a Scam

If you think you might have downloaded malware from a scam site or allowed a cybercriminal to access your computer, don’t panic. Instead:

  • Get rid of malware. Update or download legitimate security software and scan your computer. Delete anything it identifies as a problem.
  • Change any passwords that you gave out. If you use these passwords for other accounts, change those accounts, too.
  • If you paid for bogus services with a credit card, call your credit card provider and ask to reverse the charges. Check your statements for any other charges you didn’t make, and ask to reverse those, too.
  • If you believe that someone may have accessed your personal or financial information, visit the FTC’s identity theft website. You can minimize your risk of further damage and repair any problems already in place.
  • File a complaint with the FTC at ftc.gov/complaint.

I can't speak to the efficacy of this, but I do recommend pursuing that last bullet: file a complaint.

Filing a complaint enables them to provide all interested and capable bureaus with critical information needed to at least defer future scams by the same attacker, e.g. if a U.S. phone number was provided then the FTC (or more likely some other bureau) will probably be able to seize the number and ensure that it cannot be used again for this purpose. I doubt the attacker is based in the States, but if they are then further justice might even occur; if not, that would probably be the extent of justice served on this.

All of that said, the FTC is a good agency; they do what they can. Hit them up for sure.

  • Yes, we'll report it. Thanks. – Aaron Hall Feb 1 '15 at 19:06

Sounds like you have a good game plan. Make sure whatever OS (I'm a fan of linux in this scenario) you choose she does not have admin rights at all. Also if you go with windows I had the same issue with family and got them to use http://www.bluepointsecurity.com

Usually these guys are just out to get a hold of money or your card info in exchange for "helping" you. Sometimes they are "honest" and only take what they say they are going to charge , sometimes they sell the info or clean out your account. I have a couple of folks I know get jammed up like this (iYogi).

Disclousre: I used to work for BluePoint as a website dev but I have no current affiliation with them other than being a happy customer.

  • Thanks for disclosing! I wish more people would do that when recommending products/services. +1 karma! – schroeder Jan 30 '15 at 23:17
  • 1
    My wife and other family members have received calls from people stating they will fix problems that have been detected on their computers. Sometimes they make it sound like they are with the ISP, though one person said she was told that the caller's company was "Windows" and needed to fix a problem with malware coming from her PC. From what one person told me who got to the point where they were requesting payment of several hundreds of dollars to fix a problem, it seems they are often after a credit card payment, though I wouldn't count on them using the number just once. – MoonPoint Jan 31 '15 at 19:11

The computer was compromised and any data on it should be treated as if it's in the attacker's hands. Now I doubt this is actually true (those pricks are usually "nice" enough to only charge you around 200$ for a rogue/scareware "antivirus") but you shouldn't take any chances.

What I'm most concerned about are session cookies, so you should change passwords on any site you logged in using that computer, which should invalidate the previous (and possible stolen) cookie.

Besides that, nuke it from orbit and reinstall; it may be a good idea to boot it first (without network access of course) to assess the damage.

Not the answer you're looking for? Browse other questions tagged or ask your own question.