First, disconnecting the Ethernet was a wise choice. I'd also disconnect your router for the time being.
As far as figuring out how they got in, running an IDS/IPS and looking at those logs would be valuable in the future; looking back, the offline scans below will at least point out some possible infection vectors, as well checking for router vulnerabilities.
I recommend you do the following:
- Unplug your router from the Internet in addition to your PC:
- Buy a new one
- Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"
- If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router
- Also check to see if your router has [one][1] [of][2] [many][3] [vulnerabilities][4]; if so, see "Buy a new one"
- Consider a serious router/firewall, like running [pfSense free software][5] on an old machine with 2 NICs, or their own devices, or a [fitlet][6] tiny fanless PC, or whatever.
- Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
- Or at least a [Ubiquiti Edgerouter Lite][7] - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).
- Change all your passwords everywhere
- Use something like [KeePass][8] to generate long random ones for each service.
- Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.
- Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:
- Buy a new hard drive
- Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)
- Install Windows from scratch
- Install your AV package with an offline installer downloaded on a noncompromised computer and network
- Run [Windows patches offline][9] possibly by using [WSUS Offline Update][10] from that noncompromised computer and network
- Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.
- Wrap the compromised hard drive in the small kitchen towel
- Put the wrapped HD in at least 6 Ziplock bags, each sealed
- Smash the drive with the sledgehammer until glass shards are leaking through the towel
- Restore your valuable data from existing backups
- Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products
- Regardless, do these offline scans for all other machines on your network!
- Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly. I'd recommend:
- at least one of AVG and Avira (or both)
- at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
- Comodo Rescue Disk (it advertises rootkit scanning, too)
- Pick another couple of your favorites.
- [PCSupport.about.com has a pretty good top 15 list as of Feb 2016][11]
- If you're truly worried, do this on every machine on the network.
- It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
- They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.
After all of this, once you're fully online again
- Make sure your OS is patched, and stays patched.
- Make sure your router is patched, and stays patched.
- Make sure your TeamViewer is patched, and stays patched.
- And is DISABLED whenever you're not planning to use it!
- And your router limits the places you can get in from
- pfSense and the Edgerouter Lite can both set up VPNs of a variety of types. Use a certificate based one, regardless.
- Make sure your antivirus is patched and up to date, and stays that way
- Make sure your (new) firewall is patched and up to date.
[1]: http://searchsecurity.techtarget.com/news/4500246976/NetUSB-router-vulnerability-puts-devices-in-jeopardy
[2]: https://thehackernews.com/2014/12/router-vulnerability-puts-12-million.html
[3]: http://www.pcworld.com/article/2057260/vulnerabilities-in-some-netgear-router-and-nas-products-open-door-to-remote-attacks.html
[4]: http://it.slashdot.org/story/13/10/14/0120221/d-link-router-backdoor-vulnerability-allows-full-access-to-settings
[5]: https://www.pfsense.org/
[6]: http://fitpc.com/shop/product?id=121337
[7]: https://www.ubnt.com/edgemax/edgerouter-lite/
[8]: http://keepass.info/
[9]: https://superuser.com/q/7261/403289
[10]: http://www.wsusoffline.net/
[11]: http://pcsupport.about.com/od/system-security/tp/free-bootable-antivirus-software.htm