Windows Security · Is My PC Hacked? · Lesson 5 of 5

Challenge: The Fake Microsoft Technician

Help your dad clean up after a fake Microsoft caller got into his PC.

A call from Microsoft that wasn't

Your dad calls you, upset. A man phoned him this morning, saying he was a Microsoft technician. He said Dad's PC was sending out viruses.

The caller had Dad install an app and read him a code. Then the mouse moved by itself. The man opened some screens full of text and said they proved the PC was infected. He charged $299 to Dad's credit card for a "security plan".

After the call, Dad noticed his browser has a new extension he never added. Now he is worried the man is still in there.

You're heading over to help. You know Microsoft does not make surprise support calls, so this was a tech support scam. Dad's PC is still on and connected to Wi-Fi.

Finding what the caller left

With Wi-Fi off, you open Settings, Apps, Installed apps, and sort by date installed. At the top is AnyDesk, installed this morning. Dad never used it before. You uninstall it.

In Task Manager's Startup apps, you find a new item from AppData with no publisher. You disable it. You also remove the unknown browser extension.

Next you want a scan that runs before Windows loads, so nothing hidden can dodge it.

Checking Dad's email

The scan finds and quarantines one threat. Since a stranger had full control, you also plan to back up Dad's files and reset the PC with Keep my files.

Meanwhile, you use your own phone to help Dad change his email password. In his Outlook.com settings, you find a forwarding rule. It sends a copy of every email to an address neither of you knows.

Reporting and getting money back

The PC is clean and Dad's email is safe. One problem is left: the $299 charge on his credit card.

Dad found a phone number in an email from the "technician" that says it handles refunds. He wants to call it now, before the refund offer runs out. You remember that scammers often offer fake refunds to trick people a second time. That number is not one you can trust.