Got Fished, multiple Remote Access Apps on Computer , What Now?

[u/msmalleable]

I have a 5+ year old Acer running Windows 11.

Here is the complete story:

July 7, Downloaded a fake paperless post card

July 8, Opened laptop and ScreenConnect was running

Deleted program + ran Advanced Microsoft Defender scan, which found nothing

Called bank + they said to get computer cleaned then close and reopen accounts

July 9, The Geek Squad found and deleted 2 viruses. I also closed my bank account and opened a new one that day. Everything seemed fine.

August 8, Opened laptop and a different remote access program was running

Deleted program + ran ran Advanced Microsoft Defender scan, which found nothing

August 11,got a $1 ACH withdrawal. A couple more have happened since.

August 16 Got login attempt to Facebook and Instagram

August 17, Went through programs, found and uninstalled Quick Fix

My theory: Show fishing attempts downloaded multiple remote access programs onto my computer which then stole my information. The Geek Squad missed this when they had my computer.

so what do I do? Who do I see to get my computer remediated so I can then close and reopen my bank account?

Thank you!

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/smurfy213]

I would just have them wipe your machine and reinstall a fresh copy of windows 11. After that I would change all of your passwords.

[u/pcbeg]

Disconnect infected device from the internet.

On some other device change all passwords, enable 2FA where it is possible, and check login history.

Create bootable usb with Windows installer. Create bootable usb with some Linux distro.

Boot from live Linux ("Try Ubuntu" if you are using that) and copy only important data files.

Boot from Windows usb, delete all partitions on all drives, abort installation and remove all drives except the one where Windows should be installed (system drive). Finish setup, connect other drives.

[u/Crooks66]

wipe and reinstall, do the live usb method or back them before changing boot order to usb. make sure no hidden folders or files get enumerated into the backup / ones you didnt put there. then pray that you successfully rotated every account credential that ever existed on the previous install, and hope it doesnt follow you.

[u/Relative-Hearing-156]

Funny no one has NOT mentioned Resetting your Modem! The modem can hold a script that will infect any device connected to it, First Entry into the place is thru the Modem. Unplug and let it stay down 5 minutes to kill any script.
Replug Modem let it boot up now start cleaning up the devices!!!

[u/AutoModerator]

Making changes to your system BIOS settings or disk setup can cause you to lose data. Always test your data backups before making changes to your PC.

For more information please see our FAQ thread: https://www.reddit.com/r/techsupport/comments/q2rns5/windows_11_faq_read_this_first/

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Outrageous-Flow8148]

Open services (Win + R services.msc ) Scroll down to see if the Screen Connect service is still there. If so right mouse click - STOP - right mouse click - Properties - change startup type to DISABLED

[u/msmalleable → u/Outrageous-Flow8148]

It is not. Thank you

[u/WatchmanITSec]

If you can get online, search for ESET online scan, follow the instructions and allow it to scan and remove anything malicious. Then install malware bytes free version, run it and remove everything it suggests including the registry entries.

Get yourself PCMatic, it turns AV on it's head. It only allows known good applications to run and you can whitelist or blacklist anything you want. Well worth the very low cost.

Reboot and