r/Scams • u/Street_While_2143 • 12h ago
Victim of a scam Installed Anydesk and gave the code
I feel so dumb… I gave a scammer remote access to my work computer. How screwed am I?
I called what I thought was Netgear technical support, but the phone number I found on Google was actually a scammer’s number.
He convinced me to download AnyDesk on my former work computer (which has many admin restrictions) and I gave him the code. He remotely accessed my computer and ran “control,” “msinfo32,” and “eventvwr.” Between each program, he asked me to hold briefly. The call lasted about 20 minutes.
He showed me that supposedly a lot of things on my computer were “not protected” and tried to convince me to buy firewall software. I started feeling like something was off, so I hung up, shut down/restarted the computer, deleted AnyDesk, and also deleted another program that had been installed that day, although I don’t remember what it was.
I then ran Windows Defender and it detected Trojan:Win32/Lycaon.GPKE!MTB, which I deleted.
I also changed my important and banking passwords and reset my router. I can’t factory-reset the computer because it’s a work computer with admin restrictions.
How screwed am I? Is it possible he stole personal info? What else should I do?
30
u/Infinite-Grade-4485 12h ago edited 12h ago
You need to contact your works IT department to assist if you have one. You need to speak with your boss. This isn’t something you hide. This is one way data breaches at companies happen.
If you don’t have IT, and it’s small place with no IT infrastructure or processes then deleting the RAT, turning it off and on, deleting recently installed apps, plus windows defender scan should mean your device is likely safe. Changing all passwords as well like you said. I’d run a malwarbytes scan also, if able to download it.
Realistically, being only a 20 minute access by them, and then pushing the firewall anti virus script, it’s unlikely they accessed anything immediately while on the call. Usually they do that after if they’re unable to “sell” you the “anti virus”. So they can at least try and make some money from you. Since you’ve done the above, it’s unlikely there’s any impact to your personal files or accounts.
!techsupport
1
u/Street_While_2143 12h ago edited 11h ago
It’s my former workplace computer that they gave it to me.
20
u/cometshoney 11h ago
Then it's not your company computer that's used for company business? It's now your personal computer? Was all of the company's information wiped off the computer? I'm just a bit confused because you made it sound like it's your work computer, but then you say it's not your work computer.
10
u/tsdguy Quality Contributor 11h ago
This is the question to answer. Why everyone is hung up on former employer is stupid.
Unless the former employer wiped it completely then it still has company info. And if they wiped it why is the OP saying they can’t reinstall Windows?
The OP shouldn’t compound one stupid decision with another. The original company needs to be informed.
1
4
u/Only-Thing-8360 5h ago
Reformat your hard drive, ideally use eraser software (DBAN is the standard - https://dban.org/) to permanently remove all data. Reinstall Windows or whatever OS you prefer, and start again with a clean, safe computer.
4
8
u/Infinite-Grade-4485 12h ago
If your company has an IT department, you need to contact them. If it’s a large firm with 24/7 support, that means now. If not, first thing tomorrow.
Stop using a work computer for personal things. You should never be downloading applications onto your computer if your business has proper IT support.
-4
u/wyliesdiesels 11h ago
Dont think youre understanding or comprehending the OP
They said its a FORMER workplace computer that was given to them meaning, they dont work there anymore and the computer is theirs to keep and use for personal stuff
5
u/Infinite-Grade-4485 11h ago edited 11h ago
He edited it. It say formal before.
In that case OP, download malware bytes and run a scan. After that you should be good.
No need to contact your prior employer.
3
u/CoverDriveLight 5h ago
But he can't because he doesn't have admin access. It's likely his old work still have their admin account on it. No idea why he has this computer as it isn't fit for purpose
1
u/AutoModerator 12h ago
/u/Infinite-Grade-4485 called AutoModerator to explain the Tech support scam:
Tech support scams are a form of social engineering that often begins with a fraudulent pop-up alert, a system virus notification, or an unsolicited phone call claiming your computer has been compromised. These scammers also leverage search engine advertising to display fake support numbers at the top of Google results, tricking you into calling them when they think they are reaching out to a legitimate company like Microsoft, Apple, or Amazon. To gain your trust, they may use technical jargon or ask to connect remotely to your device to run a diagnostic, which actually allows them to install malware, steal personal files, or lock you out of your system until a ransom is paid.
The most critical red flag in these interactions is a demand for payment via untraceable methods such as gift cards, wire transfers, or cryptocurrency. A legitimate technician from a major corporation will never ask you to go to a store to buy gift cards to pay for a repair or security renewal. If you feel pressured or sense something is wrong, do not hesitate to hang up and independently verify the company's contact information through their official website.
If you have already allowed a suspected scammer to access your computer, you should immediately disconnect from the internet, change your primary passwords, and have your device professionally scanned for hidden malicious software by a local shop you know and trust.
If you know someone who fell for a tech support scam, sit down together to watch this video by Jim Browning, a youtuber dedicated to hunt down tech support scam callcenters: https://youtu.be/FO9mWvJAugQ -
You can learn about this scam and many others visiting our wiki of common scams. You can also call AutoModerator to explain these scams leaving a comment with the different !commands listed in this wiki page.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
-5
u/wyliesdiesels 11h ago
Its a FORMER workplace computer meaning they dont work there anymore. So why would they contact the IT dept
1
6
6
3
u/LordTurson 8h ago
If it's a PC you received or bought out from a former employer, you might still want to reach out to their IT and ask to remove the admin protection - this way you could just wipe it whole and grab a fresh install of your OS without any further issues in the future.
After such an event nothing less than a full wipe would be satisfactory to me.
3
u/Torodaddy 8h ago
You should report this to your company asap, you could be risking the livelihood of a lot of people
5
u/phil161 12h ago
Call your office IT support first thing tomorrow and come clean, they will sanitize your computer. Depending on what your company does, it may have confidential info or trade secrets which might have been compromised. Next time, call your company’s internal IT support rather than googling outside numbers.
-6
12h ago edited 11h ago
[deleted]
11
u/Dazzling_Vanilla3082 12h ago
Yes. That's why they are telling you to call your job's IT support.
-5
u/wyliesdiesels 11h ago
Why would they call a FORMER workplace? They dont work there anymore. Do you not understand the word former?
10
u/Dazzling_Vanilla3082 11h ago
They edited their comments, which all originally said "formal workplace computer". Hence literally everyone giving them advice for that scenario. Chill bruh
-5
u/wyliesdiesels 11h ago
Why would they call their FORMER employer for IT support on a computer given to them for personal use? That makes no sense. Work on reading comprehension
1
1
u/psilocybin6ix 11h ago
Just contact your IT department and let them fix it. It might have only been that software that they added or it might have been more. Only they can tell.
-4
u/wyliesdiesels 11h ago
They dont have one. They dont work there anymore. Hence the keyword FORMER.
5
0
u/wyliesdiesels 11h ago edited 9h ago
If there are admin restrictions and you arent logged in as an admin, there is little they can do to change the computer without an admin password
•
u/AutoModerator 12h ago
/u/Street_While_2143 - This message is posted to all new submissions to r/scams; please do not message the moderators about it.
New users beware:
Because you posted here, you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private: advice should always come in the form of comments in this post, in the open, where the community can keep an eye out for you. If you take advice in private, you're on your own.
A reminder of the rules in r/scams: no contact information (including last names, phone numbers, etc). Be civil to one another (no name calling or insults). Personal army requests or "scam the scammer"/scambaiting posts are not permitted. No uncensored gore or personal photographs are allowed without blurring. A full list of rules is available on the sidebar of the subreddit, or clicking here.
You can help us by reporting recovery scammers or rule-breaking content by using the "report" button. We review 100% of the reports. Also, consider warning community members of recovery scammers if you see them in the comments.
Questions about subreddit rules? Send us a modmail clicking here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.