I have given remote access to a scammer in a Microsoft tech support scam but immediately recognized it was a scam and deleted the ultraviewer app which they asked me to download and switched off my laptop.

Question

I have changed all my passwords and did alert my bank, did a credit account freeze. I also did reset my pc but with my personal files. What more can i do?

Answer 1

Hi. I'm David, and I'm happy to help you.

---

In addition to the suggestions already made, I suggest the following:

• Changing passwords does not invalidate active session cookies or access tokens. Go into the security settings for Microsoft, Google, primary email, and banking accounts, and select "Sign out everywhere" or "Revoke all sessions". Also, enable two-factor authentication (2FA) using an authenticator app rather than SMS.
• During remote access sessions, scammers usually open browser settings to export saved passwords into a text file or install malicious extensions. Assume any passwords stored directly inside the browser were copied. Also, check your browser extensions once you log back in. If account sync was active, any rogue extension installed during the scam could automatically re-download from the cloud.
• Choosing the "Keep my files" reset option leaves folders like Downloads, Documents, and desktop contents completely intact. If the scammer dropped malicious files or executable (.exe) into those directories, those files survived the reset. Review those folders and clear out anything downloaded during or right before the call.
• Keep your Wi-Fi and Ethernet turned off while running scans and checking the machine. If any hidden persistence mechanism remains, keeping the laptop offline prevents it from communicating with remote servers or probing other phones and computers on your home network.

---

Feel free to ask any questions you may have.

Answer 2

"What more can i do?"

Be on the lookout for signs that your identity has been stolen. Unless the attacker was an amateur, the contents of your user account were copied in a matter of minutes. Presume that the attacker knows everything about you that is contained in your user account.

Answer 3

Since remote access was already granted, the remaining priority is to treat the device as potentially compromised and reduce any persistence the scammer may have left behind.

1. Run a full malware scan in Windows Security.
   • Open Windows Security.
   • Go to Virus & threat protection.
   • Select Scan options > Full scan > Scan now.
   • This is recommended before relying on the device again.
2. Install all Windows security updates.
   • Go to Start > Settings > Update & Security > Windows Update.
   • Install all available updates.
3. Check for unusual account activity.
   • Since passwords were already changed, also review sign-in activity and account settings for important accounts.
   • For a Microsoft account, also check connected accounts, forwarding, and automatic replies if applicable.
4. Monitor financial accounts closely.
   • Bank notification and credit freeze were the right steps.
   • Continue watching for unauthorized charges or identity-related activity.
5. Consider a stronger reset if anything suspicious continues.
   • Keeping personal files is less disruptive, but if fake alerts, strange pop-ups, unknown apps, or other suspicious behavior continue, consider resetting the device again using a more complete recovery option.
   • Serious recovery methods can be time-consuming, but may be the best option if the device keeps showing signs of compromise.
6. Report the scam.
   • Report the incident at https://www.microsoft.com/reportascam.
   • If the scam involved a suspicious website, it can also be reported from Microsoft Edge through Settings and More > Help and Feedback > Report unsafe site.
7. Remove any software the scammer requested.
   • UltraViewer was already deleted, which was the correct step.
   • Also check for any other unfamiliar remote-access or support tools that may have been installed during the session.

The main remaining gaps after the steps already taken are: a full malware scan, Windows updates, ongoing account monitoring, and reporting the scam. If suspicious behavior continues after that, a more complete reset is the safest next step.

---

References:

• Protect yourself from tech support scams
• Protect yourself from online scams and attacks
• Tech support scams
• How to recover a hacked or compromised Microsoft account