Resolved Webistic Scam

Helping a friend that got caught up in a Webistic scam - frozen screen, dire warning, number to call, etc. He gave them access to his laptop and they cleaned it up and charged him a couple of hundred dollars. He's already talked to his credit card company and they are on board to refute the charge.
Question - What is the best way to return his laptop to usable status considering that Webistic had access?
My first thought was W11 fresh install keeping documents, photos, etc. But I'm not sure. Any suggestions?

 

Depending on whether it's HDD or SSD or M.2, my thoughts would be Fresh Install and keep nothing.
I would RENEW the drive/s as we no longer have the skillset of Broni to get us out of trouble!
The risk is there for Data corruption/embedded root/virus/trojans.
My thoughts will depend on his data stored and whether it's setup with D: on a 2,5" HDD/SSD as most "newish" laptops are.

 

That's what I feared. Yes -we do miss Broni.
When you say "RENEW the drives/s", what do you mean. Not familiar with that term.
Regarding the possibility of embedded malware, are you saying it would be risky to try to recover documents, photos, etc before attacking the problem?

 

One more question. I have a Manhattan Duo Doc for replicating hard drives. I have had success in the past at placing a hard drive in it and using it like an external hard drive to find/extract files - photos, documents, etc. Would that be safe or is there still the fear that something might be lurking in those documents/photos?

 

Robert, What storage layout is in the laptop?
I think most of the newer laptops have a M.2 card for the OS C: usually 128GB size.
The D: drive maybe up to 1TB of 2.5" HDD or SSD.
A Fresh Install on an M.2 would as I understand it, be like new again as the SSD card does not need wiping first.
A 2.5" HDD would need "Disk Wipe" or "Kill Disk" to completely clean it.
An SSD can be "wiped" following this link which you will need to copy/paste into your Address bar. The info explains the process.
https://www.crucial.com/support/articles-faq-ssd/methods-for-erasing-an-ssd

As Steve has explained, I would not try to save his Data unless he needs it
Could it be looked at in a "Virtual" environment?

 

RL,
All he could tell me is it is 256GB SSD. He has our in house (retirement community) internet provider coming out on Monday and he wants to see what they have to say. I will post when I get more information.
Another question - When one wipes, erases, formats a hard drive, will a fresh installation of Windows install OK or does one need to go through the Key type information or will Windows pick up the information it needs to install in the Bios?

 

Depends on if there is a partition on the HD with the original OS on it. You can just wipe like C and leave D alone where the original OS is at.

 

Robert, I'm pretty sure that if the comp was running with W10/11 installed, the info (Product Key etc.) is held in UEFI and the install should go without hitch.
Quote:
Can you wipe your hard drive and reinstall Windows?
To wipe your drive in Windows 10, go to Settings > Update & security > Recovery, and then click the Get Started button. When prompted, choose the option for Remove everything. You should then choose the Local reinstall option to reinstall Windows from your computer.30 Mar 2023
This should also apply to W11.
You may need to Backup first. Or take a note of all Programs/Software installed before starting the above as these will need to be installed again.
I think somewhere in the process, you will have the option to install Windows from USB or from the cloud. I believe the option from the cloud will be a clean Windows (new).

 

Thanks for the responses. I did a bit of learning - UEFI vs BIOS https://www.howtogeek.com/56958/htg-explains-how-uefi-will-replace-the-bios/ I think I can make it work depending on what he hears Monday.

 

I would imagine that the ISP would advise them not to click on any enticing new url's.
MS Defender should look after the comp provided the required settings have been set.
Have you looked in the Settings > System > Privacy and Security?

 

The ISP rep supposedly removed all traces of Webistic (access points, apps, etc) and advised that the laptop can be used normally. We will see.
Thanks to all for the input. I will mark this one as resolved but will keep a pulse on this particular situation and report back any happenings.

 

Thought I would post an update.. After about 3 weeks, no gremlins have shown up. So maybe the ISP rep's fix took care of the problem. Will follow up if anything negative is noted.

 

Thanks for your update.