bsrutter

You did not mention how long the scammer was on your machine. About 10 minutes There is no way to know whether they actually got any sort of financial account numbers, or some key parts of personal data, like birthdate, social security number, bank account number, etc. Nothing on main drive but there were some files on second drive The following is typical advice for someone who might be a victim of identity theft. I have been following all this advice.

Yes, I need much more info about "the drive at issue". You had said you removed it. Where is it now ? Is it currently attached to one of your machine ? or what ? Need details on that. I removed it and it is just sitting on the shelf but the second drive is still in the computer. can the second drive be corrupt as well? That SSD drive you keep mentioning, is that where you newly installed a clean Windows ? About a year ago I copied the hard drive over to the SSD drive and used it for about 6 months then it would not boot up so I reinstalled the hard drive in the computer. After the hacker had access to my computer I removed that hard drive and installed the SSD drive and it is currently booting. So the SSD drive does not have a clean install of windows just the mirrored copy of the hard drive before it was corrupted. Which one has a known clean Windows operating system? I guess the ssd but just don't know if the second drive can cause it to be corrupt. I had it setup to automatically use second drive for download, documents, storage etc. IF the drive is accessible as a drive, you can do CUSTOM scans with Malwabytes for Windows, as well as with the antivirus app installed in Windows. Can this be done for the second drive. It is accessable as drive D. If on the other hand, that drive has no personal files that you need, and you have a new Windows setup elsewhere, then you could "nuke" the "scammed drive" / essentially erase it. Files are mostly all saved to second drive. I copied some files that were on Desktop. But now the drive can be "Nuked"

What is it you plan to do with that drive ? I don't necessarily need that drive since the ssd drive is working. If I can scan it and remove all traces of corruption then that would be a plus. I am not only concerned about malware but what he may have done in settings etc. I think I have it setup to use the second drive for storage and programs etc. Is it possible the second drive can be corrupt or is there a way to check. Do you have a Backup of this system from before this incident ? I do not. Unless there was one automatically saved. I did a complete backup of the ssd drive once I installed it but that doesn't help Do you remember its name ? Do you remember where you had Saved it ? I installed the other drive and the name of the remote access is Goto assistant.I just downloaded it and ran it. Probably went to downloads folder Let me know if that helps or if you need any more info. Thanks

I downloaded a remote access client. Not for sure which one. I would have to reinstall the other hard drive to find it. So they had full access remotely. Yes they ran a scan on drivers with cmd prompt but I know they were doing something in the background.

I appreciate your helpful reply. Yes I did post on that forum but I didn't realize they have a 5 day response time.

Ok I purchased a Printer and and went to what I thought was the website to download the driver. It ended up being a fake website. I entered the model number of the printer and came up with error message and had you call support. So I called support and they requested remote access to fix the problem. Stupid I know but looked like legit Cannon website so I did. The tech ran a diagnostics in command prompt and said the drivers were corrupted and that my network has been hacked. Then tried to get me to pay for a Level 9 tech to remove the hack and install network security. I have removed that hard drive and installed an SSD drive but I do have a second hard drive for storage and I beleive the programs are stored on there. Is there anything I can do to check or remove what he has done?