Pop up virus alert/Possible Wiped System

[okstout4]

Hello!

We have a computer that is possibly wiped due to a fake virus alert. Is there anyway to determine if in fact it was wiped clean or could it just be dormant somehow? 

Here is the backstory...

Older gentleman friend of the family was on his computer and a pop up came up on his screen that said he had a Virus. It said that "they" were working on it and advised him not to turn off the computer until after he spoke w/them. It gave him a number to call and he called the number. They advised him to place a blank check on his printer to make a copy (scan to computer) to show good faith that they would get paid after they fixed the computer. That he would not have to sign the check until they got the computer fixed for him and at that time they'll advise him of the cost of virus removal. He didn't think about what could possibly be going on until suddenly he had no access to his computer at all. It dawned on him that they were likely swiping his banking info off his computer and he'd already sent the copy of the blank check. He immediately called his bank(s) to inform them and have his accounts shut down. Because at that point the computer was blank and nothing happens when he turns it on.

As for me, I know what this scam is all about and know not to play into it. Unfortunately, the older or elderly folks do not and its an unfortunate lesson to learn. I do have possession of the computer in question. Let me know if there is anything that can be done at this point. 

Thank you,

~Tina

[AdvancedSetup]

Good day, Tina - @okstout4

To do real, true Forensics would cost a lot of money. I'm not aware of anyone that does it for free.

You can boot the computer in either Safe Mode or the Recovery Mode to see if there is actually data on the computer or not.

Recovery Options in Windows
https://support.microsoft.com/en-us/windows/recovery-options-in-windows-31ce2444-7de3-818c-d626-e3b5a3024da5

 

 

[okstout4]

Thank you for that info and being patient with my response.

It appears that the computer is not even coming on. It does have power via the green light near the power cord on the device. When I press the power button, nothing happens. The power button itself isn't illuminating (like the power button on my pc does), instead what I am seeing is a red light illuminate on an area above the power button. It only illuminates for a second then goes away (photo of computer attached). I'm going to guess that the power supply (button or capacitors) are dead. Not sure if the scammers did this or if it just died.

This is a HP Pavillon Slimline, s5-1554 PC. Would there be any issues in replacing the power button/capacitors in regards the to the motherboard? I am doing some YT research.

Thank you for your help, its appreciated.

Edited December 2, 2022 by okstout4

[AdvancedSetup]

I would search on the HP site and see what the colors actually mean for that specific system.

 

[Porthos]

Do you at least see anything on the screen when powering it up? Unplug the power and hold the power button down for 30 seconds and then try again.

Even if the computer were "wiped" you should at least see the HP boot screen.

My .02, Those used to pop power supplies like xmas tree lights and many times took motherboards with them. They got 10 years out if it was purchased new.

I would suggest have them cut their losses and replace it and put the drive in an external case to get the data.

On 11/6/2022 at 11:06 PM, okstout4 said:

He didn't think about what could possibly be going on until suddenly he had no access to his computer at all. It dawned on him that they were likely swiping his banking info off his computer and he'd already sent the copy of the blank check. He immediately called his bank(s) to inform them and have his accounts shut down. Because at that point the computer was blank and nothing happens when he turns it on.

I would also , when he gets a replacement, change the password on every site he has ever used including email, Facebook etc.

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

[AdvancedSetup]

Topic has been reopened per request.

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks