My dad, who's 80 years old, received a call claiming his "Windows license" was expiring and needed a renewal. After hanging up, he suddenly saw a "System Locked" message on his computer. Turns out he called a helpline linked to this and was asked to pay $150 for a new copy of Windows. After I investigated, I found that a program called 'rfusclient.exe,' related to Remote Utilities, was trying to prevent the shutdown of the computer. I suspected he may have clicked a link in a scam email, leading to remote access being established. Now I'm worried about what to do next. Should I just do a clean reinstall of Windows? Is there a way to fix the 'System Locked' message or should I boot into safe mode for a reinstall? Also, how can I check if the hackers did anything else on the system? Any advice would be greatly appreciated!
4 Answers
You're spot on about the need for a clean reinstall. After that, I would highly recommend changing all important passwords from a **different device**. You never know if keyloggers were installed during their access. Make sure to set up a standard user account for your dad once the reinstall is done. Keeping his computer secure is key!
Definitely sounds like a scam. That 'rfusclient.exe' link is a red flag for remote access software. A clean reinstall is your safest bet, especially since you can't trust what other software might have been installed. I'd recommend booting into Safe Mode first to avoid that lock screen. From there, you can back up important files and reset the PC. Always better to be safe than sorry! Just check out some instructional videos before diving in.
It really does sound like there's some overlay running. If you can manage to boot into Safe Mode, that's a good way to check the startup programs and potentially remove anything suspicious. Just remember to change passwords on all accounts after you’re done cleaning the system.
If you're looking for peace of mind, just go for a full format reinstall. If you're feeling a bit risky, you could try running Malwarebytes along with RogueKiller and ADWCleaner first. Don't forget to change all your passwords, too!
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures