A ransomware attempt was made on my pc using a CLSID that mirrored mine for identification

It was a scam where they claimed to have a refund for some software, otherwise I'd be automatically charged $300 per month.  Naturally when they said they wanted to put a program on my computer, I refused since I know any dot exe could put "who knows what" on my system, but I was fearful they could bill me automatically.  He insisted that it could be done.  He told me to check a number which he told me was my computer ID, claiming he had control of my computer by running at the command prompt "assoc" and noting the CLSID number a couple of lines from the bottom of the spool of data.  He read off a number this long and with this basic configuration CLSID\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} and all numbers were what he said.

He ran something called "splashtop streamer", perhaps foolish me I thought I might be able to stay ahead of what he was doing to learn within the edges of my knowledge of what he could see and what might be a real problem for me; like dancing on a needle.  I realized he was looking for a program that I had erased last year by noticing he couldn't find what he was looking for and the PC cleaner type of suite was triggered in my memory.  When he realized I'd erased the program that would have been a real problem that I now might be able to evade, he started attempting to change the name of my computer when I broke the connection and removed all the software that had been used in the session that lasted about an hour with me losing it from time to time, "Tell me what you are doing at each step and quit asking me why I'm mad".  He was playing me, but I had to make sure what I needed to do to stay as safe as possible.

After all that I searched for what CLSID is and discovered that malware can be associated with them so I looked for a registry cleaner hoping the number might regenerate, whatever it was associated with and not know if my firewall is vulnerable.  I investigated whether or not my Trend Micro would do it so I ran as many of TMs focused operations hoping that even if I didn't completely evade detection I could at least make it a hassle for anyone to mess with me that it wouldn't be worth it.  Is it possible that I'm free or what can I do short of reformatting?

Hello, my name is Arif Ahmed, Windows Advisor.
I would be happy to help you.

As you mentioned he was able to install few programs in the PC I would suggest you to Reset the PC to avoid possible phishing attempt.

1 person found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated March 27, 2024 Views 217 Applies to: