Hello my mom connected to someone and I unplugged the Internet she had a blue screen on the computer and I pulled up the history and she said they had her type in a code on dhelp.cc what can I do to make sure they aren’t connected I could use any help I don’t want to lose anything on the computer
It doesn’t seem like it was ransomware since you were able to boot up and check history after restarting your computer. I wouldn’t worry too much because the scammers would need to reconnect with their remote access program. Just uninstall whatever program was downloaded from dhelp.cc (probably Ultraviewer).
Alright so it was connectwise that was downloaded.
So go to Task Manager
Look for connectwise client/control or screenconnect client
Right click on it and open file location
Go back to task manager
Kill connectwise or screenconnect
And then delete it from the folder.
Then download and run this Removing Unwanted Software - Boda Scambaits
And check in apps and features for any apps you and your mother don’t recognise and uninstall them.
To be fully sure the computers clean run an antivirus scan with something like Windows Defender (comes built into windows) or Kaspersky Free Free Antivirus Software for all Devices | Kaspersky or the antivirus already on the computer.
Then change all passwords, a password manager like https://bitwarden.com/ is good for keeping track of passwords, and 2fa (non phone number 2fa) like Google Authenticator or Microsoft Authenticator is good.
Then get her to call the bank and tell her scammers were connected to her computer and she wants to make sure her accounts are safe. If she had files on her computer with things such as SSN (Social Security Number) or whatever it is for you or tax information then go to the local police, file a fraud report and I believe get a credit report done and have them look over that information. You can also go to social security office but doing both would be good.
After this her computers and accounts should be fine.
I will also message you a site that may be useful and have more information on scams.
I know you were trying to help but please read over my reply, you missed a lot of things so your reply wasn’t that much of help (it still was helpful but didn’t go over everything) I just want you to read it if you feel like doing it just so your more informed on the steps victims have to take.
Do keep in mind to download Ultraviewer it doesn’t need a code unless its a custom page. If you see a page like the one linked it is 99 percent of the time connectwise/screenconnect. You can remove this via stopping the service or going in task manager opening its file location, going back to task manager and killing the task then deleting the files for it. This should work with most remote software that doesnt show up when you try and uninstall a program (like most scammers connectwise/screenconnect files).
Ultraviewer can be removed normally via uninstall programs or in programs and features.
Another program that is harder to uninstall is Supremo, usually if you go in settings theirs a install service option, just uninstall the service and delete it and it should be all good.