Disconnect the computer from the internet, then change your email and banking passwords from a different device. The remote session ends the moment the machine is offline, but anything they installed or changed while connected is still there. Below is the order we work in, and what we check afterwards.
| Symptom | Likely cause | Safe first step | When to call |
|---|---|---|---|
| They had you sign into online banking during the call | Credential and one-time-code capture | Call the bank fraud line, then change the password from another device | Immediately — before using that computer again |
| Your screen went black for part of the session | Screen blanking used to hide what they were doing | Disconnect from the internet and leave the machine on | Same day, so the evidence is still there |
| They installed a second security or support program | Persistence for a later session | Do not uninstall anything yet; write down the names | Before the machine goes back online |
| They asked for gift cards, crypto or a wire | Payment fraud, often with a refund callback to follow | Stop paying and report to ic3.gov | Any time — and do not answer the callback |
If you approved a code in AnyDesk, TeamViewer, UltraViewer, ScreenConnect, LogMeIn or a support app they talked you into installing, then yes — they had a real session, with your consent. There is no break-in to find. What matters is what they did while they were connected, and that is what a cleanup actually investigates.
The call is the distraction. The work happens in the background:
Removing the one tool you watched them install removes the one thing you know about. It does not remove a second remote tool, a new local account, a scheduled task, a Defender exclusion, or saved browser passwords they already read. That is the whole reason this cleanup is a checklist rather than an uninstall. A machine that looks normal is not evidence that it is clean.
Every remote-access tool on the system, including portable copies that were never installed. Unattended-access settings on anything legitimate you actually use. New accounts and Administrators group membership. Scheduled tasks, services, run keys and startup folders. Defender state, exclusions and tamper protection. Browser profiles, extensions and saved passwords. Outbound firewall rules. Then credential hygiene in a deliberate order: email first, because it resets everything else, then banking, then anything that reused the same password.
Call your bank's fraud line first — speed matters more than anything else. Report to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. If you read out a Social Security number, place a credit freeze with Equifax, Experian and TransUnion; freezes are free. We document a written timeline of what was accessed and when, which is what your bank and insurer will ask for. We cannot recover transferred funds and will not promise an outcome there.
The full cleanup service after a fake Microsoft, Apple or bank support call.
Local same-day help for Humble and Lake Houston.
If the account they reached was your business email, start here.
Bench or on-site cleanup once the account side is contained.
A battle-tested 5-step methodology that gets your business back online — fast, clean, and fortified.
Isolate infected systems, cut ransomware's lateral movement, and prevent further encryption of your data.
Identify the ransomware variant, remove all malicious code, and document the attack vector for your records.
Recover your files from clean, verified backups — no ransom payment needed. We validate data integrity at every step.
Rebuild affected systems with enhanced security configurations, patched vulnerabilities, and updated defenses.
Comprehensive security assessment, detailed forensic report, and a custom prevention plan to stop future attacks.
Straight answers before you spend a dollar. If your case needs someone else, we say so and help you escalate.
Operating disclosure: Virus Pros is the malware and ransomware specialty service of Atascocita IT Services, the local IT brand serving Kingwood, Atascocita, Humble and the wider Northeast Houston territory. Work is delivered by the same local technicians under that company.
Local experts who know your community. On-site response available throughout the greater Northeast Houston area.
Calls are answered 24/7 and screened, so urgent cases reach a technician fast.