My Grandad was having trouble logging into his Gmail account yesterday. He managed to find and call the "Google tech support helpline", who claimed to be from Google and claimed that his account has been hacked several times and they needed to remote access into his computer to "clean out the viruses". They also told him to leave his machine on for the rest of the day while they were connected through remote access so they could continue their work.
They said they would call again today to continue the "work" and sort out his issues with logging in to his account and provide him with a bill for their services. I'm surprised they didn't try and bill him yesterday, which makes me think they won't call today and their aim was simply to infect his machine.
Luckily, he contacted me about this and I've told him to leave his computer off for now and not to get in touch with them again.
The question is, what would be the best way to secure his computer now? I expect a simple "Reset Windows" from within his computer won't be enough to ensure that there is nothing malicious remaining on his machine - considering the attackers had remote access.
I believe he upgraded to Windows 10 from a previous version so he doesn't have a licence key - if I reinstall from a clean Windows 10 installer made from another machine, will it recognise his hardware and automatically activate Windows?
There's also the files - he has a large amount of music and photos which would need to be recovered (no backups available). Would an antivirus scan from a Linux machine suffice?