My aunt fell for this scam and her computer is probably compromised now. Her internet connection was disabled when they called her, suggesting they had already taken limited control of it. After she entered some numbers on the screen, they took full control and went into their spiel while showing her all the processes that had been stopped, and then they remotely installed some software (for a fee, of course, which I've already advised her to dispute a.s.a.p.)
In the Desktop folder there is now a program called Enigma_Infosys_Remote, and a text file called enigma_techsupport with the following text inside:
enigma infosys technical department
909 833 4727
support @enigmainfosys.c o m
w w w.enigmainfosys.c o m
1.remove all the errors and warnings from the computer
2. reinstall all the stopped apps
4.pc optimization soft
5. remove soft
I went to Microsoft's website and ran a malicious software scanner which didn't find anything, although I didn't trust that so I downloaded malwarebytes again and ran that which also came up negative. Shortly afterwards, the internet connection stopped working again, so I restarted in safe mode. A system alert popped up from the taskbar, and when I clicked on it the Action Center from the Control Panel opened up, showing The Windows Security Center Service is turned off. When I tried to turn it back on again, an error message box with a red X popped up saying "The Windows Security Center Service can't be started."
The next step was to try to do a system restore, however when I tried to restore to a point before the time they had taken control of her computer, I got the error "System Restore did not complete successfully. Your computer's system files and settings were not changed. Details: An unspecified error occurred during System Restore. (0x80070067)
Apart from cleaning the malware, etc, I'd like to know if there's any way to track down who these people are. I did a search for enigma Infosys and malware or scam but nothing came up, so I'm guessing they're a third party that's just being used by these criminals, just like Microsoft and HP.
Moderator Edit: Moved from Windows 7 to the "Am I Infected" forum.
Edited by rotor123, 16 November 2013 - 10:25 PM.