You dont know what the malicious user installed/touched/did and chances are your Dad wont remember enough of the 'process flow' to assist in a proper IR. This is an immediate zero trust situation. But I'm not sure we want to take that chance. I have also read that this is not the biggest deal in the world because these people don't really take anything, so much as they try to convince you you have computer problems and get you to pay a fee to fix them.

Anything else we should be concerned about that I'm not thinking of? How can I tell if any programs are sending out information over the internet even after doing all of the above? How do I see if any devices are somehow remotely logging into the network? (is that even a concern at the moment?) Is there a way to somehow go into the computer's recent history and see exactly what was done, what was accessed? For example, is there a way to see whether certain personal files were copied or if any tracking software was installed? I am also having him save his personal files to a hard drive and change some of his major passwords. I have a rudimentary understanding of this stuff so I remotely uninstalled Ultraviewer and ran malwarebytes and ccleaner. However, he can't say for sure that they didn't download anything.

After about 15 minutes he figured something was up, disconnected the call, and turned off his computer. As he describes it, the guy stayed on the phone with him talking about files that had been installed, problems with the network, and so forth. My dad tried to reach customer support for his printer and ended up calling a scam artist who convinced him to install Ultraviewer.

Ultraviewer free vs paid