How do I reset my personally owned Windows computer if it is compromised?

If you clicked on the link in the recent phishing message sent the week of October 19, or you suspect you may have clicked on it, we STRONGLY recommend following these instructions ASAP to reset your computer. This will purge any malware potentially installed as a result of clicking the link.

How do I reset my personally-owned Windows computer?

The first step is save a copy of your bitlocker key (assuming your hard drive is encrypted). If you do not save your bitlocker key and need it later, your computer and the data on it could be irrecoverable. Instructions on how to do that can be found here:

Find Your Bitlocker Key

If you cannot find your Bitlocker Key STOP! Bring your laptop to the Tech Desk. Do not proceed with resetting your computer.

Next, follow these instructions from Microsoft to Reset Your PC. This process may take 20 minutes up to 2 hours. Choose the option for Keep my files.

After the reset process is complete, logon to your computer and change your Windows logon password.

After that, please visit Bucknell Account Management and change your Bucknell password.

Finally, we strongly advise you change any password you entered on that computer, especially:

• All banking, finance, and shopping passwords

• All social media accounts

• All email and productivity accounts

• Anything else you really care about

Why is IT recommending I do all these steps?

The phishing email from the week of October 19 automatically installed multiple screen view and screen recording applications on your Windows computer. This means that bad actors can potentially see every thing you type, including passwords, account numbers, social security numbers, and everything else you did while the software was installed. The bad actors can potentially record every single thing you did on this computer since you clicked the link in the phishing email. You need to remove the software (NOT EASY!) and reset all your passwords to prevent the bad actors from continuing to monitor your computer and accessing all your accounts.

How do I fix a Bucknell-owned Windows computer?

If you clicked the link on a Bucknell owned computer, bring the computer to the Tech Desk immediately.

How can I check my own computer to see if it is compromised?

If you do not know or can't remember if you clicked the link, you can check to see if the compromise processes are running. 

1. Right click on the Windows icon in the task bar.
2. Select Event Viewer from the menu.
3. In the left side navigation, click the arrow in front of Windows Logs to expand the folder.
4. Click Application in the Windows Logs group.
5. Scroll through the recent log entries looking for Screen Share in the Source column.
6. If there are any Screen Share entries, follow the instructions above for personally-owned or Bucknell-owned computers.

NOTE: If there are any applications in Installed Apps that start with ZA_ the computer is compromised. Uninstalling or removing the software will not make the computer safe! You must follow all the reset instructions if ZA_ or Zoho are installed on your computer.

Is there anything else I should check or am I safe now?

IT highly recommends you follow all the instructions in the Compromised Account FAQ. While this may seem like a lot of work, the risk of losing your accounts or distributing additional spam is real! If you find altered content in any of these systems or accounts, report this information to the Tech Desk immediately.