Trojan & Virus Removal Stuttgart

Your PC safe again

Benjamin Riedel
You call, I answer.

+49 711 3588558

Is your PC or notebook infected with a trojan or a computer virus? Is your data encrypted? Or has someone on the phone taken over your computer? Unusual pop-ups, a suddenly slow system, locked files or a ransom demand? Now fast but considered action is what counts.

→ After a scam call: secure the evidence first, then clean up

→ Remove trojans, viruses and ransomware

After a scam call: secure the evidence first, then clean up

A call from supposed tech support, or a warning page that won't close. Shortly afterwards a stranger is controlling your computer, and in the end money is missing from your account. After that, most people want just one thing: delete everything and start over. I understand that well. But after a break-in, you also call the police first and the glazier second.

Your computer has, in fact, been taking notes: which programs were added and when, which pages were visited, sometimes even what the scammer typed. These facts help the police with their investigation, and they help you when you talk to your bank. Reinstalling right away wipes these traces out.

This is how I proceed:

1. First, the copy. Before I delete or reinstall anything, I back up your entire hard drive.
2. Then I read the traces. I analyze the copy on a different computer, and only read from it: Which remote access programs were added and when, how were they configured, what happened next in the browser, in your email account and in online banking? Sometimes remnants of deleted data turn up as well, such as addresses in the browser cache.
3. Then the timeline. You receive in writing what happened when, for your police report.
4. Then the cleanup. I reinstall your computer cleanly. That also gets rid of the scammers' hidden ways in.
5. Then your data comes back, and your accounts get checked. Photos, documents and bookmarks come back, the scammers' programs don't. Afterwards I check with you whether all important passwords have been changed and whether someone has secretly set up forwarding in your email account.

What to bring: the computer (for a notebook, the power adapter too) – please leave it switched off until it is on my workbench, because every time it is switched on, traces can be overwritten. Also your notes, while everything is still fresh: the time, the phone number, what the caller wanted, what you entered or approved. And if you use a Microsoft account: know how to sign in to it. Many newer computers encrypt the hard drive, and that is where you will find the key.

What I can't do, I'd rather tell you right away: I don't investigate who is behind the call. That is a matter for the police. I can see what happened on your computer, but not always who was moving the mouse, you or the caller. And only your bank knows the amounts and recipients.

The same rule applies when it isn't your computer but your website or a server at your company: secure first, then clean up. For websites I've written a self-help guide. If a server or NAS at your company has stopped working, see Emergency on site.

What I record for the police and your bank

At the end, you receive two documents. A short report in plain language: what happened and what you should do now. And a technical appendix that you can attach to your police report. At its heart is a timeline: what happened when, and how I know. On top of that come leads for the investigators, for example which server a remote access program connected to.

In it, I strictly separate what is proven, what is only an indication and what remains open. A report that claims more than it can show helps no one, least of all you. It is a technical report, not an expert opinion; the legal assessment remains with the police, the public prosecutor and your lawyer. Which documents you give your bank is best discussed beforehand with a lawyer or a consumer advice center (Verbraucherzentrale).

I keep the copy of your hard drive for as long as you and I have agreed in writing; on request, you can take it with you on a hard drive of your own. I only hand it over to investigators with your consent or if it is formally ordered.

This is what a timeline can look like – an example; the sequence and times are made up:

• 9:05 Search for a recipe, click on an ad at the very top
  How I know: browser history
• 9:06 Warning page “Your computer is locked”, with a phone number
  How I know: browser history (what the page said: no longer available)
• 9:16 Remote access program installed, fixed password set
  How I know: program folder, the program's log
• 9:19 Connection to the computer from outside
  How I know: log of the remote access program (not every program records this)
• 9:29 Sign-in to online banking
  How I know: browser history
• 9:34 Transfer filled in up to the review page
  How I know: browser history – whether it was approved, only the bank knows
• Open Who was moving the mouse, you or the caller
  The history can't tell.

How to recognize the scam

• Someone calls you out of the blue, supposedly from Microsoft or another well-known company, and says your computer is infected. Reputable companies don't do that.
• A warning page shows a phone number. Genuine warning messages don't.
• You are asked to install a remote access program. That hands a stranger the key to your computer, and often he makes himself a spare key right away that you can't see.
• “Don't hang up.” Anyone who keeps you on the phone wants to stop you from thinking it over or asking someone.
• You are asked to confirm an approval in your banking app, supposedly “to block” something, or to buy gift cards. At the latest now: hang up.

From my workshop: two cases after scam calls

The warning page came from a Google ad

A customer searches the internet for something completely ordinary and clicks on the top result, an ad. Instead of the page she was looking for, a warning appears: her computer is at risk, she should call support. On the phone, she is told to install two programs. After that, it is about her online banking and gift cards.

When the computer comes to me days later, I am actually only supposed to reinstall it. But the very first check shows a remote access program that doesn't belong there. So I back up the whole computer before deleting anything, and analyze the copy on a different computer. The history of one browser has been deleted, that of the second is still complete. From it, the sequence can be traced almost to the minute: ad, warning page, two remote access programs. One was set up for permanent access; on the other, the notice that someone is controlling the computer remotely had been switched off.

What you can take away: Even an ad at the very top of Google can lead to scammers. And anyone who deletes everything right after such an experience also deletes the evidence.

The scammer typed into Google Translate

The phone rings, a supposed technician is on the line: the computer is full of viruses. He doesn't speak German and opens Google Translate on the customer's computer. What he types in, she reads in German. He has her install two programs, asks whether she uses email, online shopping and online banking, and keeps telling her: don't hang up.

Then the crucial sentence: hackers had initiated transfers, and he would now block them. For that, she would receive an approval request in her banking app. She approves it to prevent damage. The approval doesn't block anything. It carries out a transfer.

Because Google Translate writes every typed sentence into the address bar, everything later showed up in the browser history: every sentence the scammer typed, with the time to the second. I logged every one of my analysis steps with the time as well.

Her everyday user account on the computer was set up correctly, by the way, without administrator rights. That is why the installation needed the administrator password, the master key to the computer. And it was entered during the phone call.

This matters to me: it wasn't foolishness, but a carefully prepared deception. It was aimed precisely at the wish to prevent damage.

What you can take away: An approval in your banking app is your signature on a transfer. You can't block anything with a signature. And: no passwords on the phone, to anyone.

Encryption trojans (ransomware)

Extortion trojans (ransomware) usually get into the system through email attachments or unprotected remote access: they encrypt your documents, photos and databases – including those on network drives – and demand a ransom.

Important at the first suspicion: disconnect your private PC from the internet, shut it down and leave it off, so the encryption cannot continue. In a company, on the other hand, unplug the network cables or turn off Wi-Fi, so the malware cannot spread to other computers and network drives. Leave servers and PCs switched on and call me right away – this is also what Germany's Federal Office for Information Security (BSI) advises. Only if a device cannot be disconnected from the network should you switch it off.

Whether encrypted data can be recovered without paying the ransom is something I check in my specialist workshop – more under data recovery in Stuttgart.

★★★★★

“It all started after a ‘Locky’ infection on our servers and PCs. I felt completely helpless at the time and contacted Mr. Riedel. His response time was fantastic. I received a call back immediately and was able to schedule an appointment right away. […] We consistently receive excellent advice on IT security and data backup.”

Stefan S. · Google review, March 2017 · translated by Google

How I proceed with viruses and trojans

1. Analysis of the infection – which malware, and which systems are affected?
2. Data backup before any work is done on the system
3. Cleanup of the system, or a clean reinstallation
4. Restoration of your data from backups or via data recovery
5. Hardening, so that it doesn't happen again

If a stranger had access to your computer, I reinstall it instead of just cleaning it up – as described above.

I am happy to come to you on site in the greater Stuttgart area for virus removal, trojan removal and checking every recovery option after an encryption attack – or you bring the affected system to me. I, Benjamin Riedel, take care of your case personally.

Causes & prevention

The most common ways in – and how you close them:

Remove trojans yourself – or have it done?

Simple adware can often be removed by yourself with an up-to-date virus scanner. With ransomware, rootkits or whenever business data is affected, I advise against it: the effort is high and the risk of losing data – or of keeping a system that is still not clean – is too great. When in doubt, just call briefly; I will assess the situation honestly.

Learning from real attacks

Well-known organizations are targeted regularly too – and almost every time the way in was avoidable:

• WannaCry (2017): the ransomware paralyzed systems worldwide – in Germany it hit the departure boards of Deutsche Bahn, among others. → Install security updates promptly; the patch that would have protected them had been available for a long time.
• Düsseldorf University Hospital (2020): an encryption attack paralyzed the hospital and the emergency department had to turn patients away. → Close known vulnerabilities in remote access immediately.
• Colonial Pipeline, USA (2021): the largest fuel pipeline in the USA stood still and panic buying followed. → A single old access password without two-factor protection was enough for the attackers.
• Continental (2022): the ransomware group LockBit stole around 40 terabytes of data. → Attackers are often inside the network unnoticed for weeks – monitoring and network segmentation are decisive.
• Südwestfalen municipal IT (2023): an attack on a single IT service provider paralyzed more than 70 towns and municipalities at once. → Secure your service providers and supply chains, keep backups separate and test them regularly.

Current ransomware groups such as LockBit or BlackCat (ALPHV) combine exactly these routes: phishing, data theft and encryption. The best protection remains up-to-date systems, trained staff, tested backups and cleanly secured IT – and that is precisely where I support you, including with the IT Health Cockpit.

Frequently asked questions about trojan & virus removal

Where my customers come from

From Stuttgart and all of its districts as well as the surrounding towns in the greater Stuttgart area – from Esslingen via Ludwigsburg and Waiblingen to Böblingen and Sindelfingen.