I don't understand the distinction you are making. If you are capable of identifying all the malicious software that's most of the way toward removing it.
* replace/reformat hardrive
* replace RAM sticks for good measure, as I have them already.
* config firewall
* put on standard windows security settings, remove remote access to computer, ect. lock it down.
* shes a grandmother. so essentially, just put a fuckton of addons on chrome and delete/hide other browsers. highest chrome security settings, httpseverywhere, adblock plus(not putting uBlock on, consider target user), ghostery, ect.
* explain some high level steps to her about protecting herself, all popups are scams ect
* if possible block incoming calls from 800, 900, international, and business numbers. Possible, but could impact her UX of life.
* tell her to call me if she has questions first before doing anything.
HOWEVER. A confirmation of malware would mean that the attack vector changes significantly. If a confirmation they actually actively did data harvesting or otherwise intend to go after her and her son's IDs or financials. I would escalate. I have already:
* changed all card numbers, the router and ISPs passwords,
* placed notes of breach in all accounts, ect.
* confirmed no suspiscious activity on investments and also secured them to the best I could via that companies policy without needing a 3day verified letter to execute a transfer or change in postion of the portfolio.
* replaced debit cards
* reset investments login.
[ I am aware that allowing her to use the likely compromised hard drive is a risk. but, I believe that between the security measures I have taken and the holiday weekend, I have some time to consider how I fix the issue technically ]
But if I actually found proof of maliscious code, it wouldn't be likely they were going to continue scamming: it would be a near certainty.
if the attack vector becomes securing any hole in America's horrible financial system, I would have to also set up account/credit monitoring, consider a credit freeze and take further measures. These are things I would possibly do to some extent for myself if this was my own system/life.
however I am a technical user with a background in finance and tech, and I worked at a fintech startup where we were trying to sell to banks. So i am not an expert, but have MUCH more knowledge about the industry than the victim here. So I am doing cost/ben on how much I need to do here (also of my own time to some extent) to secure everything while still allowing her not to need to do 2 factor authentication and call her bank everytime she needs to buy groceries. She is 80, so for her demographic she is highly technical. Compared to even a 65 year old, she is certainly not and does not have the technical or peripheral knowledge to execute/do tasks we would consider basic:
* make a change from win 7 - win 10
* use a password manager not already set up in chrome
* understand seperation of technological concerns. for example, she didn't want to change to win 10 because her passwords are prefilled for her in Google Chrome, and the new operating system would require her to not have them. I am aware of how chrome accounts work, this is an example.