Question resolved: no reason at this time to assume the remote access was with any malicious intent.
[skip this beginning if you want]
My partner was offered a job with a real estate listing company doing photo processing for their virtual tours, and this rang a couple of alarm bells: their photos aren't super professional on their website, the company uses the physical address of a hundred other businesses, and the interview did not seem very extensive or job-focused - though I know from experience some companies don't ask for a lot in entry-level interviews.
But mostly my partner's concern was that the employer wants remote access to the machine "to set up software." The only reason I can imagine doing this is perhaps if they have a license that they want to maintain ownership of and not have a prospective new hire share or use on other equipment. Or if they really think that someone they're hiring for a computer-intensive position is going to be that incompetent and don't want to waste time supporting program install, there are probably other reasons but I don't know how much this should raise alarm bells as I haven't done any WFH jobs. My partner has already provided them with usual hire stuff, SIN, bank deposit forms which they were in no particular rush to get.
The salary isn't out of expected range, a bit above minimum wage, and they're not rushing to try to encourage the new hire to do everything as soon as possible which is what you would expect for an IS-breaching sort of situation, and they're a smaller company with a low profile.
Anyway, I'm thinking of putting a new install of windows on one of our systems and separating it from the network by physically removing other devices until I can take a look at what they did while connected. Since we don't have a way to set up a DMZ that I'm aware of, I feel this is the safest option though perhaps paranoid/overkill - we do run 2 attached routers with different network names and passwords.
I don't know what they'll be using, and I won't be present since I will be working. My partner is tech-savvy and will recognize an obvious scam but is unlikely to recognize commands run through cmd or PowerShell, e.g., and I expect that they will be asking for admin access to install programs.
The idea is to run a clean (formatted) drive on the system to be accessed with all others temporarily disconnected as we don't have a physical firewall set up as such.
I'm willing to spend time on this but not money (ideally)
I am thinking of setting up a "honeypot" so that I can determine what is being done while the system is accessed so that I can try to determine if there is anything nefarious going on. The aim is to see if there's any personal information snooping or additional virus/software/access to unexpected files without putting anything real at risk. Obviously if there's anything like this we can assume it's not a legitimate opportunity (or otherwise involves unethical people) and waste no more time with it.
The first article I found regarding a honeypot online recommended things like ghostusb, kfsensor, and glastopf or SNARE/TANNER but I worried that there might be too many settings for a casual endeavour and I did not want to risk actually compromising the computer from outside of this one occasion while I was setting it up (also it specifically warns against not knowing what you're doing and running it, so I figured I would heed the warning since I don't want to risk a different set of attacks or make myself a target in future.) I just wanted to make it inviting from the inside, here are some things I was thinking of which may or may not be appropriate:
leave a junk passwords.txt file on the desktop, a file called bank stuff.txt on the c:/ root, and check for access in event viewer (assuming they don't purge - would also like a backup)
changing any default router admin passwords, IDK if we've ever bothered I just assumed the last boyfriend would have since he was a tech guy.
I would like to install maybe some of these
I would consider e.g.
spyrixfree keylogger but unsure if this would capture remote access commands as I am unsure how it works/if I can get it to work and my... ISP? I think blocks it, plus I would have to convince windows to use it.and run some sort of screen recorder, either OBS or NVidia's capture software to video the desktop during the remote session or something external from the computer since I'm not sure how to hide OBS and I'm not really familiar with NVidia's software except I know it's usually used for game capture so IDK if it does two screens - they specifically requested two monitors to be connected, I'm not sure if that's relevant.
Any other recommendations, "you're being paranoid," "try using software that's less outdated or would actually work as a backup for Windows event log," etc. would be appreciated. I have maybe a few more days to reinstall Windows and set up. Ideally, if they are a malicious actor I would like to capture any/all information I could (IP addresses, e.g.) and pass it along to whoever is relevant, or if I am unsure and anybody else might be interested.
For me, a big sign of illegitimacy will be if they connect from an IP assigned to the wrong geographical location or touch any of the no-no files. Obviously, if my partner decides to pull the plug/drive due to concerns then that's a different story.
I'm open to setting up Linux and a Windows virtual machine or something but I'm not familiar with it and if the remote desktop session turns out to be legitimate I don't want to leave my partner without a working computer/program that the new employer has just set up. The job starts in about two weeks, software setup is supposed to be some days before that.
