Online PC Masters - scam

Tigger1000

Just got called by these people - only this time they were calling themselves "Windows PC Online".

Played along with him until he asked me if I was next to the computer, at which point I asked him which computer, and for the IP address - and the line went silent. So I hung up.

MARKF5983

The mum of a friend has been scammed by this and got caught out, (she's not stupid, they caught her at a busy time and she wasn't thinking!!!)
The difference is that whilst I notice that people are saying these fools are based abroad the emails she received had an address in Luton Bedfordshire on them!?!?!?!?!?
Any thoughts or ideas about what action she can take!?!??!

RussJK

MARKF5983 wrote: »

The mum of a friend has been scammed by this and got caught out, (she's not stupid, they caught her at a busy time and she wasn't thinking!!!)
The difference is that whilst I notice that people are saying these fools are based abroad the emails she received had an address in Luton Bedfordshire on them!?!?!?!?!?
Any thoughts or ideas about what action she can take!?!??!

1. System restore
Best thing would be the disconnect the internet, then load the compromised system.
If it is XP, then follow these instructions to load System Restore:
http://support.microsoft.com/kb/306084

If it is Vista or Windows 7, just type "system restore" into the start menu, and it'll search for it, then press enter to run it.

Follow the prompts, and make sure the date of the Restore Point is a date before all this happened.

2. Malware check
Afterwards, reconnect the net to run some malware checks

1. Install Malwarebytes, Update it, and run a Quick scan. Clean what it finds, post the log here (www.malwarebytes.org/mbam-download.php)
2. Run HitmanPro, don't install it just do a single scan, and clean what it finds. Let us know if it finds anything interesting (don't worry about cookies). (http://www.surfright.nl/en)
3. Run aswMBR and follow the guide on the page: (http://public.avast.com/~gmerek/aswMBR.htm)
4. Run tdsskiller (http://support.kaspersky.com/downloads/utils/tdsskiller.exe)
5. Save this file to the desktop: (http://www.trendmicro.com/ftp/produc...HijackThis.exe), then hold down LEFT SHIFT and RIGHT CLICK on the file and select 'Run as Administrator'. Do a scan and save a log, then copy/paste the log that comes up in notepad into here. Don't 'fix' anything.

If you have trouble pasting the log (because this forum won't let new users post links), then try www.pastebin.com and private message me, or email me the link (or the log itself) at [EMAIL="russ_temp@fmail.co.uk"]russ_temp@fmail.co.uk[/EMAIL]

Lastly, it wouldn't hurt to run CCleaner in order to clean out all temporary files, in case anything is hiding in there:
http://www.filehippo.com/download_ccleaner

Let us know the outcome of each step if you want our help; good luck.

3. Change passwords
After you've given the best effort towards Malware removal, it would be a good idea to change all passwords. Also it would be worthwhile contacting credit card companies for advice.

andymc29

I got a call from these guys last night, hung up before he'd even finished his speil. I hate that some people actually fall for this. I cna imagine my mother paying out to these theves.

Octavius

Hi
I have just come across this forum after taking a call from On line PC Masters today and when trying to check them out I found it was a scam. They rang me this afternoon just as I was going out and I didn't have time (thank goodness) to sit down and go through the whole spiel so the man said he would call me back this evening and go through 'all the errors' I had on my computer. I am not very computer literate and I have to say he seemed very convincing. All the questions I asked he seemed to have very quick answers for. Because I said I wasn't aware of any problems, he said he could show me but I was a bit suspicious about this so he changed his tack and said I could look them up myself so I relented. The only stupid thing I did do was go to my computer and press Start then typed in msconfig in the search field at the bottom, pressed enter and went to the startup field to look at services which I have to say didn't mean a lot to me. He said there would be errors there that he could go through with me and fix when he called back this evening.
As all I usually do is basic emailing, I don't know whether typing that in has had any repercussions so I would be really grateful if someone could give me any advice.
I did read the threads and took the advice that was given to some of the other people i.e. using malwarebytes which came up as no malicious items detected so I hope I haven't been too stupid.
Thanks for any info.

RussJK

Octavius wrote: »

The only stupid thing I did do was go to my computer and press Start then typed in msconfig in the search field at the bottom, pressed enter and went to the startup field to look at services which I have to say didn't mean a lot to me. He said there would be errors there that he could go through with me and fix when he called back this evening.

That's a new one, normally they ask you to look at 'eventvwr'. Just looking at either of these won't hurt, and who knows he might have made some valid suggestions such as unticking Java/Quicktime/Adobe etc.

This kind of advice can be had here for free.

You're fine if that's all you did with him

asbokid

MadTechie wrote: »

He then tells me all my problems can be fixed for £85.95 per year! I say, okay but all you have done is ran a program, what else do i get for £85.95, he tells me this will stop any further problem

Sounds like he was trying to rip you off. I was offered the same "service plan" deal for only £79.99.

To sum up,
1. if someone calls you and tells you to install XYZ, just hang up!

RussJK

asbokid wrote: »

Sounds like he was trying to rip you off. I was offered the same "service plan" deal for only £79.99.

Did you have to quote a discount code?

asbokid

MARKF5983 wrote: »

The mum of a friend has been scammed by this and got caught out, (she's not stupid, they caught her at a busy time and she wasn't thinking!!!)

The difference is that whilst I notice that people are saying these fools are based abroad the emails she received had an address in Luton Bedfordshire on them!?!?!?!?!?

Any thoughts or ideas about what action she can take!?!??!

Have a chat with Luton Borough Council Trading Standards Department. They must be aware already... See weblinks below..

domain: onlinepcmasters.com
created: 18-Aug-2009
last-changed: 27-Mar-2011
registration-expiration: 18-Aug-2011

nserver: ns67.1and1.co.uk
nserver: ns68.1and1.co.uk

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Khalid
registrant-lastname: Jamil
registrant-street1: 41 St. Catherines Avenue
registrant-pcode: LU3 1QG
registrant-state: BDF
registrant-city: Luton
registrant-ccode: GB
registrant-phone: +44.7432129666
registrant-email: [EMAIL="info@onlinepcmasters.com"]info@onlinepcmasters.com[/EMAIL]

http://goo.gl/maps/vMKU
http://whocallsme.com/Phone-Number.aspx/06464480338

Octavius

Thanks RussJK. Yes that was all. I think he was trying to soften me up for the 'kill' as he did ring back that evening which also made me realise he hadn't achieved what he wanted and as I was busy a friend answered for me and gave him 'short shrift' to put it politely so I don't think that particular man will be calling back any time soon.
Very good forum with great advice - thanks once again.