Microsoft called me and fixed my computer

bsod

pendragon_arther wrote: »

But it was more than that, the rsoles had access to the entire hd/s. Maybe the OP isn't competent enough to wipe the hd themselves, and even if you reinstall the os nasties can still lurk in the boot sector.

These are fake tech support fee scams, not infect a pc scams. Collecting money via a phone call is far far easier than trying to hack and transfer money out of someones bank account after installing a keylogger.

Anyone capable of using a pc is also capable of scanning for malware, or re-installing windows, if they don't know how, they can google it, or ask here. Boot sectors can be wiped during a re-install, and are scanned by all reputable antivirus products.

spannerzone

GunJack wrote: »

Well, actually, I have - I've been called to 2, no 3 such machines after the scammers placed keyloggers and rootkits on them during the time they had been given remote access (and had forked out to them). Granted not all of them will, but you don't know which will and which won't, so best get it checked over if you feel it's beyond your capabilities. As long as it's not an encryption-type infection, most other things are retrieveable without resorting to new hdd/clean install.

Fair enough, you're the first instance I've seen that has confirmed it has happened so at least there's some evidence to it, previously it just seems people assume it might happen.

I'd agree with above that it's far easier to con willing victims out of money for the 'service' they've given and taken payment for than to infect a PC, but maybe some scammers also do this to allow botnets to be created to unwilling suckers.

The people I've had call me to 'sort my PC problem' don't appear to know much more than read a script and take 15 mins to realise I'm wasting their time

tyllwyd

A member of my family had this and they sold him a Windows upgrade. There was no sign of anything suspicious beyond that, and no money stolen etc, but his pc wasn't suitable for the new version of Windows and never worked properly afterwards, so they seemed to be incompetent more than anything else.

gazter

bsod wrote: »

Very unlikely, they were after $150, and they got it, job done. If it was a credit card payment, the bank will most likely refund it, if asked.

A 'specialist' will charge them more money to do something anyone can do easily, adding to this persons woe's

They can scan with malwarebytes, do system restore, restore from backup or re-install windows if they are paranoid, there is no need to pay anyone to do this.

You can service your own car, cut your own grass, clean your own windows, lose your own weight, make your own sandwiches, fry your own chicken, cut your own hair etc etc.

gazter

spannerzone wrote: »

I think people are giving these scammers too much credit and skill capability, they want to fleece you a load of money by doing very little, I've not seen any evidence anywhere that they plant viruses, rootkits, steal info or other nefarious deeds.

yes they're lying, cheating, deceiful scumbags but can anyone show any evidence they actually steal your personal data - those that get caught by the scam willingly give their credit card number and that's likely all they want from the scammee.

Of course it is prudent to check for infections but it may be better to remove the PC from the user entirely

Ive seen some nasty tricks. The syskey is particularly unpleasant, though each time ive seen it, the necessary registry files to recover from werent deleted.

Another curious one which had me scratching my head. The desktop just wouldnt respond. The icons were there, but unselectable, the task bar was there, again unresposive. It was only when i noticed that the time was wrong, and wasnt changing i worked out what had happened. They took a screen grab, made it the desktop wallpaper, hid desktop icons, his taskbar and disabled taskmanager.

securityguy

I've been tempted to get some research funding and then actually pay the scammers, and forensically analyse the results. But I suspect Microsoft et al are doing this already.

Tropez

spannerzone wrote: »

Fair enough, you're the first instance I've seen that has confirmed it has happened so at least there's some evidence to it, previously it just seems people assume it might happen.

I'd agree with above that it's far easier to con willing victims out of money for the 'service' they've given and taken payment for than to infect a PC, but maybe some scammers also do this to allow botnets to be created to unwilling suckers.

The people I've had call me to 'sort my PC problem' don't appear to know much more than read a script and take 15 mins to realise I'm wasting their time

Based on some studies and info I've seen, I think it is quite likely that the people who first started this scam had a bit of technical knowledge to plonk nasties on to a victim's system or steal files, likely only asking for a fee to make the whole thing seem more 'legitimate' (after all, why would a multinational corporation do something for free? ).

Possibly due to the 'success' of the scam, a bunch of other groups got involved purely for the couple hundred bucks per sucker they could snag, or working credit card number, getting a few people to make outbound calls reading from a script and then having the head honchos reel in the fish when someone appeared to be biting. These groups are possibly more common, as they require much less expertise (anyone could use TeamViewer for example and watch someone enter their credit card number into Paypal) but I don't think the people who can take it further have necessarily stopped either.

GunJack

gazter wrote: »

Another curious one which had me scratching my head. The desktop just wouldnt respond. The icons were there, but unselectable, the task bar was there, again unresposive. It was only when i noticed that the time was wrong, and wasnt changing i worked out what had happened. They took a screen grab, made it the desktop wallpaper, hid desktop icons, his taskbar and disabled taskmanager.

This had been done on one of the machines I mentioned earlier - likewise I was head-scratching as to what they had done, so imagine what it was like for a non-techie pc owner..... these scammers are just twonks :mad:

enfield_freddy

they had to do things like that in staples (time computers) years ago , after the local "clowns" found it fun , going to a command prompt and typing "fdisk" , totally dead machines the following day when they fired them up , this was back in win 95/98 days

gazter

GunJack wrote: »

This had been done on one of the machines I mentioned earlier - likewise I was head-scratching as to what they had done, so imagine what it was like for a non-techie pc owner..... these scammers are just twonks :mad:

Yeah, but keep me in business.