Microsoft Security Phone Scam

Microsoft's advice: Hang up on tech support scammers ...

In light of the second client to fall victim to Tech support phone scammers, I am writing this post today to warn everyone to hang up on anyone calling to tell you that your computer is infected or sending viruses/Trojans.  An alternative method used by these criminals is to send an email claiming to assist you in receiving the Windows 10 upgrade.

If you receive an email or phone call from someone claiming to represent Microsoft, press ‘delete’ or just hang up. Never give remote access to your computer to anyone you don’t know, and don’t click on unknown links or files.

If you are willing to lend an ear to the scammer the next step is they will request access to your computer via Remote Desktop.  Once in they will steal information, erase restore/recovery points and encrypt the SAM hive of your computer and upon restart you will be required to enter a password that you do not know.

How these scams work

• You receive an email or phone call claiming either that you can get a Windows 10 upgrade sooner, or, that there is some problem with your installation of Windows 10.
• You will be directed to click on a link or visit a website to download software.
• The software is ransomware which will lock you out of your computer and demand a payment.
• If you pay, you will lose every cent that you send. If you have clicked on an infected link or file, you may also compromise your device’s security in other ways.

The client yesterday had 2 computers compromised. I was able to recover one of the computers using System Restore, he had hung up on the scammer while he was working on this computer after being presented the cost to supposedly fix the computer.


The other computer was unrecoverable since the scammer had erased restore points, disabled all programs and upon restart the computer needed the unknown password. We had to do a new install of Windows 10 on this computer.

*Remember that Macs do get malware and it highly advised that you install an Anti-Virus product on your Mac.

Since these scams use a website, any device that has a browser can fall victim to this type of scam. They’re not OS dependent so if your internet enabled-toaster has a screen and a web browser it could get this type of alert! Joking aside, since it’s a browser-based scam, it’s advisable to have a backup browser installed just in case you have issues with your primary browser.

Further reading,

http://www.computerworld.com/article/2998175/security/microsofts-advice-hang-up-on-tech-support-scammers.html

http://www.computerhope.com/issues/ch001385.htm

http://answers.microsoft.com/en-us/windows/forum/windows_xp-security/does-microsoft-or-a-microsoft-call-center-ever/33968898-8371-e011-8dfc-68b599b31bf5

http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/phone-call-scams-claiming-to-be-microsoft/aefc50a4-d7a4-4c79-8db5-2fafcd6ad196?auth=1

New 6th Generation Intel Processors

30x Better 3D graphics vs. a 5 year old PC

2.5x Better productivity vs a 5 year old PC

Get Creative, Play Harder,striking visuals in higher resolution, faster frame rates, Ultra HD 4K multimedia experiences.  With a 6th generation Intel® Core™ processor inside, you can watch, play, and game like never before.  Bring the action to life.

Security Update: New malware and threats to PC security

Destroying your hard drive is the only way to stop this super-advanced malware

"Kaspersky published a detailed report Monday about Equation, which it considers the most advanced group of attackers to date and whose activity spans back to 2001 and possibly even to 1996. Even though the company stopped short of directly linking the group to the U.S. National Security Agency, there are significant details that point to such links."  PCWorld

A couple of years ago I published a blog post about the Stuxnet worm which infected and wreaked havoc to the Iranian centrifuges that were attempting to develop nuclear fissionable material for Iran's nuclear program.  Groups studying the code for the worm attributed the code writers to clandestine players, the CIA or NSA.  The problem was the code escaped and was utilized by crime groups to infiltrate the general PC population. Today there is a new threat that delivers it's threat by modifying the firmware of your hard drive.  Firmware is the low level code that acts as the interface between the software and hardware.  It is contained in the chips solder into the hard drive's interface board.  Once installed it is impossible to remove.  Formatting and re-installing the operating system has no affect and the malware remains in the chip ready to deliver it's payload.

http://www.pcworld.com/article/2884952/equation-cyberspies-use-unrivaled-nsastyle-techniques-to-hit-iran-russia.html?null

http://www.pcworld.com/article/2885192/fanny-superworm-likely-the-precursor-to-stuxnet.html

Help for the Cryptolocker (FBI) virus

The Cryptolocker virus made the news last year.  It is a particularly destructive malware program that encrypts, Word, Excel, PDFs and JPEG files to name a few and tries to force you to pay a ransom for the key to unlock your files.  Without the encryption key there is no way to recover your files without a good backup.

A client of mine was attacked last year, it occurred over a weekend so by Monday all of her documents, spreadsheets and pictures were locked and unusable.  I was able to remove the malware but it was too late for her files.  At that time I noticed that she had Carbonite and it was in the process of backing up the encrypted (changed) files.  I stopped Carbonite and she was able to contact Carbonite tech support and recover her files by restoring a back up that occurred prior to the date of infection.

The good news about Cryptolocker is that a group has somehow acquired the ransom keys used to unlock the files.  If you are attacked, submit to them a file that is encrypted and they will provide you with the key needed to unlock your files.  Be alert and please have a good backup.

http://www.wehatemalware.com/attacked-by-cryptolocker-help-is-here/

Google Chrome browser targeted

Recently I have seen an uptick in malware targeting Google's Chrome browser.  In each case the malware was delivered while the user was attempting to download a program they had Googled searched for. The delivery method for a lot of the new malware is distribution via junk email attachments, malicious torrents and particularly free applications. When searching for software using a search engine, the first listings in the search will be ads or sites that purport to be a download site for the desired software.  In most cases the listings are either scam sites which attempt to direct trick you to download alternative software/malware, or they deliver malware in addition to the desired program. Always carefully check the link provided if you click the link to ensure that the address is the website of the developer or manufacturer of the download you desire.

2 new Intel K CPUs, Gamer Desktops, high end components, DF Core i5-4690K, 3.5 GHz and Core i7, 4790K 4.0 GHZ