Watch Out! Telephone Tech. Support Scams

Watch out for a scam that’s on the go at the moment. It goes like this:

You get called up out of the blue by “Microsoft” or some such reputable-sounding company. The person who calls you normally seems to have an Indian-sounding accent. I purely mention the caller’s accent as it seems to be a common feature – you should watch out for this kind of scam regardless of the caller’s accent. You are told that your computer is infected with a virus or with malware. You are often asked if your computer has been running slowly or freezing lately.

Of course they’ve got the solution for you! At this point you’re often transferred to their “superior” or “manager” who tells you of the sorry state your poor computer is in and how they have the means to fix it. For a fee of course. This usually seems to range from 120 to 260 euro.

The “fix” seems to involve them getting you to browse to their website and download some remote access software which they then use to take remote control of your PC. At this point God knows what could happen! They have remote control of your PC and could install malware, key-loggers, web-cam spy software, anything really. They could look at your personal data, delete important data or system files, you name it.

What often seems to happen is they get you to look at your event log, tell you that the errors you’re (inevitably) seeing are due to an infection and then remote access your PC and perform a set of fairly pointless tasks such as defragging the hard drive and running Disk Cleanup. Often they apparently turn of the event-logging service so now you won’t see any more errors appearing! They then charge you for this waste of time.

Beware! No legitimate business will contact you out of the blue in this way. How would Microsoft know you have a virus and take it upon themselves to go and fix it for you? It’s all a load of nonsense so just hang up and don’t engage with them.

Here’s an example of what can happen:

Symantec sample telephone support scam

Comments

Where are SCANPST.EXE and/or SCANOST.EXE?

I sometimes have to deal with customer computers whose Outlook PST or OST files have become corrupted. Very often the fix is to run SCANPST.EXE on the offending PST/OST file. However, every time I go to do this I forget where the two executable files are. Here is where they are on a Vista machine running Office 2007: C:\Program Files\Microsoft Office\Office12 I hope this helps.

Resolve WSUS Server issue that gives "Cannot save configuration because the server is still processing"

This is a pretty infuriating error and can sometimes crop up as a result of running a "wsusutil reset" command. First of all, give the server some time, and then a bit more... but you've probably already done this. These steps may help to resolve the situation: - Install Microsoft SQL Management Studio (free download) - Run SQL Management Studio and start to connect to the WSUS database - Enter this in the "Server Name" box: \\.\pipe\MICROSOFT##WID\tsql\query - Expand the "Databases" tree - Right-click on "SUSDB" and choose "New Query" - Paste this query in: UPDATE tbSingletonData SET ResetStateMachineNeeded = 0 - You should see a message like "1 row affected", which is good - Quit SQL Management Studio - Open "Services" and restart the "WSUS Service" - Now, open WSUS

Logon Scripts in Group Policy not running

Problem Was having difficulty with a logon script I had created and was deploying to users via Group Policy. The script was to customise printer settings for certain users. But it just wasn't running when the users would logon to their PCs. The GPO was applying properly, and I could run the script manually without issue. Cause It turns out that it was happening because, by default, logon scripts don't run for 5 mins after logon occurs on a Windows client PC. Solution This can be adjusted by setting the "Configure Logon Script Delay policy" to "Enabled" and then configuring a better delay. Note: if this policy is set to disabled or not configured, the default delay of 5 mins will apply. I initially set this delay to "0" but found that wasn't successful. Perhaps the script needed a small delay. So I set it to "1" (1 minute) and it worked nicely. I must also note that during the troubleshooting process, I read many recommendations to e...

Artifact Weblog

Search This Blog