ScamBait 2015-03-31: Tech support scammer apparently surprised by scam accusation

• Report rights infringement
• published: 01 Apr 2015
• views: 13182

Tech support scam company advertising on a typosquatted domain for Google. I let him into my isolated VM, and he ran "diagnostics" on it. After confronting him with his false diagnostics (and believing that he was simply following a script), he expressed surprise that his company was doing this. Interesting bits: 2:30 Cyril (end user) calls the scammer company. 5:40 Scammer offers to look up my warranty based off of service tag (Cyril said it was a Dell). 7:00 Oops, Cyril messed up - the Dell is his laptop, this desktop is a Lenovo. Looks like he'll have to come up with a valid serial number. 9:00 Cyril can't find the serial number. The sticker on the back is messed up, too. :( 10:30 Scammer offers to look up our warranty by name and ZIP code. 11:15 Scammer comes back that there's no warranty on the PC, it expired after one year. 15:30 Cyril says that maybe this was just a web page (since it was sounding like we weren't going to get a free diagnosis). 20:00 Cyril begins the remote session with the scammer. 21:15 Scammer starts a "tree" command using my special version of "tree". 21:30 Scammer loads "msconfig" to look at Services, claims the stopped ones should be running. 23:45 The "tree" command completes, with a warning about CSRSS.EXE entered (confirmed pasted, not typed via keylogger). Narwhal Internet Security has already appended it's answer to the "tree" command, though. 25:30 Scammer opens "regedit" and checks "HKEY_LOCAL_MACHINE\Security" - nothing is found (normal), but he claims this is due to the security of the machine being compromised. 26:00 Scammer runs a "netstat", provides general misinformation about ESTABLISHED connections. 32:30 Cyril asks one last time about the web page ad, to confirm it's a security warning. 33:20 Scammer shows the Windows Temp directory and states they're unwanted files that need to be removed. 36:00 I ask if the scammer just typed the message while the "tree" program ran. 36:45 Explain how I got to the ad directing me to call them. Rep looks at the site that showed the ads.Also explain what the "tree" and "netstat" commands actually do. Inform him that maybe the people who run the company aren't being honest with him. 39:00 Rep explains that they were giving training about scanning and troubleshooting. I review with him about how the typosquatting site works and how his company provided bad info in his training. 41:00 Rep seems genuinely worried and distraught that the company is doing this. I answer several questions for him about anti-virus, anti-malware, firewalls, etc. 46:45 I explain to the rep how a lot of companies are doing this to solicit business, as well as how to bypass the website's popup flooding. He thanks me for explaining, I thank him, and we part ways.