Justreceived a call on a Saturday morning 10/1/2022 (ID showed: a local number in my area
203-235-9206 - which of course doesn't ring when you call it back) from a person claiming he is from Cox and alerted me that the Cox internet server crashed last night and they need to reset my computer and its modem to work properly with their network.
He asked that I check my modem to see how many lights are flashing. Then he asks that I sit in front of my Windows computer and find the control key on lower left side of keyboard. He then says "Now hold down WINDOWS four-squared key and press the letter R key" (this brings-up the "Run" command box). He then wants you to type in the Run box: msconfig - run it and then look for "Services" tab. He will then ask how many programs say "stopped" (your response lets him know you are actually performing his requests - it does NOT harm your computer - as you (and he) haven't really "run" any damaging commands - YET)!
Once he is confident you are actually in front of / and using your computer, he will ask you to return to the command box, delete the "msconfig" lettering most likely still residing in the box and replace it with a command to download from "
www.ultraviewer.net" (setup vrsn 6.5). THIS IS WHERE THE RED FLAG OF CAUTION IS NOW FIERCELY WAVING IN FRONT OF YOUR BRAIN!!! The caller wants to take CONTROL OF YOUR COMPUTER (possibly to plant spyware, malware, etc)!!!
Although I already clearly understood this was a scam (even though he tried hard to make it feel proper), I played along with his request (never really downloading the file) and I stated my virus protection software was alerting me of a possible security violation has stopped me for proceeding to this site (which McAfee did do). He asked me to ignore the alert as he is from Cox.
i was on the internet looking at celebrity photos when my computer "locked". I was told that I needed to call a support number via a voice that came over my computer. Basically it was a sales pitch from ultraviewer. I shut my computer down multiple times to get rid of this voice to no avail. After speaking to 'Samuel" I was able to end our connection and uninstall this ultraviewer app. He said my computer was hacked which I do not believe,
UltraViewer is a legitimate remote access software which allows users to connect and control systems over a distance. Tech support scammers rely on such programs to gain access/control over their victims' devices. It must be stressed that the developers of this software are not associated with scams; cyber criminals abuse these apps for their own malicious goals.
Technical support scams are promoted on deceptive websites, and they typically involve claims about users' devices being infected but recoverable by calling "expert technicians", "technical support", etc.
As mentioned in the introduction, UltraViewer is a legitimate application that offers remote access/control functionalities for single/multiple devices, file sharing, chatting, etc. This program is operational on Windows XP all the way to the Windows 11 operating system version. However, like many other remote access tools, UltraViewer is misused by cyber criminals to facilitate their scams.
Tech support scams require remote access so that the scammers could variously abuse victims' devices/data for revenue - under the guise of providing "technical support" services. This is achieved through the use of software like UltraViewer.
Remote app developers are aware of the potential abuse of their software and tend to use a variety of security measures to counteract it. To connect with another device using UltraViewer, the user needs to give their UltraViewer ID and password to the connecting party. The program aims to prevent repeated access by generating new passwords for each session, which the user can terminate at any time. UltraViewer also employs preventative measures against brute-force attacks - to stop cyber criminals from forcibly obtaining said passwords.
However, there is a feature that allows for custom passwords to be set, which do not change after the session is terminated. At the time of writing, our testing revealed that it is possible for the party remotely controlling a device to set a custom password on UltraViewer.
Hence, scammers do not need to walk their victims through multiple steps on how to create such a password, as they can do so themselves upon initial access. This means that a device can be reaccessed repeatedly without requiring the user to provide their password consecutively - one instance is enough.
Furthermore, UltraViewer has an "unattended access" functionality, which the connected party can configure on the remotely accessed device. Therefore, the cyber criminals can eliminate the necessity of any user interaction past the initial one by using this function. They could then turn on the device (a feature available on certain Windows versions) and control it at any time without user consent.
As an additional measure, remote access software often displays warnings when a user is about to allow a connection from regions rife with scammer activity. Alternatively, some remote apps use geoblocking to prevent connections from specific regions/countries outright. However, UltraViewer's official website states that it uses no geographical restrictions.
Note that no website can detect threats on your system, and no genuine company (e.g., Microsoft, McAfee, Norton, etc.) uses such warning sites and demand you to allow "technicians" to access devices remotely. Hence, if a page makes such claims and encourages you to call provided numbers and/or permit remote access - know that it is a scam.
Technical support scams are promoted on rogue websites. This deceptive content warns visitors of various fake threats present on their systems. Common themes include: trojan/virus/malware infections, detected hacker activity, computer blocked for security reasons, pirated software/OS found, etc.
These fraudulent messages are often disguised as alerts from legitimate entities like Microsoft/Windows, McAfee, Norton, etc. For example, the screenshot of a tech support scam above mimics Microsoft's official website and overlays the disguise with fake threat alert pop-ups.
These scams urge users to call the provided helplines to resolve nonexistent issues. Afterwards, the scammers instruct victims on how to download/install remote access software. Once the ID/password of such a program is given to the cyber criminals, they connect to the victim's device. How the scam progresses from that point on may vary.
Typically, the scammers continue with the charade of being support/technicians and perform hoax system scans, bogus malware removal, etc. In most cases, these fake services and/or yearly/lifetime "support subscriptions" cost exorbitant amounts of money.
Criminals tend to use difficult/impossible to trace currencies (e.g., gift cards, pre-paid vouchers, cryptocurrencies, cash hidden in packages and shipped, etc.) to avoid persecution and prevent victims from retrieving their funds.
Technical support scammers can cause severe damage to devices, e.g., disable/remove genuine security software, install fake anti-viruses (require purchase, yet are nonoperational), or infiltrate trojans, ransomware, and other types of malware.
Cyber criminals usually target highly sensitive data, which they can obtain by tricking victims into revealing it (e.g., over the phone, typed where scammers claim they cannot see, through phishing sites/files, etc.) or by downloading it from the device (possibly with the aid of malware).
What is more, successfully scammed victims are often targeted repeatedly. To summarize, by trusting a tech support scam - users can experience multiple system infections, data loss, severe privacy issues, significant financial losses, and identity theft.
If you cannot close a scam page, use the Windows Task Manager to end the browser's process. Keep in mind that the previous browsing session must not be restored when reopening the browser - since that will also open the deceptive website.
And if you have disclosed data to scammers: in case of log-in credentials - change the passwords of all potentially exposed accounts and inform their official support; for other private data (e.g., ID card details, passport scans, credit card numbers, etc.) - immediately contact the corresponding authorities.
If you have fallen victim to a technical support scam and allowed cyber criminals to remotely access your system: first, you must disconnect your device from the Internet. Secondly, uninstall the remote access software the scammers used (e.g., UltraViewer, TeamViewer, AnyDesk, etc.) since they may not need your permission to reconnect. Lastly, use an anti-virus to run a full system scan and eliminate all detected threats.
We have analyzed thousands of online scams; "Your Windows Got Corrupted Due To Virus", "Pirated Windows Software detected in this Computer", "DRIDEX..Malware detected - Error Code: DXRW2:#19X80XD", "MICROSOFT WINDOWS With Pre-installed Mcafee" are just some examples of technical support scams.
Various scam models are used to deceive users; they range from fake virus alerts to hoax prize giveaways. The Internet is rife with deceptive and malicious content. Therefore, we highly recommend being vigilant when browsing.
Deceptive sites can be force-opened the moment you enter a webpage that uses rogue advertising networks. The latter can also cause redirects to scam pages when hosted content is clicked (e.g., buttons, text input fields, ads, etc.).
Spam browser notifications and intrusive advertisements promote online scams as well. Mistyping a website's domain (URL) can also result in a redirect (or a redirection chain leading) to a dangerous site. Additionally, adware can display ads that endorse scams or force-open their sites outright.
We advise against visiting/using websites that offer pirated software/media or other questionable services (e.g., Torrenting, illegal streaming or downloading, etc.) since they are usually monetized through rogue advertising networks. Pay attention to site URLs and be careful when typing them.
3a8082e126