Scammers' alternative to TV

[Mick]

Just recently visited a lady whose ASUS AIO was the target of scammers from 'Virgin Media'. Her bank had advised her to get her computer looked at by an 'expert' to get rid of any junk they'd installed and generally give it a clean bill of health. While I'm there, combing through the hosts file etc, I come across a copy of Team viewer with an installation date about a week ago. Uninstalled that, but then found a copy of something called 'Anyplace Control Portable' dropped into the Programs(x86) folder. Never come across this one before, so I Googled it. 'Based in the Ukraine' was good enough for me, so I looked around for an uninstallation file - which did not exist. Not that surprising if it's a portable program. Doesn't show up as an installed program in Control Panel either, doubtless for the same reason, and there's no icon on the desktop to give you a heads-up. Revo wouldn't find it either, so basically, the only way to spot this nuisance is to manually examine the folder tree in File Explorer, then clear it out using a combo of the delete button and a reg cleaner.

As I said - this was new to me. Maybe I'm just late to the party, but thought it worth mentioning as a tool scammers may be switching to now that TV is so widely known for this sort of thing. I did notice that MBAM picks it up as a PUP, so that's a bit of good news.

 

[timeshifter]

Good catch. I'd recommend a nuke and pave if I were working on a system in that situation.

 

[Porthos]

Good catch. I'd recommend a nuke and pave if I were working on a system in that situation.

I also have them change all passwords everywhere. (Thief/scammer could have harvested them from the browsers )

 

[glennd]

Just recently visited a lady whose ASUS AIO was the target of scammers from 'Virgin Media'. Her bank had advised her to get her computer looked at by an 'expert' to get rid of any junk they'd installed and generally give it a clean bill of health. While I'm there, combing through the hosts file etc, I come across a copy of Team viewer with an installation date about a week ago. Uninstalled that, but then found a copy of something called 'Anyplace Control Portable' dropped into the Programs(x86) folder. Never come across this one before, so I Googled it. 'Based in the Ukraine' was good enough for me, so I looked around for an uninstallation file - which did not exist. Not that surprising if it's a portable program. Doesn't show up as an installed program in Control Panel either, doubtless for the same reason, and there's no icon on the desktop to give you a heads-up. Revo wouldn't find it either, so basically, the only way to spot this nuisance is to manually examine the folder tree in File Explorer, then clear it out using a combo of the delete button and a reg cleaner.

As I said - this was new to me. Maybe I'm just late to the party, but thought it worth mentioning as a tool scammers may be switching to now that TV is so widely known for this sort of thing. I did notice that MBAM picks it up as a PUP, so that's a bit of good news.

Was it running? Was it the client or the server?

 

[Mick]

Was it running? Was it the client or the server?

It wasn't running, but that was likely because I'd got the machine in safe mode at that point. I did notice it had both the admin and user/client modes installed. Luckily, this customer doesn't use this machine for banking etc, - there's not even an MS account log-in set - so the only passwords to be gleaned were her email account, which I changed.

 

[Markverhyden]

Good catch. I'd recommend a nuke and pave if I were working on a system in that situation.

That what I tell all of my M$ OS customers. A customer of mine called me up last Tuesday, her 90 year old mother fell for a support scam popup. In her case she had an old XP Pro machine but I was able to find a W7 Pro refurb at Microcenter at a nice price. Never really looked at it but they carry a nice, low priced selection of refurb business machines, desktops and laptops.

 

[fencepost]

The biggest problem with a W7P is that support for it ends in ~1.5 years. I suspect it'll still activate if upgraded to Win10, but at this point I can't see putting a W7 box into production anywhere.

 

[GTP]

The biggest problem with a W7P is that support for it ends in ~1.5 years. .

That doesn't mean it will suddenly "stop working." It just means no more updates. Depending on what they are using it for there's no reason to move to Winspy 10.
I'll continue on with Win 7 till the day I die despite the problems I'll inevitably face.

 

[Porthos]

I'll continue on with Win 7 till the day I die despite the problems I'll inevitably face.

But you are a tech and can mitigate any issues in the future. Our clientson the other hand.

 

[GTP]

But you are a tech and can mitigate any issues in the future. Our clientson the other hand.

Good point and one I failed to consider before hastily responding to the post. I guess it would have to be evaluated on a case - by - case basis.
I don't discourage clients from upgrading to (or buying new equipment) with Win 10 but at the same time I don't recommend they do either.
If their current OS is doing everything they need I encourage them to continue with it until they do experience problems or need to update hardware.
When clients find out about things like being able to sync contacts, talk to (shudder) cortana, or their kids learn about the xbox gaming stuff in Win 10, then they usually want to upgrade to get those "features" to use MS speak. That's the time to upgrade.
I've had clients upgrade for the sole purpose of getting "Candy Crush" in their start menu...

 

[Diggs]

I'll continue on with Win 7 till the day I die despite the problems I'll inevitably face.

(Maybe we should set up a GoFundMe page for counseling for @Barcelona. I bet a professional could help. chuckles.....)