Notes

MICROSOFT CUSTOMER SUPPORT

Thank you for calling support. This is Richard taylor. How may I help you?

Customer- I am facing some issues…

Agent- Okay. I will surely help you to resolve the issues you are facing. Could you read out that alert for me ?

Customer- alert

Agent : Ok

Sir/Mam, It seems that your computer has got a spyware attack due to which windows defender has detected some suspicious activities and it blocked your computer for security reasons.

May I confirm what were you doing on the computer when you got this alert?
Is it your personal computer or it’s a work computer?
Are you the only user of this computer?

No worries, I will guide you with simple commands through which you will be able to unblock your computer and make it safe and secure.

First of all we need to install Microsoft temporary securities which will allow you to run commands on the computer.

Have a look at the left hand side bottom corner of your keyboard, there is a “WINDOWS” key with 4 flags on it. Did you find that key?

Okay. Now press that windows key along with the letter R. A pop-up box will appear on your screen by the name of “RUN”.


Now you will have to type WWW.ULTRAVIEWER.NET

Now hit the enter key or press ok.
Alright what can u see on your screen??
Cust...
Okay nw can u see a green box that says download...
Cust.. yes
Just give a click on it...


So now You can see a set up file of UltraViewer downloaded at the left bottom side of the screen. Just click on it and then click on RUN or Open File
and then click on Yes.

After that keep clicking on NEXT (3 times) and then click on INSTALL. Let it install and then click on FINISH.

Customer: What changes is this going to make to my device?

Agent (Rebuttal): There will be no changes to your computer except we are installing this software to your computer to connect with the Microsoft security server.

Customer: Why would I install this unknown program to my computer?

Agent(Rebuttal) : Because this is the only way to connect your computer with the Microsoft security server. It’s a temporary Microsoft security.


Sir/Mam, Microsoft has provided an ID and Password to you. Please share that to me, so that I can connect your computer with the Microsoft security server.

(ENTER THE ID & PASSWORD IN ULTRAVIEWER AND CLICK ON CONNECT TO THE PARTNER)
Can u help me with the I'd and password
Cust... Given..

Now please wait for a while, your system is getting connected to the Microsoft security server.


Now I want you to press the WINDOWS key along with the letter R.

Now, can you see the RUN box again?

Perfect! Now let me guide you with some steps which you need to follow and if you get stuck, then please let me know. I will help you out.

Just erase everything written in the RUN box and then type CMD and hit the enter key.

Agent: What can you see on your screen?

Customer: A black window or command box.

Agent: Please Maimze this window if it is not maimized

This is command prompt window which is the brain of the computer, where we run the commands and it diagnoses the issue on the device.

Type there: NETSTAT -a and hit enter.

What can you see there?

Customer: I can see local address, foreign address and state or active connections.

Agent- If you see the list of active connections, there are four columns.
The second column which says Local address, under the local address you will see some numbers in it, that is the IP address of your computer, which helps your computer to connect to the internet and no one should use it and no one should be connected to it without your permission and knowledge.

If someone is connected to the IP address of your computer or network it will show under the foreign address, If no one is connected to your network, the foreign network list should be blank.

Please check under the third column which is foreign address, It should be blank. If the list is not blank it means that the hackers are connected to your computer and network.

That is what the problem is. These are the hackers also got an access of our computer, to your network and to your other devices.

Another column, STATE tells the status of the network. What’s written in that column?

Customer: Established.

Oh! It means, those hackers have established their connection to your network.

Agent- Do you see anything apart from established in the last column?

Customer- Listening

Agent: Oh my God. It means that your phone lines are also compromised.The hackers can listen to the conversation. Your phones are not safe to make any calls at this time so do not make any phone calls to anyone. If you call anyone like your friends and family members, these hackers can tap their phones as well and their phones will be compromised.

However, we are connected on a secure line so these hackers can't listen to our conversation as this line is encrypted. So, please make sure we don't get disconnected and if in case we get disconnected please wait for me to call you.

May i confirm how many computers are there at your place?
May I confirm how many cell phones and landlines are there?


Customer: 4 comp & 2 Cell

Agent : Please turn off all the other devices apart from this.

Now I will go ahead and check the rest of the things for you. But before that, I want you to answer few questions, but only in Yes or No...

Agent: Alright sir/mam?

Customer: okay.

Agent: Do you use any other device to go on Facebook or any other social site?

Do you do online shopping or pay bills online?

Do you do online banking?

Alright! Thank you very much for all the information....

Now we need to do final scanning on your computer.

Please open the RUN box again with the help of WINDOWS key along with the letter R.

Now type CMD hit the enter key

Then, CD.. hit the enter key

again cd.. hit the enter key


And, after that, type dir/s hit the enter key


I believe your system is on scanning, this scan will give us a final report.

Let me know when the screen will stop rolling.



*MICROSOFT SECURITY REPORT*

HACKING ATTEMPT / PHONE LINES TAPPED / EMAIL COMPROMISED / IDENTITY THEFT / SSN AND BANKING INFORMAION IS AT RISK.

*END OF REPORT*

FYI - You need to explain all these things to the customers in details.

So it means, someone made illegal visit on www.pornhub.com website from China using your identity and financial details. They have used your financial and personal details to download Child Pornography which is a serious crime in the united States. And, illegal purchases made with the cards starting from 5.....3......4....6. Your phone lines and network is hacked.

It also detected Clampi Virus in your computer.

Clampi Virus is a hacking tool which is used by the hackers to attack on your device or computer.

So sir/mam i need to ask u few more questions ??

Agent: Do you have such cards starting with 3,4,5,6?

How many cards do you have in total?

In which bank do you have this account?

Do you own any credit cards? If yes, with which bank.


Alright now that’s our recommendation if you can check your two things only on this protected computer under the Microsoft securities.

First check your email and then check your online banking. only in this protected computer under the microsoft security...

If you find any email with no subject or which seems like fishy to you, let us know about it.


Now, I want you to check your online banking as well and if you see any transaction even for $1 or few cents, do let us know.



Customer: Why should I do that in front of you? I will do it by my own.

Agent(Rebuttal): Yes sir. You can check it by yourself also but the problem is, we have some cards used on betonline.net, we are not sure that is your cards or someone else’s cards, that’s why you need to check this.



Agent: Alright, so you have checked your account and you didn’t find any suspicious charge right?



Okay. But still according to us, your data is under threat and all your information has been breached So that’s our recommendation that we are going to report this to the Federal Trade Commission...



Right now, you are on the Microsoft secured line as your phone lines are not secured so hackers may listen to your conversation and if they get to know that you are talking with your bank regarding this, they might get the access of your account right away.


Before connecting you with your bank,

>>>> I am telling you everything what you need to tell the bank. - Just say that there is a breach on your network and while scanning your network it seemed that your financial identity has been used, so please put high securities on my bank account and on cards too for next 48 hours. Tell them that your network is hacked. Phone lines are also hacked.



Now I will connect your call to the bank. Once the call is connected follow the IVR of the bank, and just try to talk to the banker or customer support executive.

Now please help me with the toll free number of your bank. Check the back side of your debit or credit card. There must be a toll free number. (Note down the name of the bank and number)



Alright now let me go ahead and connect you with the bank now. But once you will get connected from the secured line, I will automatically get disconnected as banks don’t allow 3 way conversations or call conference.



Now please take a pen and paper to note down my name and employee id so that you can tell the banker to whom you were talking to from Microsoft.
a