AMMYY Scam

I just had a phone call similar to everyone else. He, an Indian or Pakistani, said he was from Trust Support and when questioned, he claimed he was in Finchley, North London, As with other people there was lots of background talking which tends to make you think it is legitimate.

Trust Support is a legitimate company but probably not his company. He knew my email address which puzzled me as I hadn't told it to him. OK the phone number can be random but how do they link the phone number with the email address ? 

He asked me to type in netstat at a command prompt which I did. Then he wanted me to log on to www.ammyy.com at which point I became more suspicious and after googling, found this Microsoft forum.

I told him I wasn't going into it and he then gave me an alternative site www.121usa.com which is another remote support site. No way was I giving him access to my computer.

I then told him I wasn't going any further and hung up on him, having wasted 20 minutes talking to him.

Got the call today.  I knew right away what this was as many of the users on my network have reported receiving this kind of call, but I was ready.   First he identified himself as working for Windows, never mentioned Microsoft.  He said they had detected some errors on my computer and they were calling to help me fix them.  Then suddenly a new guy started talking who later identified himself as a supervisor.

As a disclaimer, I am a network security specialist, so please don't try this. 

I had created a virtual machine that was isolated from any other network segments and only has access to the internet for just this purpose.  The virtual machine took a little while to spin up so in the meantime I was just playing along for a little while and wrote down all they asked me to do and answered their questions just by knowing what they were looking for.  The "technician" asked me to examine my event viewer by going to "windows key" + R and type eventvwr and then asked me how many red crosses and yellow triangles I saw.  Instead of having you go to ammyy.com, the "technician" had me go to www.teamviewer.com and join a session, but we will come back to this.  

My virtual machine had not been reset from the last time I had tested some malware on it, so I told the guy that my kids needed some help and could I call him back because I was "really, really concerned about my computer".  He said no, but he would call me back in 10 minutes.  I figured that was the end of it, but continued to reset my virtual machine anyway.  Sure enough he called back about 20 minutes later.

I made this guy suffer.  I faked an impromptu reboot, claimed it was running really slow, then a windows update, followed by another reboot.  I acted all frustrated and said, 'Man this thing is really slow today."  To which he responded, that's because of all the infections.  He started asking about my kids ages and I gave him fake ages.  At one point I think he started to get frustrated because he said, "I'm just trying to get some of your personal information so come on!"  I almost lost it at that point, but instead I just kept apologizing for "wasting his time".  He asked what version of Windows I was running and I told him XP to which he responded, "Good, Good, that's the best one!  You should keep that forever.  All the best technicians still run XP!"  He asked me about what browser I was using and I told him Internet Explorer.  He said Internet Explorer is the worst you should use Mozilla.  I almost asked him how he could say that if he worked for Microsoft, but I didn't.  He asked me about my anti-virus and I told him, "just the free Microsoft Security Essentials." He said that was why I was infected.  I asked how he knew it was this computer and not the other one in my house (I have several, but didn't tell him that), he said it is Window's job to know and then to help out and that it was definitely this computer.  So I said, "oh, okay" I figure the longer he's on with me the fewer other people he will be able to screw over.

Anyway, I finally "got it working" and then he asked me to go to www.teamviewer.com and click 'Join a session' and then he asked for the ID and password, since it was in a virtual machine, I gave it to him.  I watched him then go to ammyy.com and download the software and run it.  Then close teamviewer and opened the event viewer.  He says wow that's a lot of errors.  Then he clicked the start button and says, "why is your username XPMUser?"  I said a friend set it up for me and that's what it always said....I thought for sure I was busted, but nope he just kept right on going.  He opened a command prompt and typed "tree" and it displayed all the directory trees.

Then I watched him right click and hit paste and on the command prompt he pasted, "Your Software Warranty has Expired" and he says, "Oh see there at the bottom?  Your warranty has expired"  At this point I was getting bored, so I logged into my firewall and blocked the virtual machine from the internet and waited.  He says, "uh-oh, looks like I got disconnected."  To which I said, "let me check.  I think my internet is out!  Let me reboot my cable modem and see if it fixes it."  He replies, "I was just going to tell you that I see errors from your cable modem.  Try rebooting it, that should fix it!"  I don't have cable internet, so that was pretty funny. 

I waited a minute while he started to tell me all about these warranty plans that he had to offer.  He had a 3-year warranty and a lifetime warranty and the lifetime warranty was not the life of my computer, but my lifetime.  It became clear that he was trying to sell me some kind of fake warranty and not really trying to install malware, so I said, "There looks like we are back online." and promptly hung up on him.

This is where it gets annoying.  They called back 30+ times over the next 2 hours.  A few times I answered and then hung up and ran a phone trace, but to no avail.  The call always comes up as Caller ID Unavailable.  So I need to follow up with my phone company and see why the anonymous call blocking isn't working.

Anyways, hope you all enjoyed that little encounter.

This just happened to me! An indian lady rung and told me to go to run, type in ammyy and give me the ID code. I was suspicious straight away and googled ammyy and I saw the link referring to tis being a scam. I gave her the fake ID then hung up. She rung back and was all "sorry, we got disconnected" I said "No, I hung up on you because I realised this was a scam" to which she said... "Ok, bye" and hung up.