#Windows r key scam code#
#Windows r key scam password#
#Windows r key scam Pc#
#Windows r key scam windows#

Because assoc.exe, the command they asked me to type, is actually used to display which file extensions are associated with which applications, and has nothing to do with viruses at all.

#Windows r key scam windows#

That long code,, is actually a CLSID, a globally unique identifier found in the Windows registry, and itвЂ™s used to tell Windows the place in the registry that handles that file extension. вЂњ Can you read the longest line near the end please?вЂќ I did so, noting that the numbers were the same ones that they had made me write down earlier, as I finally started to figure out the game. You arenвЂ™t a real geek until you can diagnose viruses with assoc.exe. The desire to start laughing was almost unbearable, but my curiosity made me hold on to see what nonsense they were about to tell me. Once I had done so, he asked if I could type вЂњassocвЂќ and press Enter again. Next he asked me if I was in front of my computer, and once I was, he asked me to press the Windows key and the R key at the same time, and then told me to type C, M, D and press enter. Can I read that back to him? I did, 888DCA60, and he confirmed it.ДЄt this point I scrambled to boot up a newly installed copy of Windows in a virtual machine that I luckily had ready. 8, 8, 8, D as in dog, C as in cat, A as in apple, 6, zero.

#Windows r key scam code#

вЂњ Can you write down this number?вЂќ he asked, before rattling off an alpha-numeric code for me to jot down.

#Windows r key scam Pc#

This will close the browser.He proceeded to tell me that my computer was reporting viruses to their servers, and he needed me to verify my consumer license ID to make sure that it is really my PC with the viruses. Right click on the web browser entry and select 'End Task' from the menu. Under the processes tab you will see the apps that are currently running, which will include your web browser. To defrost your frozen browser, and this applies to whichever flavor of browser you are using, simply right click on the Windows taskbar at the bottom of the screen and select Task Manager from the menu that appears. If you are unfortunate enough to have got caught out by the support scammers and find yourself sitting in front of a locked browser with the telephone support number being your only apparent way to escape, don't panic. More often than not these support scammers are covering a number of possible payloads: remote installation of malware on your computer, stealing your credit card details or compromising your online banking login credentials.

These support scam campaigns are designed to scare people into calling their fraudulent hotlines in order to gain remote access to the computer and extort a 'support fee' for fixing the problem that doesn't exist. The scammers have also been changing the pages host address up to 12 times each day in order to evade detection. There are specific variations for Google Chrome, Microsoft Edge and Mozilla Firefox as well as a catch-all for any other browser client. Wang also found that the format of the pages displayed will vary depending upon the browser version being used. These HTML documents within other HTML documents are 'added by setting iframe as the page's showLogin,' Wang reports, 'making it appear when the URL is entered.' The iframe content is the authentication page URL, hence the loop which effectively freezes the browser in a seemingly inescapable lock. Rather than applying basic JavaScript coding to loop the user back to the same pop-up window, this scam does it by adding iframes. While creating a loop to a web page isn't unusual in and of itself, Wang says this campaign is different thanks to the methodology used. It urges the user to call a support number to remove the infection and prevent 'further damage to our network.' While such language would ordinarily be highly suspicious to most people, the scammers have employed another tactic to scare the user into believing the threat is real: freezing the web browser.

The 'support' window, meanwhile, claims that the computer has been infected by 'a virus and a spyware' that has stolen your Facebook login, credit card details, email credentials and photos stored on the device. Clicking to cancel the authentication pop-up just loops the user back to the same page.

#Windows r key scam password#

One asks for a username and password from the user while the other suggests they telephone Microsoft for urgent technical support as the computer has now been blocked. Nothing could actually be further from the truth, of course, and the user will be faced with two pop-up windows as they arrive. Thought to be using the traditional social engineering method of malvertising to distribute malicious links, the fraudsters direct potential victims to a web page that appears to be typical of a Microsoft technical support site.