Scam phone call claiming to be from Windows support

Hi,

If you need to check for malware here are my recommendations - these will allow you to do
a thorough check and removal without ending up with a load of spyware programs running
resident which can cause as many issues as the malware and maybe harder to detect as the
cause.

No one program can be relied upon to detect and remove all malware. Added that often easy
to detect malware is often accompanied by a much harder to detect and remove payload. So
its better to be overly thorough now than to pay the high price later. Check with these to an
extreme overkill point and then run the cleanup only when you are very sure the system is clean.

These can be done in Safe Mode - repeatedly tap F8 as you boot however you should also run 
them in regular Windows when you can.

Download malwarebytes and scan with it, run MRT, and add Prevx to be sure it is gone.
(If Rootkits run UnHackMe)

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

Malwarebytes - free
http://www.malwarebytes.org/

Run the Microsoft Malicious Removal Tool

Start - type in Search box -> MRT  find at top of list - Right Click on it - RUN AS ADMIN.

You should be getting this tool and its updates via Windows Updates - if needed you can
download it here.

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN
(Then run MRT as above.)

Microsoft Malicious Removal Tool - 32 bit
http://www.microsoft.com/downloads/details.aspx?FamilyID=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Microsoft Malicious Removal Tool - 64 bit
http://www.microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

also install Prevx to be sure it is all gone.

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

Prevx - Home - Free - small, fast, exceptional CLOUD protection, works with other
security programs. This is a scanner only, VERY EFFECTIVE, if it finds something come back
here or use Google to see how to remove. 
http://www.prevx.com/   <-- information
http://info.prevx.com/downloadcsi.asp  <-- download

PCmag - Prevx - Editor's Choice
http://www.pcmag.com/article2/0,2817,2346862,00.asp

Try the trial version of Hitman Pro :

Hitman Pro is a second opinion scanner, designed to rescue your computer from malware
(viruses, trojans, rootkits, etc.) that have infected your computer despite all the security
measures you have taken (such as anti virus software, firewalls, etc.).
http://www.surfright.nl/en/hitmanpro

--------------------------------------------------------

If needed here are some online free scanners to help

http://www.eset.com/onlinescan/

New Vista and Windows 7 version
http://onecare.live.com/site/en-us/center/whatsnew.htm

Original version
http://onecare.live.com/site/en-us/default.htm

http://www.kaspersky.com/virusscanner

Other Free online scans
http://www.google.com/search?hl=en&source=hp&q=antivirus+free+online+scan&aq=f&oq=&aqi=g1

--------------------------------------------------------

Also do these to cleanup general corruption and repair/replace damaged/missing
system files.

Run DiskCleanup - Start - All Programs - Accessories - System Tools - Disk Cleanup

Start - type this in Search Box ->  COMMAND   find at top and RIGHT CLICK  - 
RUN AS ADMIN

Enter this at the prompt - sfc /scannow

How to analyze the log file entries that the Microsoft Windows Resource Checker
(SFC.exe) program generates in Windows Vista cbs.log
http://support.microsoft.com/kb/928228

Run checkdisk - schedule it to run at next start and then Apply OK your way out then restart.

How to Run Check Disk at Startup in Vista
http://www.vistax64.com/tutorials/67612-check-disk-chkdsk.html

-----------------------------------------------------------------------

If any Rootkits are found use this thread and other suggestions. (Run UnHackMe)

http://social.answers.microsoft.com/Forums/en-US/InternetExplorer/thread/a8f665f0-c793-441a-a5b9-54b7e1e7a5a4/

Hope this helps.

---

Rob Brown - MS MVP - Windows Desktop Experience : Bicycle - Mark Twain said it right.

---

Ken Blake (MS MVP)

potsymoore,

You are in UK, are you ? If yes, please read the following :

Action Fraud

Action Fraud is the UK's national fraud reporting service, run by the National Fraud Authority. Action Fraud is the place to go to get information and advice about fraud, as well as to report fraud. UK citizens can report fraud online or by calling 0300 123 2040. When a fraud is reported to Action Fraud, victims are given a crime reference number and their case is passed on to the National Fraud Intelligence Bureau (NFIB), which is run by the City of London's police service.

The Action Fraud website also has an A-Z of fraud describing different types of fraud, and offers prevention advice.

---

For the benefits of others looking for answers, please mark the suggestion as Answered if it solves your problem.

I just had this happen to me aswell...  now i'm worried... cause like the person above i gave them access to my computer (yes i know stupid & I should have known better).  Now I cannot remove the ammyy admin file from my computer.  It does not show up under Control Panel, Programs & Features as being installed but the ammyy admin application file is in my downloads folder & this is where I cannot delete it from. 

HI Wendz75,

DO NOT USE THE COMPUTER that computer to contact ANYONE
as that information will be forwarded to the phony company. Use
the telephone and no compromised computers. Turn this computer
OFF and leave off with no internet access until you have taken all
corrective action.

You may be so compromised at this point you need to contact your
bank and ALL other sensitive contacts that have information on the
computer. That would include credit cards, business, email contacts
and the email accounts themselves, and other.

Remove internet access from the computer. Then scan it for malware
using the methods in the previous posts in this thread. The backup
the data off the computer using redundant methods. Lastly format
and re-install Windows - check with the System Maker or other pro-
fessional help to be sure you have all you need to accomplish this.

See the previous post about contacting the FBI and other authorities,
bank, credit card companies, credit bureaus and others.

Hope this help.

I too, just received the same call from a fellow named James representing his compay as Microsoft Associate who was going to correct a malware situation on my system, based on information received from the Global Router.  I listened to his instructions and did as he asked until he directed me to the AMMYY.com site and told me to load the FREE software.  At this point I asked him directly for a number to call or if he was in fact trying to sell me a product.  He then got very upset, rattled off a private network address claiming it was mine and stated he was going to black list me for access to the internet.  I stated I was not going to load his product at which time he really blew it by telling me to f%#@ off.  These guys need to be stopped, as other people may not be as lucky to catch on.

 

Regards,

 

John

Other FREE options include
Avast - antivirus
Spybot - Search and Destroy - Spy and Malware tools
And Zonealarm - Firewall.
all of them have free versions and work better than most any of the pay programs I have seen/used.
Cleaning up viruses and Spyware is kind of a hobby of mine, and I get infected systems with other anti-vi programs on there all the time.

Using many of the Free Scans you will find on line in a web search are similar to this phone call in that they will use the opportunity to put bad things on your system, I have seen the result of this far too often.

(Oh and MS, this window seem a bit broken, my text is going outside of the box to the right until it goes off screen and finally wraps around, makes it hard to edit) 

These guys are still at this gig, it must be profitable because you can hear their whole call centre in the background.  They knew my name and that I had a wireless network.  They claim to need the ammyy.com software to identify the malware and viruses that are being sent from your computer to theirs.  Then they would be able to connect you to the microsoft service centre to repair the problem.  If you resist they ask for someone who knows more about computers and tell you that you must be illiterate.  I'm a four year computer scientist and apparently I'm illiterate too so don't be shamed by these guys.  The guy on my phone call ended saying Oh sir, you are going to learn a big lesson when your computer crashes. LOL

How to know they are frauds: If you open your task manager (ctrl alt del) it lists all the resident programs.  You can ask these guys to tell you specifically which program is sending the information.  If they were really receiving information they would know which program was doing the deed, but they don't = frauds.

Hope you don't get tricked.