Reset the trial counter on O’Print “AirPrint Activator for Windows”.

If you ever have the need to hack or crack the trial period on OPrint – an airprint relay / proxy / print server for Windows then here is how.

Quit OPrint
Delete the following registry keys and their sub-values.
HKLM\SOFTWARE\Wow6432Node\OPrint
HKCU\AppEvents\EventLabels\option
Delete the following file
C:\Windows\SysWOW64\config\settingenv

Re-open OPrint. The trial will be back to 30 days.

However – this software is reliable and fully worth paying for. These instructions might be ideal if you installed it and then forgot to test it before the trial period expired.
Advertisements
Posted in Uncategorized | Leave a comment

Optimum Global Services” Tech Support Scam / “0800 098 8413”

Another day and while browsing the internet I clicked on an advert that promised 30% discounts on Amazon’s prices… Then got this. (And uncovered a huge scam using about 40 different “it company” domains).

0800-098-8413-scam

The messages read as follows:

Critical Error! Some suspicious activities has been detected from your network and your system has been blocked. Call immediately on 0-800-098-8413 to prevent further data loss.

Critical Error! Your system has been blocked because suspicious activities has been detected from your IP address. Call 0-800-098-8413 immediately.

ERROR! Call for support: 0-800-098-8413

Warning!
** YOUR COMPUTER HAS BEEN BLOCKED **
Your computer has alerted us that it has been infected with a virus and spyware.  The following information is being stolen…

> Facebook Login
> Credit Card Details
> Email Account Login
> Photos stored on this computer
You must contact us immediately so that our engineers can walk you through the removal process over the phone. Please call us within the next 5 minutes to prevent your computer from being disabled.
Toll Free: 0-800-098-8413

The number victims are asked to call is a UK freephone number. “0-800-098-8413” (aka.. 08000988413 or “0800 098 8413”).

The page, hosted at GoDaddy, that showed the fake warning was:

http://jaunt-googleroutesgo.xyz/uk/microsoftnetsecurity_8413/0-800-098-8413/chrm/

It directs people to call the tech support scammers “Optimum Global Services” who seem to be operating out of the site http://www.rateditteam.com to take payments.

Unusually for these kinds of things – the address given is a UK address (not USA or India) and the postal address given on the website matches the whois:

Registrant Name: Samuel Verghese
Registrant Street: Flat 5, 25 Brunswick Terrace,
Registrant City: Hove
Registrant State/Province: East Sussex
Registrant Postal Code: BN3 1HJ
Registrant Country: UK
Registrant Phone: +44.7342047912
Registrant Email: done4ultd@gmail.com

When that initial payment failed they then tried to take payment via “www.directcontracta.com” which initially looks like an unrelated “find a contractor” website but after a bit of investigation is actually registered by the same email address as rateditteam.

Associated are the Google Analytics accounts: UA-90478716 and UA-67147650

Also related to the rateditteam.com domain is:

sammy@thearch.club (matches the Samuel Verghese name used in the original tech support scam domain and is also near Hove in the UK?)

His local computer fixing business “www.expertpcbook.com”

The shared(?) youtube channel of Samuel Verghese?: Shows three young Indian men in Mumbai and several product reviews or videos attempting to go viral and domain “3wise.men”

The company of someone who lives at the address, supposedly an “Entreprenneur”.

All the following are shady looking web design and tech support companies with similar pricing structure to rateditteam:

www.itshowwedoit.com
 www.wecansortitforyou.com
 www.firstitforyou.com
 www.yourplaceforit.com
 www.pickusforit.com
 www.jewelitsolutions.com
 www.workingwithitteam.com
 www.itexteam.com
 www.thetotalitteam.com
 www.wesortitall.com
 www.timetotalkit.com
 www.digitalsconnections.com
 www.firstinit.com
 www.timetoaskit.com
 www.ititcltd.com
 www.getandgopro.com
 www.weloveinfotech.com
 www.itdecided.com
 www.topmantech.com
 www.eyeteco.com
 www.bringhomeit.com
 www.theitcrib.com
 www.itstheitcrew.com
 www.itstheitguys.com
 www.wegotitguru.com
 www.quickresponsesolutions.com
 www.fastexpertsolutions.com
 www.totalsolutionsexpert.com
 www.expertproteam.com

Related but probably a “customer” of the scammer:
http://www.amteachings.com – A meditation class around Hove, Sussex, UK.
If you are the owner of the above meditation business above – please contact your web developer and tell them off for being involved in scams.
http://www.everybizsolution.com

 

http://www.directcontracta.com

optimumglobalservices.com

Another URL used during the scam was http://onlinescanner.somee.com/ which appears to be a fake virus warning site that even has a one time password / unique value that needs to be entered before the fake scan will start! A working code is 84651 if you fancy testing it out.

Posted in Uncategorized | 3 Comments

Squid configuration for BBC iPlayer

Hello everyone.

This might be of use for me in the future when I’ve managed to lose an existing configuration or setup – or might be of use for anyone reading this who needs to do something similar to one of my setups.

I have a customer who uses Squid in their network. The Squid proxy is used to do content filtering to prevent access to undesired content on the internet. However – to do this Squid passes all the requests on to a cloud filtering company.

The side effect of this is, even though the cloud filtering company servers are based in the UK, the BBC have tagged the egress IP as being something that they don’t allow on iPlayer! Here is the response from BBC support…

I understand you’re unable to access iPlayer as you are not recognised as being within the UK.

Your IP is showing as being registered to CLOUD FILTER COMPANY DATACENTER NAME REDACTED (third party IP databases concur). It’s also listed as proxy type: hosting, proxy description: dns. While the proxy type itself indicates that this IP isn’t recognised as a broadband connection, it’s the description of it being a DNS that is actually causing the block here.

This all seems like going the direction of getting the BBC or their “data provider” to re-categorise an IP that the customer doesn’t even own will be far too difficult.

The easiest solution was to work out the configuration required for only allowing the iPlayer content to go direct and bypass the upstream cloud filtering company.

The following lines in the correct positions within the Squid config did the trick. In this case I’ve just made all of bbc go direct as I was too lazy to identify just the iPlayer domains.

acl bbcuksites dstdomain .bbc.co.uk .bbci.co.uk
tcp_outgoing_address 10.0.0.253 bbcuksites
tcp_outgoing_address 10.0.0.254 !bbcuksites

acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3

ssl_bump peek step1 all
ssl_bump splice all

In this instance they were using squid as an https_port and http_port “intercept”. You may not need the SSL Bump stuff if you are using Squid as an explicit proxy as the CONNECT request seen by Squid is likely to be the hostnames already instead of just an intercepted IP.

If using intercept… Squid needs to have ssl-bump enabled which also means you need to be running Squid 3.5 or higher. SSL peeking is required so you can tell the https sites being accessed. A couple of components on iPlayer (even though the main page is non-https) are over https:

Looking up CONNECT request from 192.168.35.4 with url component.iplayer.api.bbc.co.uk:443

Without ssl peeking Squid would only see “52.31.81.220:443” and wouldn’t know to send that traffic direct.

In the example config lines above I’m using source based routing at the router. Traffic from 10.0.0.254 goes via the cloud provider and traffic from 10.0.0.253 goes direct.

You could easily change this to just parent proxies, tcp_outgoing_mark or any other similar routing rule ability.

Posted in Uncategorized | 4 Comments

Further CEO Email fraud..

Further to a previous scam.. an admin assistance this morning had an e-mail claiming to be from the CEO of the company.

The e-mail chain went as follows (names and domains redacted for privacy):

19 December 2016 at 14:01

Subject: INVOICE 277
Adam REDACTED <hon22@inbox.lv>
To: Tanya@REDACTED.co.uk

Tanya

How much does the bank charge for chaps payment

Regards

Adam REDACTED
sent from my iPad

19 December 2016 at 14:14

Subject: INVOICE 277
Tanya Taylor <tanya@REDACTED.co.uk>
To: Adam REDACTED <hon22@inbox.lv>

£25

Tanya

19 December 2016 at 14:28

Subject: INVOICE 277
Adam REDACTED <hon22@inbox.lv>
To: Tanya REDACTED <tanya@REDACTED.co.uk>

Tanya

Please make a faster payment of £10,560 to this account,

Beneficiary Name : Firetail Limited

Address:6 Motley Avenue
London EC2A 4SU
Phone: +44 (0) 207 148 0910

Email: info@firetail.co.uk

sort code: 777406

account: 23102260

Let me know once this transfer is completed.

Regards.

Adam REDACTED
sent from my iPad

As always – be aware of any kind of scam. Emails claiming to be invoices, emails claiming your Amazon account has been suspended.. and emails asking for payment to be made. It is always worth spending a few minutes to contact the sender directly to ensure that the request is genuine. In this case it is fairly easy to spot as the scammer is using “hon22@inbox.lv” which isn’t anywhere near the domain name of the victim company.

However – often senders get their email accounts hacked… so just because it came from a genuine email address does not mean the request is genuine.

The scammer seems to be using inbox.lv webmail and the e-mail headers give away that they are using Firefox 50.0.
They seem to be hiding behind a VPN or VPS given the amount of abuse associated with the IP. The IP used to submit the messages was:

146.185.31.214 – “92b91fd6.rdns.100tb.com”

Posted in Uncategorized | Leave a comment

TalkTalk Refund Scammers part 3

So.. another TalkTalk refund / western union scam.

You can find my previous articles on this scam here, with call recording, and here.

This time – customer is cold called by someone claiming to be from TalkTalk.

To prove their authenticity they tell the victim their TalkTalk account number – victim goes off to their filing cabinet and indeed the account number is correct. Using this “validation” the victim then follows the instructions to connect “TalkTalk” (the scammers) to their computer.

When connected to their computer they run the following .bat file:

echo
color c

cd..
cd..
cd..
tree

tree

tree
Current Status:Router software warrenty has been expired..Router is not compatible with this network..Computer got corrupted and damaged 61 percent…Router needs to be changed…Customer is eligible to get back a refund of 320GBP from TALKTALK via BANk…

pause
@ECHO off
:Begin
msg * Router software warrenty has been expired..Router is not compatible with this network..Computer got corrupted and damaged 61 percent…Router needs to be changed…Customer is eligible to get back a refund of 320GBP from TALKTALK via BANk…

msg * may corrupt your system or processor
msg * go to this site money will be refundable….
start http://www.talktalkb.yolasite.com

The final step of that batch file loads up a fake version of the TalkTalk site.. under the Contact tab are very convenient and easy logos for the scammers to talk the victim into clicking so that the victim can log into their online banking and the scammer can then transfer money or at least, obtain more personal details.

In my case they got as far as asking the victim to enter into their online banking.. The victim refused and hangs up but isn’t savvy enough to know to also turn off their computer. Shortly after their computer user account password has been changed and their registry and been syskeyed.

This time the scammers used the syskey password “9748”. The computer account password appeared to be sufficiently complicated that ophcrack can’t guess it.

The password hint set on the victims windows account was “western union”.

Posted in Uncategorized | Leave a comment

rightclickitserv.com virus scam warning.

Another day another scam virus warning advert. This time on AOL search or an AOL search paid result link!

rightclickitserv-spam-scam-virus-warning-page-wording

The box that pops up has so many line returns that the OK button falls off the bottom of the screen, probably to confuse the user into thinking their computer really has been locked.
The message reads:

rightclickitserv-spam-scam-virus-warning-page*YOUR Windows COMPUTER HAS BEEN LOCKED*

Windows Security Alert!!

System has been infected due to unexpected error!
Please Contact Microsoft Certified Expert 0-800-014-8239 Immediately!
to unlock your computer.

Suspicious Activity Detected. Your Browser might have been hijacked or hacked.

ANONYMOUS ACTIVITY

Private and Financial Data is at RISK:
. Your credit card details and banking information
. Your e-mail passwords and other account passwords
. Your Facebook, Skype, AIM, ICQ and other chat logs
. Your private &family photos and other sensitive files
. Your webcam could be accessed remotely by stalkers

IMMEDIATELY CALL Microsoft Certified Expert AT 0-800-014-8239

MORE ABOUT THIS INFECTION:
Seeing these pop-up’s means that you may have a virus installed on your computer which puts the security of your personal data at a serious risk.
Its strongly advised that you call the number above and get your computer inspected before you continue using your internet, especially for Shopping or Banking.

Call immediately for assistance. Contact Microsoft Certified Expert at (0-800-014-8239 )

Victims are asked to call a UK freephone number of 0-800-014-8239 (aka. “0800 014 8239” or +448000148239 / 08000148239)

The wording is very similar to a scam I saw back in October.

The domain the scam warning was served from was http://www.rightclickitserv.com who seem to be a SEO (Search Engine Optimisation) and tech support company. Whois on the domain is:

Registrant Name: Manish Verma
Registrant Street: 10518 Friends Colony
Registrant City: Gurgaon
Registrant State/Province: Other
Registrant Postal Code: 122001
Registrant Country: IN
Registrant Phone: +91.8802257971
Registrant Email: memanish1980@gmail.com

Also related is another advertising / search related website of www.afftronics.com (Hosted on the same server linked by GA).

Through a convoluted link of whois details and websites being hosted on the same IP I believe the following domains are suspicious and also related to the same group or call center.

-“aks@itinfocube.com”
-goithelp.co
-onlinecomputerrepairservices.com
-contactus-help.com
-tollfreeshelpline.com
-email-customer-care.com
-tollfreehelplines.com

Posted in Uncategorized | Leave a comment

Pitney Bowes K700 / K721 Franking Machine RJ11 BT Telephone Lead

img_20161108_121123What is it with annoying companies.

Pitney Bowes make franking machines. More recent ones use wifi direct to the internet or USB to a computer for top ups and balance verification.

Older machines use a telephone line. So have an RJ11 (square) connection at the back and then, in the UK, go to a BT plug on the other end of the lead.

BUT… it isn’t a standard lead. You can’t use the Pitney Bowes lead with a normal phone or fax machine and you can’t use a normal replacement lead from a shop with the Pitney Bowes Franking machine. FFS. Really?

So.. going from left to right as you look at the connectors (as shown in the picture above) where pin 1 is the left-most pin.

Pin 1 on the BT plug goes to pin 3 on the RJ11 plug

Pin 2 on the BT plug goes to pin 4 on the RJ11 plug

Pin 3 on the BT plug goes to pin 1 on the RJ11 plug

Pin 4 on the BT plug goes to pin 2 on the RJ11 plug

Seriously.. Every other lead for a telephone or fax machine is just a 1:1 mirror of the connections. Why bother being annoying and different Pitney Bowes!

Hope the above information helps someone if they are needing to splice up a new lead.

Posted in Uncategorized | Leave a comment

How to mask off the “wifi power off” pins on M.2 NGFF wireless cards. (The old Mini PCI Pin 20 trick)

 

 

This week I was presented with a problem where a laptop wasn’t connecting to Wi-Fi.

 

 

The laptop, to the end user, would report no networks in the wireless network list and when the “diagnose my network” wizard was run it would report that the “Wireless capability is turned off”.

wireless-capability-is-turned-off

However to confuse things further.. the hotkey to turn off and on wireless (often an Fn and F key combination) wasn’t reporting that the wifi card should have been off.

The netsh command would report “The wireless local area network interface is power down and doesn’t support the requested operation.”

img_20161104_211644

Essentially something had gone wrong, either with the softkey wireless control or somehow with the motherboard.

This problem used to happen a lot on older laptops, especially Toshiba laptops. They had physical wireless switches on the laptop and they would either get broken or go wrong forcing the wifi card to be turned off. We regularly ended up taking out wifi cards, putting tape on them, and putting them back in. The last time I had to do this was quite a few years ago and on a Mini PCI card, not an NGFF M.2 card.

Turning wifi off and bypassing it to always be on
When you use the soft-key or physical switch the motherboard should apply a 3.3 volt “signal” to one (or more, maybe in the case of M.2) of the pins on the wireless card.

mini-pci-pin-20-masking-exampleThe wireless card then understands that it is commanded to be off and disables it’s radio.

The trick to ensure a wifi card is always on, no matter what the wifi switch is set to, is to put something in the way so that 3.3volt signal can’t reach the wireless card.

This was incredibly well documented for Mini PCI cards. Cut out a small slither of tape and stick it over Pin 20 and put the card back in the machine.

 

M.2 NGFF connectors and keying
Things have moved on since Mini PCI and Mini-PCIe in laptops. Quite a few now have what is called M.2 NGFF (Next Generation Form Factor) which can be used for SSDs, Bluetooth, WWAN (cell phone cards), WLAN and GPS (and, I expect a lot more!).

The first problem I came across was identifying the type of socket that the card used. I knew the model card was an M.2 NGFF card so I initially tried putting the M.2 wifi card into my M.2 to USB SSD converter but the “keys” didn’t line up (the cut out bit or bits along with, in the socket, the plastic wall).

This confused me somewhat until I found that there are _many_ different types of M.2 socket. The best reference I found was this pdf on page 6 with a lot of diagrams. I believe my USB M.2 converter is “B Keyed” but the wifi card is “A Keyed”.

How to force an M.2 wifi card to stay on?
The problem I faced is a complete lack of information on NGFF M.2 pin outs and masking. Initially I found quite a promising website..

https://puri.sm/posts/hard-not-soft-kill-switches/

The above url seems to be an article for people who might be worried about snooping (webcam, microphone, wifi etc.).

The top picture on the page starts off well and shows a motherboard with a M.2 wireless card with the same “A keying” as the card I had problems with.

Scroll down the page and there is also some helpful wording and an explanation about how the voltage is applied to disable the card. Their aim is to fully disable it all the time, my aim is the opposite but the information is still good.

They say “The WiFi/Bluetooth Hardware Kill Switch works by applying to pins 56 and 54 an input of [3.3volts]” but then inexplicably then go onto show a photo of what appears to be a Mini-PCI or PCIe slot and an arrow pointing to a pin. This doesn’t match up with (1) the photo at the top of their page or (2) the layout of an M.2 slot.

DAMN.. now I can’t be lazy and copy the pin from an arrow on a photo. I have to work it out myself. I also couldn’t validate that their claims on the pin numbers were correct. If they have junk photos on their website then maybe the other stuff is entirely made up too. Still worth a go though.

Because there is very little information about M.2 and, especially, “A Keyed” M.2 sockets on the internet I had to attempt to work out which of the pins, on my card, were 54 and 56. trying to count pins – especially when many are not present – is very difficult.

Wikipedia and paint.net had to come out for some heavy image editing / overlaying of connector diagrams on top of a photo of the card I had in my hand.

m-2-key-a-connector-wifi-mask-ngff-card-front

M.2 A Keyed NGFF overlay with B and M Keyed diagram for pin location.

I started with the front side, the one that would (or should) line up best. This made it easy to identify pin 57 (or where pin 57 should be).

Turning the card over was then fairly easy to guess at which pins were 56 and 54 but I did want to be sure.. more paint.net handiwork and I was confident I’d identified the right pins.

m-2-key-a-connector-wifi-mask-ngff

After playing about lining up the “top” pin diagram with the “top and bottom” socket diagram and then drawing lines – the pins identified are right in the position where 54 and 56 would be (they don’t line up top to bottom as the pins are slightly offset on either side of the card and socket).

Out came the tape and scisors and then some surgical precision “sticking” it on top of the pins and chucked the card back into the laptop….

img_20161104_213240

Success!

So.. I hope this documentation helps someone. I’ve posted it as it looks like accurate and verified, tested as working ok, information doesn’t exist for M.2 wifi pin outs – until now.

WARNING: Make sure you know what you are doing. Don’t blame me if you mess up your wifi card or laptop motherboard. If in doubt take this information and your computer to someone who you are confident has the skills to perform this work.

Posted in Uncategorized | 6 Comments

supportcare.net / Geek Masters / eSupportStation / vlinks tech support scam cold callers.

Another day and, unusually, another tech support scammer but one who called me!

Looking back at my call records it seems they had tried to call on Friday morning too but got through to my answerphone.

This is the first time they have called my number. Normally I have to call them from a fake virus warning page or a friend of mine is called and I have to use the number the friend was given.

The caller ID they called from was “0001632960451” (numbers beginning 000 don’t exist.. but let’s imagine they have broken and / or faked caller ID). At a later date they also called from “00666675”

The initial domain they went to for “ordering” the service I “needed” was:

http://www.supportcare.net/our-plans

The current whois information for the domain is associated with:

Registrant Name: Archit Gupta
Registrant Street: A-4/211 DDA JANTA FLATS
Registrant City: PASCHIM VIHAR
Registrant State/Province: Delhi
Registrant Postal Code: 110063
Registrant Country: IN
Registrant Phone: +91.9953444997
Registrant Email: architguptaa@gmail.com

Yet the website gives a US address and phone number of

276 Fifth Avenue, Suite 704
New York, NY 10001
Ph.: +1-877-848-3948
Email: support@supportcare.net

The email address used is only associated with one other domain that doesn’t seem to be active.

The second part of the payment (the cart stuff) seems to run from zoomworld.ca which gives a logo called Geek Masters.
The zoomworld website code also leaks what appears to be previous name of “SG Technologies Inc.”

ESupportstation is the “merchant name” being used at the payment processor.

The server that their website is hosted on is “45.79.143.121” which has the reverse DNS of “server.studiosos.biz”. The website at www.studiosos.biz, which appears to be an invoice software company, is the same exact template and layout as the supportcare.net site.

studiosos give their address, on their website, as:

1800 Windridge Drive, Sandy Springs
Atlanta GA 30350
Ph.: +1-404-382-0802

Yet their whois details, at the time of writing, give the same address as published on the scam support supportcare.net site:

Registrant ID: DI_47249721
Registrant Name: Studio SOS LLC
Registrant Organization: Studio SOS LLC
Registrant Address1: 276, 5th Avenue, Suite 704
Registrant City: New York
Registrant State/Province: New York
Registrant Postal Code: 10001
Registrant Country: United States
Registrant Phone Number: +1.8622466786
Registrant Email: mail@studiosos.biz

The computer they connected to my test computer from seemed to be on the domain “vlinks”, possibly the name of an outsourcing call center?

Posted in Uncategorized | 2 Comments

ussoftwaresolutionsinc.com fake virus warning message and tech support liars.

Another day and another, what I feel to be, scam tech support company. This time I can attribute them to at least 100 fake virus warning sites and domains.

This time a message pops up when a victim is browsing (in the case I saw) TV streaming websites.

The scam warning was on “http://computerproccesseal.club/?source=70790_600680_  ” but it looks like many other domains are also involved.

us software solutions scam warning.png

The message reads:

0x80070424 Warning: Activation Key Damaged!!! Call Help Desk:

** YOUR COMPUTER HAS BEEN BLOCKED **

Error # 268D3

Please call us immediately at: +44-800-090-3856
Do not ignore this critical alert.
If you close this page, your computer access will be disabled to prevent further damage to our network.

Your computer has alerted us that it has been infected with a virus and spyware. The following information is being stolen…

> Facebook Login
> Credit Card Details
> Email Account Login
> Photos stored on this computer
You must contact us immediately so that our engineers can walk you through the removal process over the phone. Please call us within the next 5 minutes to prevent your computer from being disabled.

Toll Free: +44-800-090-3856

The telephone number used in this scam is a UK number of 0800 090 3856 aka. +448000903856 or 08000903856).

A small javascript file controls the telephone number that shows on the scam warning.

If these tech support liars call you back their caller ID shows as +18443073377

Needless to say the message is a lie, there is no infection the computer and the computer access (other than the scam message) will not be blocked.

When the victim calls up they are given the standard scam tech support routine of being shown the “scary errors” in event viewer and stopped services in msconfig (all normal!)

Their fixes (of which they charge £199) seem to be.

1) Running a .bat file to clear the event viewer history. (“Win 7 Viewer.zip” containing “Win 7 Viewer.bat”)

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
exit

2) Running SuperAntiSPYWARE to close the web browsers and clean cookies.
3) Installing CCleaner..

Entirely not worth it and their initial sales pitch about infections, firewalls and risks are fiction.

The company who tried to take payment are:

https://www.ussoftwaresolutionsinc.com/
aka. “US Software Solutions Inc.” or “ALW*ussftwrsolution8882551137”.

The domain I came across has the following whois information:

Registrant Name: Ajay Kumar
Registrant Street: C-45, Sec- 5
Registrant City: Noida
Registrant State/Province: Uttar Pradesh
Registrant Postal Code: 201301
Registrant Country: IN
Registrant Phone: +91.8802175217
Registrant Email: kidanumer8171@gmail.com

Other domains related to this scam are:
Hosted on the same IP at GoDaddy..

macintosh-security-warning.info
windows-error.co (an active fake virus warning page listing +1-800-737-7785 as the number to call and error code ERR7343DYJ6)
computerprocceslocksmiths.club (a copy of the original scam warning that I’ve posted at the top of this page).
computerprocceslock.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerprocceslock.club (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
processorprocceslock.club
computerproccessecure.club (an active fake virus warning page listing +44-800-090-3846 as the number to call and error S47452D aimed at Mac users)
computerprocceslockservice.club (an active fake virus warning page listing +1-844-564-0211 as the number to call and error S47452D aimed at Mac users)
computerprocceslocks.club (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
pcprocceslock.online
computermycceslock.club (an active fake virus warning page listing +1-888-417-0191as the number to call and error 268D3)
computerproccesseal.online
computerbolt.online (an active fake virus warning page listing +1-888-328-0520 as the number to call and error 268D4 aimed at Mac users)
computerprotection.online
computerprotectionhub.online
computerlocksmiths.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerprotectionworld.online (an active fake virus warning page listing +1-888-608-9575 as the number to call and error 268D3)
computerprotectionservices.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerlock.online (an active fake virus warning page listing +1-888-328-0781 as the number to call and error 268D5 aimed at Mac users)
computerprotectiongroup.online (an active fake virus warning page listing +44-808-238-7566 as the number to call and error 268D3)
processorlock.online (an active fake virus warning page listing +61-180-094-0864 as the number to call and error 268D3)
computersecure.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerlockweb.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerclamp.online (an active fake virus warning page listing +1-888-328-0781 as the number to call and error 268D5)
computerprotectionweb.online (an active fake virus warning page listing +1-888-608-9575 as the number to call and error 268D3)
computerprotectionreviews.online (an active fake virus warning page listing +1-888-328-0466 as the number to call and error S47452D aimed at Mac users)
computerpadlock.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerprotectionstar.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerprotectiontech.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerprotectionzone.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerprotectionhome.online (an active fake virus warning page listing +44-800-090-3856 as the number to call and error 268D3)
computerlockbox.online (an active fake virus warning page listing +1-888-430-9671 as the number to call and error 268D5)
computerlocks.online
computerlockpro.online (an active fake virus warning page listing +61-1800-990-328 as the number to call and error 268D4)
computerlockshop.online (an active fake virus warning page listing +61-1800-940-864 as the number to call and error 268D3)
computerprotectionsystems.online (an active fake virus warning page listing +44-800-090-3846 as the number to call and error 268D3)
computerprotectionnow.online
computer-lock.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
computerlockservice.online
computerprotectionpro.online (an active fake virus warning page listing +1-888-328-0471 as the number to call and error 268D3)
pcvirusalertsystem.today
technicalserrors.online (an active fake virus warning page listing +61 (1800) 893-775 as the number to call and error 268D3) (also related to an Amazon s3 hosting account “technicalserrors.online.s3-website-us-west-2.amazonaws.com”)
safari-infected-with-malwares.s3-website-us-west-2.amazonaws.com (an active fake virus warning page listing +44-800-098-8642 as the number to call and error XX00x1)
pcnetworktrustytrusty.online (an active fake virus warning page listing +1-888-328-0471 to call and error code S47452D)
alertatpc.website
recheck-mac-service.com (an active fake virus warning page listing +64-1800-894-043 as the number to call and error 9ADX400)
pcnetworksteadfastcloud.online (an active fake virus warning page listing +61-1800-940-864 as the number to call and error 268D3)
pcnetworktrustycloud.online (an active fake virus warning page listing +1-888-328-0466 as the number to call and error 268D#3)
pcsystemauthenticcloudservices.online (an active fake virus warning page listing +61-180-094-0864 as the number to call and error 9ADX400)
debuggingerrorinterrupt.club (an active fake virus warning page listing +61-1800-940-864 as the number to call and error 268D3)
pcnetworkreliablecloudservices.online (an active fake virus warning page listing +1-844-564-0211 as the number to call and error 268D#3)
safarifaults.club (a fake apple support “Your mac has been blocked” page listing +44-8000-988-382 as the number to call and error 8UXK307)
pcnetworksteadycloud.online (fake virus warning page listing +1-888-328-0466 as the number to call and error 268D#3)
netservicesupport.website (fake virus warning page listing +1-8777-993-986 as the  number to call and error 9XAX401)
debugginginterrupt.club (fake virus warning page listing +61-1800-875-586 as the number to call and error 9ADX400)
systemexpert.online (fake virus warning page listing +61 (1800) 893-775 as the number to call and error 268D3)
mclimaxasurment.club (fake virus warning page listing +1-877-231-7887 as the number to call and error S47452D)
alertatpc.space
geekcrew.online
computermalwareissue.space
recheck-mac-service.info (fake virus warning listing +61-1800-894-043 as the number to call and error 268D3)
geekcrewservices.club
geekteam.online
supportsupport.online (fake virus warning listing +1-877-937-6922 and +61-1800-940-864 as the numbers to call and errors S47452D and 0x80070424
networkalertnetwork.club (fake virus warning listing +61-1800-894-043 as the number to call and error 268D3)
pcmethodreliablecloudcomputing.online (fake virus warning listing +1-877-231-7887 as the number to call and error 268D#3)
macsystemmeasurwoment.club (fake virus warning listing +1-844-564-0211 as the number to call and error 268D3)
macsystemuseasurment.club (fake virus warning listing +1-844-564-0211 as the number to call and error 268D3)
macsystemusasurment.club (fake virus warning listing +1-844-564-0211 as the number to call and error S47452D)
systemreliablecloudstorage.online (fake virus warning listing +1-844-564-0211 as the number to call and error 268D3)
hxxp://www.supportsupportnetwork.online (fake virus warning listing +1-844-669-3961 as the number to call and error 9XAX400D)
recheck-mac-service.org (fake virus warning listing +61-1800-990-328 as the number to call and error 268D3)
pcgeeksquad.club
systemreliablecloudservices.online (fake virus warning listing +1-844-564-0211 as the number to call and error 354#D7)
techhelp.club (fake virus warning listing +44-8000-988-382 as the number to call and error 8UKX307)
pcassist.online (fake virus warning listing +1-844-669-3961 as the number to call and error 9XAX400D)
methodexpert.online (fake virus warning listing +61-1800-661-980 as the number to call and error 268D3)
pcaid.online (fake virus warning listing +1-844-669-3961 as the number to call and error 268D3)
expert-system-solutions.net (fake virus warning listing +61 (1800) 893-775 as the number to call and error 268D3)
computermeasurmentmart.club (fake virus warning listing +1-844-669-3961 as the number to call and error 9XAX400D)
computermeasurmenthub.club (fake virus warning listing +1-844-669-3961 as the number to call and error 9XAX400D)
xdebugging.club (fake virus warning listing +1-844-669-3961 as the number to call and error 268D3)
somedebugonmycomputer.club (fake virus warning listing +44-8000-988-382 as the number to call and error 8UXK307)
someerroronmypc.club (fake virus warning listing +1-844-669-3961 as the number to call and error 9X#X400D)
hxxp://www.mymacinterrupt.club (fake virus warning listing +1-844-669-3961 as the number to call and error 268D3)
funmaxsteel.club (fake virus warning listing +44-8000-988-382 as the number to call and error 8UXK307)
pcdebuggingerrorinterrupt.club (fake virus warning listing +1-844-669-3961 as the number to call and error 268D3)
alertatpc.online
visitnewyorkcity.club (fake virus warning listing +44-8000-988-382 as the number to call and error 8UXK307)
systemalertsystems.club (fake virus warning listing +1-844-669-3961 as the number to call and error 9XAX400D)
machelpexpert.online (fake virus warning listing +1-844-669-3961 as the number to call and error S47452D)
macbackupexpert.online (fake virus warning listing +1-844-669-3961 as the number to call and error S47452D)
saffaribrowser.com (fake virus warning listing +61 (1800) 157-009 as the number to call and error 268D3)
expert-system-solutions.org (fake virus warning listing +61 (1800) 661-980 as the number to call and error 268D3)
expert-system-solutions.info (fake virus warning listing +61 (1800) 893-775 as the number to call and error 268D3)
mac-safari-repair.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1 (844) 412-6929 as the number to call)
mac-supports.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-844-856-0111 as the number to call)
supportllc.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-844-412-6929 as the number to call)
error-code-229s4.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-844-412-6929 as the number to call)
shop-for-sale.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-844-856-0111 as the number to call and error 268D3)
trackingfacebookfuntime.club.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-844-856-0111 as the number to call and error 268D3)
gamezonly.space.s3-website-us-west-2.amazonaws.com (fake virus warning listing +61 (1800) 893-775 as the number to call and error 268D3)
technicalserrors.online.s3-website-us-west-2.amazonaws.com (fake virus warning listing +61 (1800) 893-775 as the number to call and error 268D3)
trackingfacebookads.club.s3-website-us-west-2.amazonaws.com (fake virus warning listing +61 (1800) 893-775 as the number to call and error 268D3)
mac-alert-38107.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-844-717-2444 as the number to call and error 268D3)
pcnetworkreliablecloudcomputing.online (fake virus warning listing +1-844-231-7887 as the number to call and error 268#D3)
pcnetworkreliablecloudhosting.online (fake virus warning listing +1-888-328-1037 as the number to call and error 268#D3)
macmeasurhombrest.club (fake virus warning listing +1-844-564-0211 as the number to call and error 9XW#X400D)
macmeasurmentpro.club (fake virus warning listing +1-844-564-0211 as the number to call and error S47452D)
macplanreliablecloud.online (fake virus warning listing +1-844-564-0211 as the number to call and error CM74#2D)
macsystemreliablecloud.club (fake virus warning listing +1-844-564-0211 as the number to call and error S47452D)
pcservicecompany.online (fake virus warning listing +1-844-590-7988 as the number to call and error S47452D)
methodsupport.club (fake virus warning listing +44-800-088-5641 as the number to call and error S47452D)
computerseal.online fake virus warning listing +44-800-088-5641 as the number to call and error S47452D)
macsystemsteadycloud.online (fake virus warning listing +1-844-590-7989 as the number to call and error 268D3)
systemalarm.club (fake virus warning listing +1-844-590-7992 as the number to call and error 268D3)
computerprotectioncenter.online (fake virus warning listing +1-888-328-0471 as the number to call and error 268D3)
cpudebuggingerrorinterrupt.club (fake virus warning listing +1-888-871-6288 as the number to call and error 268D3)
systemexpert.website (fake virus warning listing +61-1800-893-775 as the number to call and error 9ADX400)
cpidebuggingerrorinterrupt.club (fake virus warning listing +1-844-590-7989 as the number to call and error 9#XWX400D)
edge-not-working.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-888-328-0471 as the number to call and error 268D3)
pcsteadycurrent.online (fake virus warning listing +1-888-328-0471 as the number to call and error 268D3)
window-error.s3-website-us-west-2.amazonaws.com (fake virus warning listing +1-888-328-0471 as the number to call and error 268D3)
macsystemreliablecloudservices.online (fake virus warning listing +1-888-328-0471 as the number to call and error 268D3)
pcsteadycurrent.online (fake virus warning listing +1-888-328-0471 as the number to call and error 268D3)
supportsupportservices.online (fake virus warning listing +1-844-590-7989 as the number to call and error 268D3)
pcsteadynow.online (fake virus warning listing +44-800-090-3848 as the number to call and error 268D5)
computerinterruptdebuggingexcess.club (fake virus warning listing +1-844-590-7989 and +1-877-937-6922 as the numbers to call and errors S47452D and 0x80070424)
gomicrosoft-errors.website and gomicrosoft-errors.website.s3-website-us-west-2.amazonaws.com (fake virus warning listing +44 (8000) 988-382 as the number to call and error XX00x1 and the full error shown below..)

System Detected Security Error (Error Code : XX00x1) Due to Suspicious Activity. Please Contact MAC Technicians For Help :
‘+ tollfree +’ . Please contact MAC technicians to rectify the issue.
Please do not open internet browser for your security issue to avoid data corruption on your registry of your omacusating system. Please contact MAC technicians at

Tollfree Helpline at ‘+tollfree+’

Tell customer service this error code : XX00x1

PLEASE DO NOT SHUT DOWN OR RESTART YOUR COMPUTER, DOING THAT MAY LEAD TO DATA LOSS AND FAILIURE OF OPERATING SYSTEM , HENCE NON BOOTABLE SITUATION RESULTING COMPLETE DATA LOSS . CONTACT MAC technicians TO RESOLVE THE ISSUE ON TOLL FREE – ‘+tollfree+’

PLEASE DO NOT SHUT DOWN OR RESTART YOUR COMPUTER, DOING THAT MAY LEAD TO DATA LOSS AND FAILIURE OF OPERATING SYSTEM , HENCE NON BOOTABLE SITUATION RESULTING COMPLETE DATA LOSS . CONTACT MAC technicians TO RESOLVE THE ISSUE ON TOLL FREE – ‘+tollfree+’. Please contact MAC technicians to rectify the issue.
Please do not open internet browser for your security issue to avoid data corruption on your registery of your omacusating system. Please contact MAC technicians at

Tollfree Helpline at ‘+tollfree+’

Tell customer service this error code : XX00x1

PLEASE DO NOT SHUT DOWN OR RESTART YOUR COMPUTER, DOING THAT MAY LEAD TO DATA LOSS AND FAILIURE OF OPERATING SYSTEM , HENCE NON BOOTABLE SITUATION RESULTING COMPLETE DATA LOSS . CONTACT MAC technicians TO RESOLVE THE ISSUE ON TOLL FREE – ‘+tollfree+’

PLEASE DO NOT SHUT DOWN OR RESTART YOUR COMPUTER, DOING THAT MAY LEAD TO DATA LOSS AND FAILIURE OF OPERATING SYSTEM , HENCE NON BOOTABLE SITUATION RESULTING COMPLETE DATA LOSS . CONTACT MAC technicians TO RESOLVE THE ISSUE ON TOLL FREE – ‘+tollfree+’.

supportsupport247.club (fake virus warning page listing +61-1800-940-863 as the number to call and the warning message shown below..)

Microsoft System Security Alert

Oops !! Something went wrong with your Unknown OS Platform

Dear Unknown User,

The Website you have recently visited may have downloaded the Malware and Virus on your Unknown OS Platform system.

Microsoft Defender is Suspicious about your Unknown OS Platform System Security.

Your TCP Connection Was Blocked by Your Unknown OS Platform Security System. Your Unknown OS Platform and Internet Explorer has been locked untill we may hear from you to immediately fix this issue.

Please Contact Microsoft Unknown OS Platform Help Desk

——————————————————————-
Customer Support : +61-1800-940-863 (TOLL-FREE)
——————————————————————-

********** IMMEDIATE RESPONSE REQUIRED **********

Please contact network administration to rectify the issue.
Please do not open internet browser for your security issue to avoid data corruption on your registery of your operating system Unknown OS Platform. Please contact Unknown OS Platform network administration department at +61-1800-940-863 (TOLL-FREE)

Virus Info:
A Trojan horse, or Trojan, in computing is a non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. The term is derived from the story of the wooden horse used to trick defenders of Troy into taking concealed warriors into their city in ancient Greece, because computer Trojans often employ a form of social engineering, presenting themselves as routine, useful, or interesting in order to persuade victims to install them on their computers.

A Trojan often acts as a backdoor, contacting a controller which can then have unauthorized access to the affected computer. The Trojan and backdoors are not themselves easily detectable, but if they carry out significant computing or communications activity may cause the computer to run noticeably slowly. Malicious programs are classified as Trojans if they do not attempt to inject themselves into other files (computer virus) or otherwise propagate themselves (worm).

A computer may host a Trojan via a malicious program a user is duped into executing files or browsing internet.
Please contact network administration department at +61-1800-940-863 (TOLL-FREE)

Expired domains or also associated and suspicious are:

sincronizarsantander.info – Santander are a bank.
click4support.biz
click4support.us
web-consultant.biz
classifiedline.asia
turkeyclassifieds.asia
classifiedgallery.asia
vehiclesclassifieds.asia
systemsupportalert.online
browsersupportapp.net
helpdeskproductions.org
hxxp://www.hotappdownload.com

The name Anil Verma crops up regularly across the domains I’ve found including being the name used for ussoftwaresolutionsinc.com (anil.verma1392@gmail.com)

The name anil also appears in the javascript source code of the fake virus warning website.

Also related (linked by ga):

ubertechsupport.blogspot.com
dialportsolutionsllc.com “Dialport Solutions llc” (Almost an exact copy of the ussoftwaresolutions website)
usinfosolutions.us
ubertechsupport.tumblr.com

Posted in Uncategorized | 4 Comments