what apps do tech support scammers open?

[K86twCuCgDzvF2yHrqKq8FAJNW]

I'm setting up a scambaiting VM and I'm going to replace all the tools that they open with my own special stuff. Thing is, It's been quite a while since the last time I set one up and I forgot what to replace.

[Crunchy Dragon]

Usually they'll have you open IE.

 

If you watch any Lewis's Tech videos that should give you an idea of what your scambaiting VM should look like.

[iRileyx]

Check out Kitboga on twitch, he does it the same way through a VM. Should give you an idea of what you need to do.

[Murasaki]

Reminds me of my fake msconfig I made a few years back.

Quote

 

[GoodBytes]

Usually the process is as follows:

 - They make you check EventViewer or make you open command prompt and type you a command where lots of file shows or the command return a true or false statement. They might make you download some of their fake anti-virus that says that you have a million viruses or something.

 - Try and convince you that your system has viruses or your Windows is not activated

 - Make you download Team Viewer and make you run it so that the scammer can remote desktop to your system.

 - Open SysKey to encrypt SAM (the hidden registry section that contains accounts login profile. Windows allows you to ecnrypt it, and basically, before you get to the account screen when you start your PC, you have to put a password to decrypt SAM so that Windows can see what account exists)

 - Open IE or your web browser to get to some page to pay for their "service"

 - Promises to remove the viruses or "activate Windows", via a fake program.

 - If he is nice, after you paid, he might remove the SysKey encryption password... or just hang up, and next time your restart you are screwed either way.

 

Microsoft removed SysKey in Windows 10 starting with Fall Creators Update due to the scammers. In any case, it is not used by anyone, encryption is outdated, and possibly easy to crack if someone cares enough to break it (which they don't as no on uses the feature), account system is more secure than before especially if you use a Microsoft linked account. And if you want encryption for protection, make your account MS account linked if its not already and encrypt your sensitive files, or even better, use BitLocker Encryption from Windows. (Pro edition needed for both).

[K86twCuCgDzvF2yHrqKq8FAJNW]

@GoodBytes it is a windows 7 VM and I have syskey and msinfo32 replaced with a screen locker in vb.net that plays ram ranch but thanks. I also have nanocore and trollrat installed on it too

[K86twCuCgDzvF2yHrqKq8FAJNW]

[K86twCuCgDzvF2yHrqKq8FAJNW]

https://discord.gg/zy2cjv planning on trying to RAT the scammer as well

[K86twCuCgDzvF2yHrqKq8FAJNW]

1 hour ago, Ross Scarlet said:

Reminds me of my fake msconfig I made a few years back.

 

download?