13

What is the reason this command was run and why network hacked....clampi found was typed in at the command prompt

enter image description here

Title has been changed....somebody gave me the computer to fix after calling a number via a popup that was difficult to get rid off....and also used a phishing technique to get her to call a number so to speak to a microsoft engineer...he logged on and messed around and said 500 euro...

i'm not sure if he typed the "what the title of this question is" there for? to scare the user using a technical term?? or did the person make a mistake and write something in there that was meant to go into his notes?

had to refresh the machine, didn't have a chance to look into it too much, but it had me investigating wannacry which clampi is related....but was it just a pop up that caused the problem? or did he want to say it would cost the 500 euro to get rid of clampi...perhaps the attacker thought that this person would have heardd of the term....basically all i wanna know is if that was only meant for his notes? from the technical pov he wouldn't be using the term network hacked.

  • Probably the operator doing the scam wanted to type that into some "CRM"-Tool, but unfotunately switched to your desktop? – Marcel Jun 14 '17 at 7:07
  • 19
    where did this screenshot come from? there is no context here – schroeder Jun 14 '17 at 7:56
  • @AndréBorie I don't think it's a duplicate, in that post the question is about what the motives of the con are and if the number was spoofed, in this one hes asking about the methodology behind this specific step in the conning process. Just my opinion though. – Nalaurien Jun 14 '17 at 11:44
46

If i understand this correctly, you called the 1800 number and gave them remote access to your computer where they opened cmd and ran netstat and typed "hacked... clampi found"

What is happening here is theater. When the scammers "check the computer" they do a variety of things including but not limited to:

  • looking at eventvwr
  • typing netstat or tree into cmd
  • looking at running services

Each one is designed to show you true information about your computer but then twist it in a way to convince you to believe there has been a breach of some kind. This is the essence of their con.

The idea for your specific example here is that while cmd is running a command, like netstat or tree, it still takes typed input. You can open cmd right now and type tree. While tree is running type something like "VIRUSES FOUND, MUST KILL EACH AND EVERY VIRUS" You will notice that once tree has completed your text appears after the > in your cmd prompt. They usually use commands that take more than a few seconds to complete, just enough time to fully type out whatever they want so it doesnt appear one letter at a time but fully when the previous command is completed. netstat -sp tcp will generally take anywhere between 30 seconds to a minute and a half depending on connections. More than enough time to type out a sentence.

To the inexperienced this makes it appear as though a scan has been done and the result of that scan is output. In your case, they made it seem as though netstat is a scanner of tcp traffic and it found "clampi" a well known malware.

But it's theater, nothing more, they simply typed it so that, upon seeing it, the user enters a state of panic. In this state someone might do anything to fix the problem immediately! Well lo and behold your knight in shining armor, the tech support agent, who, for a fee of only 599.99 for the 3 month plan or 999.99 for the lifetime plan will personally make sure your computer is "hacker free" forever.

Its nothing more than a scam designed to prey on people who don't know the deeper aspects of computers or the full extent of their available features, which even today, is a lot of people.

| improve this answer | |
  • 5
    I'll never tell someone to avoid a scan, but it is very common practice to type something to solidify the con. In most of the scams that I have seen there is always something typed. The command is just there for show. The thing they type is what they use to convince the person a breach has been made and needs immediate attention. Remember, it only appears sloppy to those who don't use cmd on a regular basis. – Nalaurien Jun 14 '17 at 8:33
  • 11
    This is consistent with what I've seen, too. When the sorts of people who frequent security fora look at this, they scoff and say "well they've obviously just typed that into the command prompt, why would I be scared?". When our grandparents look at this, having seen what hackers looks like on TV, they'll see a lot of scrolling text in a monospaced font followed by some scary looking words that they just about understand. The goal of the scam is to intimidate the victim and I'd be unsurprised if this theater was effective. – ymbirtt Jun 14 '17 at 9:12
  • 10
    The goal is to get the user to pay them of their own free will. Not to exploit the system. The computer is just a means to an end. It's not the prize. Plus it's meant to be "low tech" so you can have warehouses of "support agents" who may have no technical ability able to do the con successfully. That's how you scale the business. Instead of hiring one or two technically adept agents, hire a bunch of minimum wage people who just carry out the motions, read from a script. Its just cheaper and more profitable. – Nalaurien Jun 14 '17 at 9:47
  • 1
    netstat -sp tcp takes less than 1 second to run on my machine. Barely enough time to paste a pre-copied message. Actually, it's somewhere in the ballpark of 0.1s – John Dvorak Jun 14 '17 at 11:26
  • 1
    Its highly variable, if you just restarted, or don't have a lot of tabs open and your PC is rather light it can be very fast. If you've been browsing a while, have a few tabs open and maybe a service or two like steam or battle.net, an AV scanner, it will take longer. :30 - 1:30 is an estimated average, for most PCs that are kept on most of the day. – Nalaurien Jun 14 '17 at 11:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.