Teamviewer scam - beware

[Britton30]

Yes Welcome Biorave. All scum, like in the toilet, is hard to get rid of.

 

[ganjiry]

These scams are getting beyond a joke recently My mom is always getting call's from supposed Microsoft and untill recently didn't own a pc.
There seem to be more and more of these phone call scam's appearing by the day. I received a call a couple of day's ago from someone claiming to be from Isonic refunds department in Swansea Wales. He was demanding to speak to my mrs even though i'd told him he was full of Sh** so i gave her the phone just to find out the story. He went onto say she had a payment taken from her bank by mistake for mobile phone bill which needed to be returned. When she replied stating she'd never had a bank account and her phone is in my name he replied "Oh sh** and hung up.
These people are brazen as f*** and will argue the toss untill proven wrong. The thing is they don't even try to hide their phone number so when i googled it found plenty of threads reporting the same calls and nothing ever gets done about it. Their addresses are known and still nothing gets done.. It's a joke.
Makes you think about giving them some of their own medicine

 

[Britton30]

They are in the business of lying and cheating to make money so they get very persistent and good at it. Then they run for public office.

 

[ganjiry]

They are in the business of lying and cheating to make money so they get very persistent and good at it. Then they run for public office.

The way of the world aye mate

 

[kado897]

They are in the business of lying and cheating to make money so they get very persistent and good at it. Then they run for public office.

The way of the world aye mate

Too true.

 

[Britton30]

They are in the business of lying and cheating to make money so they get very persistent and good at it. Then they run for public office.

The way of the world aye mate

Too true.

Unfortunately, the dirty low-down pond scum.

 

[tinmar49]

I've had similar scams tried on me and the second time I kept them on the phone for about ten minutes pretending to be running a computer, and when I got fed up I told them what I thought of them using the maximum number of swear words. They hung up on me. I do feel so sorry for the many computer users who are fooled by these rogues.

 

[ang]

Remove Team Viewer after Scam

Hello,

This weekend, my father fell for this scam. I was at their home visiting when it occurred, and happened to come into the room after he had been on the phone for quite some time, and figured out what was happening. My father is a very trusting senior, who grew up in a small town, and believes in the goodness of people (which makes him a target in this ugly day and age). I thought we had talked enough with him about computer safety, but apparently we had not.

Anyway, my question is this. He had already downloaded TeamViewer and given them the ID and passcode. They had already taken control of the computer. I made him hang up, turned off the computer, unplugged it and disconnected the internet. They took the computer to the Best Buy Geek Squad, and changed email and banking passwords using another family member's computer. The Geek Squad removed a few viruses from their computer (though we don't know if these were on prior to the call).

I realized this morning that TeamViewer may still be on their computer. I am no longer in town, so I spoke with my mother over the phone and had her look for it in the Uninstall section of the Control Panel, and it was not there. I also had her check in the Program Files folder, and the Program Files (x86) folder. It didn't appear in any place. Does this mean the TeamViewer is no longer on their computer, or could it be hiding anywhere? And if it is on the computer, can they still access the computer at any time or does TeamViewer generate a new passcode once the computer has been shut down?

(I'm not terribly good with Windows, as I switched to a Mac many years ago and missed all of the updates since XP. I'm also not in the same state anymore, so I'm not able to look at the computer myself.) I'd appreciate any help you can offer.

Thank you!

 

[andrew129260]

The scammers use teamviewer. But that does not mean that teamviewer is bad. Teamviewer is actually a fantastic and safe program. If you do not see it anywhere, on the desktop or program files it is indeed gone.

Since teamviewer is gone, they will not be able to access the computer at all.

Also: Don't think just because you have a mac your safe ether. I have seen and read reports on this happening to mac users as well.

 

[Britton30]

To connect a remote user would need the ID and password which TV generates a new one on each start up.

 

[UsernameIssues]

... He had already downloaded TeamViewer and given them the ID and passcode.
~~~
And if it is on the computer, can they still access the computer at any time or does TeamViewer generate a new passcode once the computer has been shut down?
~~~
I'm also not in the same state anymore, so I'm not able to look at the computer myself.) I'd appreciate any help you can offer.

Thank you!

Welcome to the Seven Forums.

As others have mentioned: the password/passcode that TeamViewer creates is indeed a temporary one. So, yes, TeamViewer generates a new password/passcode each time that TeamViewer starts. You don't even have to shut the computer down or even log off, just exit TeamViewer. When you restart TeamViewer, it will have a new password/passcode. Also, a remote person cannot run thru all 9999 possible codes to get back in. TeamViewer prevents such action really well.

However, TeamViewer can be configured to start whenever Windows starts. If TeamViewer is set to do this, it will ask for a new (permanent) password. The scammers might have set such a password and told TeamViewer to always start. It sounds like the Geek Squad uninstalled TeamViewer for you. Unfortunately, we do not know if the Geek Squad told the uninstall process to remove TeamViewer's settings. If TeamViewer's settings remain on the computer, then those old settings would be used again if TeamViewer ever got installed again. (The computer ID will most likely remain the same each time TeamViewer is installed.)

I would suggest that you call and have them re-install TeamViewer. Then you install TeamViewer for mac (Free TeamViewer Download for Mac). When they run into trouble, you can see what they see and maybe help them out a bit. You might not be totally up to speed on various Windows things, but we are here to help you with that.

If they install TeamViewer again, ask them if the password/passcode is four numbers. If it is, then TeamViewer is NOT set to start each time Windows starts. If TeamViewer is set to always start, then the temporary password/passcode that users see on the main TeamViewer screen will be changed to use 6 characters (a mixture of numbers and letters).

If you set TeamViewer to run all of the time on their computer - then you connect (and control it) at your convenience - thus allowing us to help you to help them. If you put TeamViewer in this mode, you will be selecting a password of your own to use. Please pick a good one

 

[ang]

Thanks so much for the replies! That eases my mind.

I realize TeamViewer is a legitimate program, which is why I figured the Best Buy team would not have removed it. I just wasn't sure if it generated new passwords or if they could easily reconnect using the old one. When the scammer was controlling the computer, I clicked on a "terminate this session" or something similar, and it was just automatically reconnecting. That was when I turned off the computer.

Thanks for the warning about the Mac. I know they're no longer safe to viruses and scams. Though had I been the recipient of this phone call, I would have immediately known it was a scam and hung up. I just mentioned it because I've been out of the Windows world since XP and there have been a lot of changes with each subsequent operating system. I'm still quite unfamiliar with Windows 7 and where to look for installed programs.

 

[ang]

Thank you Username Issues. I will call and have them re-install it and take a look at the passcode.

 

[ang]

Actually, I just thought of something else. If he clicked "Join Remote Session" and only downloaded the Quick Support file instead of clicking the large Download button and installing the full program, that could be the reason it didn't show up in the program files. If he was just using the Quick Support, it couldn't be configured to start when Windows starts, could it?

 

[UsernameIssues]

My guess is that Geek Squad uninstalled TeamViewer once you told them that story about the scam.

You are correct, TeamViewer's QuickSupport app does not show in the list of installed apps and cannot (easily*) be configured to start when Windows starts... but it also does not go away on its own. The QuickSupport app installs into this folder...
C:\Users\username\AppData\Local\Temp\TeamViewer\Version9
...and remains there until it is deleted.

I would think that the Geek Squad's automated tools would have emptied the temp files.

*In theory, Windows could be told to automatically start this app in many ways - but this is very unlikely to have been done by the scammers - given their boiler room style of operating. They don't wish to spend much time with each user. They just want the money and run. Also, as far as I know, TeamViewer's QuickSupport app cannot be set to use only one password.


Edit: I should have offered a reason why TeamViewer does not remove its QuickSupport files from the temp folder once the QuickSupport app exits. The support tech (or scammer) using the TeamViewer can tell the remote computer (which is using the QuickSupport app) to reboot and automatically reconnect the remote control session. It can also reboot the computer into the safe mode and automatically reconnect the remote control session. One manual reboot by the computer being worked on will stop subsequent automatic reconnects by the QuickSupport app (or by the full TeamViewer app).

 

[robinb9]

That is true and not, you can set teamviewer to have a static password so everythime you log on, you do not have to put a new password in. As long as it is out of program and features it is gone but i would recomment your parents to change the computers password immediately just in case they put a program onthrough teamviwer and they are controlling it through this program

 

[UsernameIssues]

Was this...

That is true and not, you can set teamviewer to have a static password so everythime you log on, you do not have to put a new password in. As long as it is out of program and features it is gone but i would recomment your parents to change the computers password immediately just in case they put a program onthrough teamviwer and they are controlling it through this program

...in reference to to me saying this:
Also, as far as I know, TeamViewer's QuickSupport app cannot be set to use only one password.

Our new member (ang) first asked about TeamViewer in post #128 and how it acts on the computer being worked on. Britton30 answered ang's question while I was composing my long post and testing things

Then ang asked how TeamViewer's QuickSupport app would act on the computer being worked on. See post #134. As far as I know, TeamViewer's QuickSupport app cannot be set to make use of a static password. If this can be done, I would love to know how since TeamViewer's QuickSupport app has a much smaller footprint than the full install of TeamViewer. I would love to only install TeamViewer's QuickSupport app on the dozen's of computers that I support via remote control. As it is, I have TeamViewer's full app installed on each remote computer.


When the scammers took control of ang's parent's computer - they could have removed TeamViewer from the list of installed applications but not actually uninstalled it. ang wisely asked her parents to also look in the two program file areas. TeamViewer is nowhere to be found... so they are probably safe. I highly doubt that the scammers spend the time to walk their victims thru the process of installing TeamViewer into a non-standard folder location.

The scammers have little interest in breaking back in later. Their goal is to swindle the end user and move on to the next potential victim. Of course, a scammer could be working two jobs:
1) scamming folks
2) setting up bots
:-(


Thanks for suggesting that the user account password be changed. I should have thought of that

 

[robinb9]

I have seen this on a clients computer and others i have come across, where the scammer convinces the person to download teamviwer, and walks him thru set up to set it up as not a quick install but a full install. Once it is installed , the victim gives him the password. Then the scammer logs on, goes into the options and makes it a static password so it does not change each time and sets it to start up in windows. In one case the scammer put in a bot program which tracked everything my client was doing. He also planted a virus in to show my victim he was infected and he would remove it for him for $80 bucks. He then convinced him to set up a maintennace agreement to maintain (cough cough) his computer and keep it virus free.
How my client figured out something was wrong was that his tax refund never showed up. He had turbo tax on this computer and all his info was being used. And worse at the end of the month when he got his credit card statment there were amounts there that were incredibly wrong
He found me thru another client and when he told me what happened, he still had teamviwer on his machine, had no idea this was the culprit. I told him to un install teamviwer, at that time i had no idea there was another program on there tracking him because i had not seen the machine yet.
He uninstalled it but told me funny things were going on everytime he typed something. That gave me a clue something was still there
At this point i got his laptop and brought it to my office lab. I disconnected it from going on the internet.
Because i have been trained by the best hackers in the world (ages 12-18) i was able to dig down and find the bot program the scammer installed and removed it out of the registry and all the folders it was sitting in and in startup. I then changed his computer name and password.
But in his case only, because of this hidden program that was there, we oppened a new user account with a new name and password, i moved all his files into it, of couse all his programs were there, and deleted the original account once this was all set up.

My other client was a bit more lucky, teamviwer was not used but logmein was instead. (Same concept as teamviwer) only you need a email address and password but you can still con a user i to putting it on if you are convincing enough
I removed the program, checked to see if anything else was installed which it was not, checked for anything else and we changed his password on the computer only, just as a precaution

Unfortuntely those who are not computer savy, are very gulable and that is what these scammers are looking for

 

[Golden]

Silver colander and strained Linguini! At least you sorted it

 

[RoasterMen]

My friend from Malaysia used Team Viewer to play GTA IV on my PC and works flawlessly except for the sutters with the internet connection