Phone Scam

[Dave <mrx () propergander org uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

OK This is not new, but it happened to me just an hour ago.

A stranger on the end of a phone call tells you your PC is infected, and you should download and install a RC server so 
it can be fixed.

I just been through this and installed Ammyy admin from ammyy.com (Whois - dataguarded) as per the strangers 
instruction on a VM XP install.
Nothing to see here, so what, big deal etc. etc.

What maybe interesting to some is the IP address it connected to:
prag178.startdedicated.com 62.75.224.229 ports 443, 80, 8080

I reveal the IP address for those of you who might like to update IPTables, databases or just like to write down 
numbers.

These people scam the ignorant PC user into believing their PC is rife with viruses and trojans in order to get them to 
part with money.
I wasted an hour of their time, got a first hand education and most likely an infected XP VM to analyse.

regards
D
- -- 
Mankind's systems are white sticks tapping walls.
http://www.propergander.org.uk
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEVAwUBTibV6bIvn8UFHWSmAQKwOQf/T3P9uZ0/OIvRT308j3XEvr6zm7WBgJTP
SGhvrLzCh9utqdgwKl21kIW/EOdgZ4tw1XsRGLYM4Y3uqrdop1RlufDgm3XWs8W5
WNUQvq7KbqpGpTkfeA+FN2aNp14n2yKLFuLCVYn4lbiQQLD/iENa4qPasBV0QBHW
z5MMKdoH13GLrdRn4Z2IfpxKZDKAoKL3TkyWd44qOLam8KqVG0ziPDWuoLF86krq
tek5yIS1+Ijdaqut+V2mOGgXL8Edlp8Q4uwqzIrba3WALrmtEXIw675EGzNP6Bg7
6tJCYYwITwsinvcOvJR84o9C3p1zTZ7uSfxKf91kZF/xbK1V5OBUaA==
=trZf
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/