Support Scammer Anna's CLSID confusion

Another day, another support scam call. It appears that one of my PCs has been  sending out messages to India again about system problems. I don’t know why it would rather talk about its problems to a call centre in Uttar Pradesh rather than just pop up an error message to me. Does it feel I’m working it too hard? ;-)

‘Anna’ claimed to be from Global PC Helpline, and gave me a UK phone number 0800-0148910 which does indeed correspond to the Global PC Helpline page for the UK at http://globalpchelpline.com/uk/. She also told me that my PC was sending out messages about system errors, and tried to pull the CLSID gambit on me, then put the phone down when she realized I wasn’t buying it and tried to get her to tell me what she thought the ASSOC program really does.

While this was clearly a scam call, I can’t, of course, prove beyond all doubt that she was calling from Global PC Helpline, and in fact Caller ID was disabled.

However, after taking a quick look at the GPCHL website, if they’ll excuse the familiarity, it includes some interesting features. While the company is claimed to have been founded in Magnolia TX in January 2009, whois data are not entirely consistent with that claim:

Registrant :
Name: shan rizvi
Organization: NA
Address: g-5,swroop park ,ghaziabad,
City: Noida
State: Uttar Pradesh
Postal Code: 201005
Country: IN
Phone: 2632573
Fax:
Email: pankajchandola@gmail.com

Anna also told me she was in India,  when she was still answering my questions.

The site claims, among other services, to offer support for a number of well-known antivirus products. I particularly liked the first sentence of a section on support for McAfee products:

Our certified technicians provide you immediate help and best possible solutions for Norton Antivirus.

I’m not sure whether that means that McAfee and Symantec are closer friends than anyone realized. Or does it mean that McAfee detects and removes Norton? Perhaps the AV industry is more competitive than I’d realized.

The site has a number of more serious problems:

  • unfinished stub pages (I can’t wait to find out what Smart Phone Support is, unless it turns out to be Anna, in which case there may be a Trade Descriptions issue)
  •  invalid security certificate messages
  • a Facebook page  that claims it was founded in Foley TX. Not exactly round the corner from Magnolia TX.

Any Texas Rangers reading this who can help this confused company sort out its real location?

David Harley CITP FBCS CISSP
ESET Senior Research Fellow

  • Aaron

    As usual, what a great post David! Keep up the excellent investigations exposing these such scammers and never lose your sarcastic writing style. It is informative while entertaining, which is most appreciated.

    • David Harley

      Thanks, Aaron. :)

  • Allan G. Hitchmoth

    August 20, 2012.
    Got a frantic voice-mail from my sister-in-law about a call from a woman named "Shivi", or some such, stating that she was with "Global PC Personal Computer Help Lline" The number she gave was  1-800-986-4764, and does indeed correspond to a company with the URL of ". The woman claimed that Microsoft was reporting that my sister-in-laws' machine was reporting errors and had her go to the comman-prompt and check the screen. Of course, once the woman read back the CLSID, she was amazed and really thought she had a problem. She also, in her befuddlement, completely forgot the "ASSOC" command the woman instructed her to issue once at the prompt. (That's why it took me so long to realize what number the woman "read back" to her) Luckily, she told the woman that she wated HER computer guy to check it out before going any further. It took me a while to decipher exactly what the steps were that the woman walked her through, but it was this very CLSID scam!
    For informational purposes, the URL is registered through GoDaddy,
     Domain Name: GLOBALPCHELPLINE.COM
          Created on: 18-Dec-10
          Expires on: 18-Dec-13
          Last Updated on: 15-Jul-12
     
    The rest is useless as it pertains to DomainsByProxy.
    I have no idea if this is a legitimate company who's information is simply being exploited, or if they're the scammers themselves. Either way, it seems this little gem is about to make the rounds again!
    Thanks for the blog, David!
    Great job!
    I now have something to which I can point when explaining the scam and (hopefully) forewarning my clients.
    All the best!
    -Al

    • David Harley

      Thanks, Allan. It’s always good to have data on specific sites.

  • Mrs Rosemary Bamford

    Had a similar call today from 'John Thompson', very strong Indian accent.  This is the first time we've had an address which sounds even plausible (my husband likes to string them along).  It's been a bit quiet recently but for well over a year we've had variations on this, perhaps twice a week.  I have a post grad. in Computer Science but this doesn't seem to daunt them at all.

Follow Us

Automatically receive new posts via email:

Delivered by FeedBurner

ESET Virus Radar

Archives

Select month
Copyright © 2013 ESET, All Rights Reserved.