The IT Nerd

After dealing with the events of part one of this investigation , I turned my attention to finding out who People Connect Inc. were. As I mentioned in my previous post, I found that the name and the phone number that they are associated with tech support scams in the past. Thus I was really motivated to find out who these people were and expose them for the scammers that they are. Before going further, I want to point out that I have hyperlinked some info that doesn’t go to this group of scammers, and anything that goes directly to the scammers is not hyperlinked. The latter can be easily found via Google or whatever search engine that you prefer if you’re interested.

The first thing that I looked at was the phone number that the scammers were using which is 1-800-690-3683. A Google search indicated that this number has been associated with tech support scams using a variety of company names. That suggests that this scammer has been around for a while and has used or is using a number of business names to scam people and avoid detection. But they don’t seem to change the phone number. The other thing that this Google search did is that it led me to the website of People Connect Inc:

The company claims to offer these services:

Two things got my attention. The first is the fact that they claim to be a Microsoft Partner. I can find no evidence that supports that this is true. The second was the ITES link is the one that got my attention. When I clicked on it, this is what I saw (Click to enlarge):

It says nothing about phoning people up and providing tech support. Real or otherwise. But it does say enough that a person who is not tech savvy may buy into what they are claiming.

But things got really interesting when I did a whois lookup on peopleconnectusa.com and got this result back (Click to enlarge):

The registrant has an address in Plainview New York, and the location turns out to be a house according to Google Street View which is strange seeing as search on Google Maps comes back with a different address in Uniondale NY with a different phone number that is tied to this domain name. The funny thing about this address is that Google Maps lists them as “computer support and services” with a couple of 5 star reviews which I would say are likely fake. On top of that, there is no suite number listed in this Google Maps entry. If you take that and combine it with the fact that there is a company that operate short term office space rentals in the same building, it leads one to suspect that this address is a front for this scam so that people are more likely to hand over credit card info and the like.

On top of that the technical contact is located in Kolkata India which is a known hotbed for tech support scams coming from India. Here’s where things get interesting. If you look at the e-mail addresses you’ll see that the ones for the registrant and admin contact (who are the same person) have the same first name as the technical contact, who strangely uses a Gmail address. That suggests that the person behind this scam might be the tech contact, or he at least is responsible at least in part in terms of setting it up, and the scam is run out of India.

Another couple of things to point out, at the bottom of their website they have links to a Facebook page where they post their own content to so that they can look legitimate. However, they also have a link to what I suspect should be their Twitter feed, but it simply goes to Twitter.com. Clearly attention to detail is not a strong point with these scammers. They also have a LinkedIn page that doesn’t have a whole lot of content on it. Finally, People Connect Inc are using a website called provencredible.com to try to add to the impression that they are legitimate. Ignoring the fact that only a tiny number of companies use this service, when you go there to see what’s listed there for People Connect Inc. you see this (Click to enlarge):

I am going to go out on a limb and suggest that the first testimonial is fake, and the second one is real.

Clearly, there’s enough evidence here to support the fact that these people are scammers, and they’ve been running this scam for a while. Thus if you get a call from People Connect Inc., hang up the phone. Or if you get a call from 1-800-690-3683, don’t even pick up the phone.

In the next part of this investigation, I going to focus on what software that these scammers tried to install on my client’s PC so that you can see what an operation like this does to the unsuspecting. What I will do is install this software on a virtual machine and analyze what it does. As soon as I have completed that, I will post the results here so that you can see how dangerous scammers like these are.

I got a panic call from a client on Thursday who went over to his parents house and apparently, his mother had received a call from someone claiming to be from Microsoft and saying that her computer had viruses. She had then initiated a remote access session with this “technician” and he was doing stuff to the computer. I literally dropped what I was doing and raced over there. The reason for my urgency was simple. The scammer will typically attempt to get the victim to allow remote access to their computer. After remote access is gained, the scammer relies on confidence tricks and social engineering.  Typically involving utilities built into Windows and other software in order to gain the victim’s trust to pay for the supposed “support” services, when the scammer actually steals the victim’s credit card account information, or to persuade the victim to login to Internet banking. Sometimes they will even steal files off of the computer. Clearly this sort of scam is very dangerous.

When I got there, I saw someone controlling the computer remotely. I put an end to that by pulling the power plug. I then warned the clients that the scammers would be phoning back and when that happened (which it did about 5 minutes later), the scammer needed to be told that the Internet is out. Meanwhile, I went about seeing what these scumbags had done. There was a remote access program running with the name People Connect Inc. I Googled the name and found that the name and the phone number that they are associated with this sort of scam. The remote access session showed that they had uploaded a number of files to the computers:

• A text file that was meant to show that these scammers were legit.
• CCleaner which is a utility to clean up a computer.
• The installer for the Chrome web browser
• Several files named unlock.bat, hosts.exe, lock.bat, execunlock.bat, execlock.bat, Nautilus Blue.exe, Nautilus Green.exe as well as a encrypted zip file that had the same files.

I took a copy of the ZIP file and deleted the rest. The reason why I took the ZIP file is I wanted to see what they were up to using a pristine copy of all of these items. As I type this, I am running a password cracker on it in a Windows 7 virtual machine. Once I crack it, I will test out the utilities to see what these files are and what effect they have on a Windows computer. I will then submit them to various anti-virus makers so that they can add these files to their virus definitions.

I ran a virus scanner that boots the computer from a USB thumb drive. I found nothing. I then went through the system and I ended up not really finding anything. From what I could tell, there were still in the process of setting up shop to carry the scam forward. I then ran several other malware and antivirus scanners and found nothing. I then ensured that the system was properly protected and left.

Now to protect themselves, the client cancelled the credit card that they used to stop the scumbags from getting paid. And to ensure that everything is okay, I will be doing a follow up. Meanwhile I will be looking at the files that these scumbags left behind after I break into the ZIP file. I’ll report on both of those in the coming days. In closing, I will also give you tips on how not to become a victim of a scam like this. Please stay tuned for further developments.