Tautoko Hangarau rūpahu nga Pahū-Up Scams me te Tango i nga Utauta Uru Mamao Kore Whakamana¶
He rereke nga nama ohorere i ia whenua. Ka whakamahia e tenei wharangi te 911, te nama mo te United States me Canada. He maha nga whenua e whakamahi ana i te 112, 999, tetahi atu nama ranei. Kimihia te nama mo to whenua.
Ka tutakina te mata o to rorohiko ki roto i te matohi matohi whero, kikorangi-katoa ranei e kii ana "Te Pokapū Haumarutanga Windows Defender: Trojan.Spyware Detected, Call Microsoft Support Immediately at 1-800-..." (he rite ranei ki te Apple macOS e kii ana kei te whakaekehia o putea iCloud me o putea), kei te titiro koe ki te Te Tautoko Hangarau Hangarau Pop-Up Scam. Ahakoa ka whiti te mata i nga tohu whai mana, ka whakatangihia he haruru nui, he reo karetao ranei na roto i o kaikorero, ka whakatio i to pehu kiore kia kore e taea e koe te patene i te X pātene, karekau he huaketo i to rorohiko. He wharangi paetukutuku kino noa e mahi kino ana i to kaitirotiro API Mata-Katoa (F11), API Maukati Tohu, me Tukutuku Ororongo Rorohiko hei whakapouri i a koe ki te waea atu ki te pokapu waea taihara.
Heoi, ka tino noho te kino i te wa e waea ana koe i te nama waea i runga i te mata me te tuku i te "kaihangai" ki te whakauru i tetahi taputapu Aroturuki Mamao me te Whakahaere (RMM) arumoni tika ranei, penei i te AnyDesk, TeamViewer, ConnectWise ScreenConnect, UltraViewer, RustDesk, LogMeIn Rescue, Zoho Assist, Tere Tere ranei. Ka uru ki roto i to rorohiko, ka pangia e nga kaipahua to kaitirotiro ("te whakauru i te papaa haumaru"), whakatuwherahia o kupuhipa tirotiro me nga huihuinga putea ipurangi, whakarawe i to whaarangi paetukutuku peeke HTML kia rite ki te "whakahoki nui" i a koe te 40,000 taara, ka whakauru tonu Unattended Access Windows Services kia taea ai e ratou te takiuru ano ki to rorohiko i te 3:00 AM i muri i to whakairinga. Ma tenei aratohu e whakaatu ki a koe me pehea te wehe atu i te mata tirotiro tio i roto i te 5 hēkona, ka wehe i nga hononga mamao kaha tonu, te horoi i nga ratonga papamuri RMM huna, me te kati i o putea putea.
Mahia tenei inaianei¶
- WATAHIA to taura Itarangi, whakawetohia te Wi-Fi i runga i to rorohiko, wetehia ranei to pouara Wi-Fi kaainga mai i te putanga hiko o te pakitara inaianei. Mena kua waeahia e koe te nama waea, me tuku ranei tetahi ki te hono atu ki to rorohiko, kaua e moumou taima ki te tautohetohe ki te kaipahua i runga waea, ka ngana ranei ki te kati i tana matapihi ki to kiore (ka taea e koe te kati i to kiore me te whakapouri i to mata). Toia tinana te mono ki runga i to pouara Wi-Fi, ka pupuri ranei i te paatene hiko tinana o to rorohiko mo te 10 hēkona kia mutu ra ano te whakakore i to waahi whakahaere mamao.
- Ki te KORE koe i waea atu ki te nama ka mau tonu koe ki runga i te mata orooro "Virus Alert" e rarapa ana, pehia me te pupuri
Alt + F4(raneiCtrl + Shift + Escki te patu i te kaitirotiro i roto i te Kaiwhakahaere Tūmahi) i runga Windows, pehi raneiCommand + Option + Escapeki Whakamutua te Safari/Chrome i runga i te Mac. Kaore ano koe i taumanutia. Ko te whakaoho he ripa tirotiro tukutuku noa e rere ana i te aratau kiosk mata-katoa. Kia kaha koe ki te whakamutu i te kaitirotiro, whakatuwheratia ano ka ** KAUA e panui "Whakaora i nga Wharangi"**, ka 100 paiheneti te ma o to rorohiko. - Mena ka tukua e koe te kaiwaea ki te hono atu ki to rorohiko, waea atamai ranei, waea atu ki to peeke, uniana nama, me nga tari mahi tinihanga mai i tetahi waea motuhake. Ahakoa kaore koe i pato i to kupuhipa peeke i a ratou e matakitaki ana, ka whakahaerehia e nga kaipahua nga tuhinga aunoa i runga i nga hongere whakawhiti konae AnyDesk/ScreenConnect e kape ana i to kaitirotiro
Login Datakupuhipa kua tiakina me ** pihikete wātū hohe** i raro i te 10 hēkona, ka kōkirihia rānei ngā whakawhitinga ACH/Zelle/Waea e kore e kitea i muri i te mata arai "Windows Update" kua pango. Whaia to maatau aratohu pakaru putea putea inaianei tonu. - Whakaohohia to rorohiko me te Wi-Fi me te Itarangi kua MATE KATOA (i roto ranei i te Aratau Haumaru Windows) i mua i te tango i a AnyDesk, TeamViewer, ScreenConnect, UltraViewer ranei. Me paatoo noa i te
Xi runga i AnyDesk, TeamViewer ranei **kaore e tango i te urunga a te kaipahua mena ka whirihorahia e ratou "Whakauru Karekau", ka whakauruhia ranei he wahangu ConnectWise ScreenConnect (ScreenConnect.ClientService) Ratonga papamuri Windows. Puritia te rorohiko ki te tuimotu i a koe e tango ana i nga taputapu mamao katoa i hangaia i tenei ra, ka whakakore i tana Ratonga Windows / macOS LaunchDaemon ma te whakamahi i nga taahiraa i raro nei. - **Kaua rawa e hoko i nga kaari koha, tango moni tinana, arowhai moni, tukuna ranei he moni crypto, whakawhiti waea ranei hei "whakamuri i te moni utu nui ake."
F12(Nga Utauta Kaiwhakawhanake Tirotiro) i a koe e takiuru ana ki to putea putea, whakatikahia te tuhinga HTML o to toenga arowhai mai$2,500ki$42,500, ka tangi i roto i te mataku me te kii "i paopao ohorere ratou$40,000hei utu mo$400i runga i to puka whakahoki ka panaia ki te kore koe e waea, me tuku mai ranei te taapiri$39,600." Kaore he moni kotahi i tukuna ki to putea; na ratou i whakatika nga nama i runga i to mata, i whakawhiti ranei$40,000mai i to ake putea penapena/HELOC ki to putea arowhai. - Ki te kii te kaipahua kei te tukuna he "kaiwhakahaere mo te tari" he "kaikawe" ranei ki to whare ki te tiki moni, paraka koura ranei, waea atu ki nga pirihimana. Ko te neke mai i te raweke waea ki te tuku i te kaikawe muera moni tinana ki to tatau o mua he hara hara kaha kei te haere tonu. Maukati o tatau ka waea atu ki to nama whawhati tata (911 i te United States me Canada, 112 puta noa i te Kotahitanga o Europi, 999 i te United Kingdom, tirohia ranei to maatau tau ohorere whaiaronga).
He aha a Microsoft, Apple, Google, Amazon, Geek Squad me Norton e kore e whakaatu i tetahi nama waea i runga i te pahū-ake ka waea atu ranei ki a koe
Nga taputapu haumarutanga o te punaha whakahaere tuturu, tae atu ki te Microsoft Defender, Apple XProtect, me te Google Safe Browsing, kaua rawa e whakaatu i te kore utu. 1-800 ranei 1-888 te nama waea i roto i te matohi haumarutanga, kaua rawa e purei i te tangi haruru, i te whakatupato korero ranei e kii ana kia kaua e whakawetohia to PC, kaua hoki e mahi nga kaihoko waea ki waho ki te waea atu ki nga kaihoko mo nga huaketo me nga ohaurunga kua pau. Tetahi matapihi pakū-ake, nama īmēra ($399.99 Geek Squad / Norton Auto-Renewal), ko te waea waea ranei e hoatu ana ki a koe he nama tautoko ki te waea he 100 paiheneti he mahi tinihanga kino.
Hangarau tautoko tinihanga me te uru mamao rakau whakatau¶
flowchart TD
Root["Pahū-Up Tautoko Hangarau, Īmēra Nama rūpahu, Tinihanga Uru Mamao rānei"] --> DidConnect{"I Waea koe i te Nama, i tuku ranei i tetahi ki te hono atu ki to Rorohiko/Waea?"}
DidConnect -->|"KORE: I kite noa i te mata pahū-ake e rarapa ana i te tirotiro"| BrowserKill["1. Matapihi: Pēhi Ctrl+Shift+Esc -> Whakamutua te Mahi i runga Chrome/Edge/Firefox<br/>2. Mac: Pēhi Cmd+Kōwhiringa+Esc -> Whakamutua Whakamutua te Safari/Chrome<br/>3. Whakatuwheratia ano te kaitirotiro KARE he panui 'Whakaora i nga Wharangi' -> Ūkuia te keteroki me te aukati i nga whakamohiotanga o te pae<br/>(Kore he kino kua whakauruhia; he 100% haumaru koe)"]
DidConnect -->|"ĀE: Kua whakauruhia he pūmanawa, patohia he waehere 9-mati, i whakauru ranei i tetahi URL i homai e ratou ki ahau"| CutNet["KAUPAPA 1: Momotu tonu i te Wi-Fi me te Wetewete i te Waea Itarangi (Wewete Pouara ranei)"]
CutNet --> BankLock["STEP 2: Mai i te waea ma, waea atu ki to Peeke/Brokerage Fraud Dept ki te whakatio i nga kaute, whakakore i nga kaari, ka aukati i nga waea."]
BankLock --> PurgeRMM["STEP 3: I te wa e noho tuimotu ana te PC, tango i te AnyDesk, TeamViewer, UltraViewer, RustDesk ME te patu i nga ratonga ScreenConnect / GoTo huna."]
PurgeRMM --> AuditSys["STEP 4: Mukua nga kaiwhakamahi Kaiwhakahaere Windows nauhea ('kaiwhakamahi kupenga'), tango i nga mahi whakaoho, wete i nga mahanga 'syskey', BitLocker ranei, ka whakahaere i te Defender Offline Scan"]
AuditSys --> RotateCreds["STEP 5: Mai i te taputapu ma, takahuri Email, Peeke, me te Kaiwhakahaere Kupuhipa kupuhipa & pāwhiri 'Waitohu atu o Sessions Katoa'"]
Wāhanga 1: Me pehea te kati i te pahū-ake "Mahiti Virus" mata-katoa (Mena KAORE koe i waea atu)¶
He aha te take i maukati ai te whakatupato a Microsoft, a Apple ranei i to pehu kiore me te kore e tuku kia paato i te paatene kati? I te wa i paatohia e koe i runga i te rohe typo-squatted (penei youtbe.com ranei espnn.com) ranei he anga whatunga kino kino ranei, na te wharangi paetukutuku i whakaoho e toru nga API tirotiro HTML5 tika i roto i te tere 10-millisecond loop:
1. Element.requestFullscreen(): Ka horahia te wharangi tukutuku ki runga i to aroturuki katoa, ka huna i to paetaumahi Windows, Mac Dock, me nga ripa tirotiro.
2. Element.requestPointerLock(): Ka hopu i to pehu kiore ki roto i te pouaka 1-pixel e kore e kitea (i hangaia mo nga keemu tirotiro 3D penei i te Minecraft), me te ahua kua tio to kiore.
3. window.onbeforeunload + window.print() porowhita korero: Ka puta ake nga pouaka korero mutunga kore ka paato Esc ka whakaoho tonu i te mata katoa.
Me pehea te patu i te pahū-ake i roto i te 10 hēkona i runga i Windows, macOS, Chromebook, me te iPad¶
- I Windows 10 me Windows 11:
- Perehi
Ctrl + Shift + Esckei runga i to papapātuhi (ka whakatuwheratia Kaiwhakahaere Mahi Matapihi ki runga ake o te tirotiro tio). - (Mena kei te mau tonu to pehu kiore, whakamahia te
Down Arrowkī i runga i to papapātuhi hei tohu Google Chrome, Microsoft Edge, Mozilla Firefox ranei, ka pehi i teDeletekī raneiAlt + Eki te panui Whakamutua te Mahi). - Taahiraa nui ina whakatuwhera ano i to kaitirotiro: Ina whakatuwhera ano koe i a Chrome, Edge ranei, ka patai tetahi mirumiru iti i te kokonga matau-runga: " Kaore a Chrome i tutakina tika. [Whakaora]". Kaua e paato Whakahokia (ma te paatene Whakaora ka whakatuwherahia te ripa kino). Patohia te
Xki te whakakore i te mirumiru. - I a Apple macOS (MacBook / iMac):
- Perehi
Command (⌘) + Option (⌥) + Escapei runga i to papapātuhi hei whakatuwhera i te matapihi Force Quit Applications. - Tīpakohia Safari ranei Google Chrome ka paato i te Force Quit.
- Purihia te
Shiftkī i runga i to papapātuhi i te wa e paato ana i te tohu Safari, Chrome ranei i roto i to Wau kia whakarewahia. Te pupuriShifti te wa o te whakarewatanga ka kaha te macOS ki te whakatuwhera i te matapihi tuwhera ma ** me te kore e whakahoki i nga ripa kua maukati o mua **. - Whakakorea Nga Pahū-ake Whakamōhiotanga Papamahi Hohoki ("McAfee: 5 Nga Waotere I Kitea" kei te kokonga matau-raro):
- Mena kei te kite koe i nga whakatupato huaketo ka paheke mai i te ** kokonga matau-raro o to paetaumahi Windows** (te kokonga matau-runga ranei o to mata Mac) ahakoa kei runga koe i te paetukutuku noa, i paatohia e koe te "Whakaae" i runga i te Tirotiro Push Notification prompt i nga ra ki muri.
- I Chrome: Tārua me te whakapiri
chrome://settings/content/notificationski te pae wāhitau. Titiro ki raro i te rarangi "Whakaaetia ki te tuku whakamohiotanga", pawhiria nga ira e toru (⋮) i te taha o nga paetukutuku tauhou katoa, ka kowhiri i te Tangohia / Poraka. - I Microsoft Edge: Tuwhera
edge://settings/content/notificationska tango i nga waahi katoa kaore i te mohiotia i raro i te Whakaae. - I Apple Safari (macOS): Whakatuwheratia Safari> Tautuhinga> Paetukutuku> Whakamōhiotanga ka kowhiria Whakakahore ranei ** Tango** mo nga paetukutuku tauhou.
Wāhanga 2: Whakaotia te tango i nga Utauta Uru Mamao scammer (RMM Purge Protocol)¶
Mena i waea atu koe ki te kaipahua me te whai i a raatau tohutohu ki te toro ki tetahi paetukutuku (penei i anydesk.com, ultraviewer.net, help.me, fastsupport.com, he hononga ritenga pera ranei support247.screenconnect.com) me te whakahaere i tetahi konae kua tikiakehia, kia momotuhia to rorohiko mai i te ipurangi (Wi-Fi OFF, Ethernet wetekina) i a koe e tirotiro ana me te tango i nga urunga mamao katoa ki muri.
He aha te take ka whakauruhia e te hunga tinihanga e rua, e toru ranei nga taputapu uru mamao i te wa kotahi¶
I te wa e hono atu ai tetahi kaipahua ki to PC ma te AnyDesk, Windows Tere Awhina ranei, ko ta ratou nekehanga papamuri wahangu tuatahi (i te wa e whakararuraru ana i a koe i runga i te waea) ko te whakauru i te tuarua, hinonga e kore e kitea he kaihoko Aroturuki Mamao & Whakahaere (RMM), te nuinga o ConnectWise ScreenConnect (ScreenConnect Client), Atera, Syncro, MeshCentral, SimpleHelp, Tactical RMM ranei.
- He aha? Na te mea ahakoa ka pohehe koe, whakairihia te waea, ka tango i a AnyDesk mai i to papamahi, Ka rere a ScreenConnect hei huna. NT AUTHORITY\SYSTEM Ratonga papamuri Windows (ScreenConnect Client (xxxx)) kahore he ata papamahi. I te wa ka hono ano to PC ki te Wi-Fi, kei te 100 paiheneti te wahangu o te kaipahua, te uru pakiaka ki to miihini.
Te ripanga rapu matua mo nga taputapu Uru Mamao me te RMM i tukinotia e te hunga tinihanga¶
| Ingoa Utauta | Kei hea e huna ai i runga i te kopae (Windows & macOS) | Ratonga Windows / Ingoa Tukanga Papamuri | Me pehea e mau tonu ai nga Scammers ki te uru ki muri |
|---|---|---|---|
| ConnectWise ScreenConnect (Ko te taputapu tohenga #1 e whakamahia ana e te hunga tinihanga) | Wiki: C:\Program Files (x86)\ScreenConnect Client (xxxx)\ ranei %TEMP%\ScreenConnect\Mac: /opt/screenconnect-xxxx/ & /Library/LaunchDaemons/screenconnect* |
ScreenConnect.ClientService.exe / ScreenConnect.WindowsClient.exe |
Ka tāuta hei aunoa SYSTEM ratonga ma te whakamahi i tetahi ID tauira 16-puāhua matapōkeretia (ScreenConnect Client (a1b2c3d4e5f6)). Kare ranei ** ka puta i nga wa katoa ki te Tāpiri/Tango Papatono ki te whakarewahia hei MSI/ratonga kawe. |
| AnyDesk | Wiki: C:\Program Files (x86)\AnyDesk\ & %APPDATA%\AnyDesk\ & C:\ProgramData\AnyDesk\Mac: /Applications/AnyDesk.app & -/.anydesk/ |
AnyDesk.exe (AnyDesk Service) |
Ka taea e nga kaipahua te "Whakauru Karekau" me o ratou ake kupuhipa me te kape service.conf / system.conf na to 9-mati AnyDesk ID noho herea ki to ratou papatohu. |
| TeamViewer | Wiki: C:\Program Files\TeamViewer\ & %APPDATA%\TeamViewer\Mac: /Applications/TeamViewer.app & /Library/Preferences/com.teamviewer* |
TeamViewer_Service.exe (TeamViewer) |
Ka tautapahia e te hunga tinihanga to rorohiko ki a raatau putea TeamViewer i raro i te Whakauru ngawari / Whakaaetanga Karekau ka taea te "Mata Pango" (TeamViewer Monitor Driver) ki te huna i ta ratou mahi. |
| UltraViewer / Supremo / RustDesk | Wiki: C:\Program Files (x86)\UltraViewer\, C:\Program Files\RustDesk\, %APPDATA%\RustDesk\ |
UltraViewer_Service.exe, rustdesk.exe |
I whirihorahia kia timata ki a Windows me te whakaae ki nga kupuhipa kore e tiakina. |
| Whakaora Takiuru / GoToAssist / Zoho Assist | Wiki: %LOCALAPPDATA%\LogMeIn Rescue Applet\, C:\Program Files (x86)\GoToAssist*, C:\Program Files (x86)\ZohoMeeting\ |
LMIRTechConsole.exe, g2ax_service.exe, ZohoURS.exe |
Rēhita ana i tetahi Ratonga Tautoko Karekau i te Maataki ki roto services.msc me te Kaihōtaka Mahi (taskschd.msc) e ora ana i te whakaara ano. |
| Awhina Tere Windows (I hangaia ki roto Windows 10/11) | I hangaia ki roto C:\Windows\System32\QuickAssist.exe (taupānga Toa Microsoft ranei) |
QuickAssist.exe |
Ka mutu te huihuinga ina katia, engari ka whakamahia e te hunga tinihanga te Awhina Tere i te 60 hēkona tuatahi ki te tango me te whakauru i te ScreenConnect, AnyDesk ranei. |
Ko te tuhinga PowerShell taahiraa-i-taahiraa ki te kimi, ki te whakamutu, ki te whakakore i nga ratonga RMM huna katoa (Windows)¶
Ahakoa kei te tuimotu to PC Windows, paato-matau i te paatene Tīmata -> paohia Terminal (Kaiwhakahaere) ranei PowerShell (Kaiwhakahaere), ka whakahaere i tenei tuhinga tātaritanga me te whakakore hei whakaatu me te whakakore i nga ratonga uru mamao kua whakauruhia ki to rorohiko:
# 1. List all running or installed Windows Services matching common RMM / Remote Access tools:
Get-Service | Where-Object {
$_.DisplayName -match "AnyDesk|TeamViewer|ScreenConnect|ConnectWise|UltraViewer|RustDesk|Zoho|LogMeIn|GoTo|Supremo|SimpleHelp|Mesh Agent|Atera|Syncro|Splashtop" -or
$_.Name -match "AnyDesk|TeamViewer|ScreenConnect|UltraViewer|RustDesk|Zoho|LMI|GoTo"
} | Select-Object Status, Name, DisplayName
# 2. Immediately STOP and DISABLE every matched remote access service so it can never start again:
Get-Service | Where-Object {
$_.DisplayName -match "AnyDesk|TeamViewer|ScreenConnect|ConnectWise|UltraViewer|RustDesk|Zoho|LogMeIn|GoTo|Supremo|SimpleHelp|Mesh Agent|Atera|Syncro|Splashtop"
} | ForEach-Object {
Stop-Service -Name $_.Name -Force -ErrorAction SilentlyContinue
Set-Service -Name $_.Name -StartupType Disabled -ErrorAction SilentlyContinue
Write-Host "Stopped and Disabled Service: $($_.DisplayName)"
}
# 3. Check for any software or folders created or modified in the last 72 hours in Program Files & ProgramData:
Get-ChildItem -Path "C:\Program Files", "C:\Program Files (x86)", "C:\ProgramData", "$env:APPDATA", "$env:LOCALAPPDATA" -Directory -Force -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-3) } |
Select-Object CreationTime, FullName
I muri i te whakamutu i nga ratonga i PowerShell:
1. Perehi Win + R, momo appwiz.cpl, ka pehi Enter ki te whakatuwhera i te matarohia Programs and Features paewhiri mana.
2. Pāwhiritia te "Kua Tāuta I" pane tīwae hei kōmaka i ngā papatono kua tāutahia mai i Hou ki te Tawhito.
3. ** Wetewete i nga papatono katoa i whakauruhia i te ra o te mahi tinihanga** (tae atu ki te AnyDesk, TeamViewer, UltraViewer, RustDesk, ScreenConnect Client, Zoho Assist, GoTo Opener, rūpahu " wheori / taraiwa taraiwa" ranei).
4. Mukua te toenga o te ScreenConnect & AnyDesk kōpaki: I te File Explorer, muku C:\Program Files (x86)\ScreenConnect Client*, C:\ProgramData\AnyDesk, a %APPDATA%\AnyDesk (te whakakore C:\ProgramData\AnyDesk\service.conf ka whakangaro i te Hash kupuhipa kaore i tiakina e te kaipahua me te AnyDesk ID).
Tango-taahiraa o te Whakarewa Whakanuia Mamao i runga i te Apple macOS¶
I runga i te Mac (kua whakawetohia te Wi-Fi OFF), ka whakauruhia e nga kaipahua etahi kaihoko papamuri ki roto /Library/LaunchDaemons a /Library/LaunchAgents. Tuwhera Terminal (Applications > Utilities > Terminal) ka rere:
# 1. Inspect all third-party background LaunchDaemons and LaunchAgents for remote access tools:
ls -la /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents
# 2. Unload and delete any ScreenConnect, AnyDesk, TeamViewer, Zoho, or LogMeIn persistence plists:
sudo launchctl bootout system /Library/LaunchDaemons/*screenconnect* 2>/dev/null
sudo launchctl bootout system /Library/LaunchDaemons/*anydesk* 2>/dev/null
sudo launchctl bootout system /Library/LaunchDaemons/*teamviewer* 2>/dev/null
sudo rm -rf /Library/LaunchDaemons/*screenconnect* /Library/LaunchAgents/*screenconnect* /opt/screenconnect*
sudo rm -rf /Applications/AnyDesk.app ~/.anydesk /Library/LaunchDaemons/*anydesk* /Library/LaunchAgents/*anydesk*
sudo rm -rf /Applications/TeamViewer.app /Library/LaunchDaemons/*teamviewer* /Library/LaunchAgents/*teamviewer*
- pātene) tetahi taupānga tautoko mamao kua whakarārangihia ki reira.
Wāhanga 3: Whakamuri "Maka Whakahoki Scammer" (msconfig Maukati Whakaara Haumaru, net user Maukati Kupuhipa, me nga mahanga BitLocker)¶
Ina mohio tetahi kaipahua tautoko hangarau kei te kore koe e utu ki a ia, kei te whakairi ranei i te waea, ka whakapaua e ia a ratou 15 hēkona whakamutunga i runga i to rorohiko e ngana ana ki te rakau i a koe ki waho o Windows kia taea ai e ratou te tohe i a koe mo te "waho kupuhipa":
1. Hurihia te msconfig "Whakatika Haumaru me te kore Whatunga" Rore Maukati¶
E pai ana te hunga tinihanga ki te pehi Win + R -> momo msconfig -> tirohia Haumaru Whakaoho (Te iti) -> hurihia to kupuhipa pūkete kaiwhakamahi Windows rohe ma net user -> ka kaha ki te whakaara ano. Ina whakaara ano to PC ki te Aratau Haumaru tuimotu, ka monoa to PIN Hello Windows noa, ka tono a Windows mo te kupu huna kua whakatakotoria e te kaipahua.
- Me pehea te wehe atu:
1. I te mata takiuru Windows, purihia te Shift kī i te wa e pa ana i te Power icon -> Tīmata anō ki te tomo i te puru ** Windows Recovery Environment (WinRE)** -> Troubleshooting > Advanced options > Command Prompt.
2. Mena kua whakakorehia e te kaipahua te whawhai noa ki roto bcdedit (safeboot minimal), whakahaere i tenei whakahau ki te whakaora tonu i te whawhai noa:
Support, Admin1, ranei MicrosoftHelp), muku tonu me net user Support /delete.
2. Takina mena i tahaetia e te Scammer o Kupuhipa Pūtirotiro kua Tiaki (Login Data / iCloud Keychain)¶
I te wa i pangohia to mata e TeamViewer, i te waahanga "Aroturuki Pango" ranei a ScreenConnect, i kaweake e te kaipahua o kupuhipa?
- Whakatuwhera Google Chrome (chrome://password-manager/settings) ranei Microsoft Edge (edge://wallet/settings). Ka paatohia e nga kaipahua "Kaweake kupuhipa" (me kape ranei i to %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data kōnae SQLite me Local State Kī DPAPI) i roto i te 30 hēkona o te tūhonotanga.
- Me whakaaro ko nga ingoa kaiwhakamahi me nga kupu huna katoa kei roto i to kaitirotiro paetukutuku i kapehia e te kaipahua. Whakamahia he rorohiko motuhake, maamaa, waea atamai ranei ki te huri i to imeera, putea, putea, taake, Amazon, me nga kupuhipa paapori, me te whakakore i nga waahi tirotiro ma te whakamahi i to maatau. te kaaina tohu hui me te whakakore i nga huihuinga o te ao aratohu.
3. Te Kaute me te Tango i nga Taupānga Uru Mamao kua whakauruhia ki runga i te Android, i te iPhone ranei (AnyDesk / TeamViewer QuickSupport)¶
Kei te piki haere te tautoko hangarau me te rūpahu "Geek Squad / Amazon / Norton Refund" ka akiakihia nga patunga ki te whakauru i te AnyDesk Remote Control ranei TeamViewer QuickSupport ki runga i to iPhone, Android atamai ranei kia taea ai e te kaipahua te panui i nga peeke 6-mati SMS 2FA tuhinga mai i te mata o te waea a te tangata i mate i te pona: - I runga i te Android: Whakakāhia Aratau Rererangi, whakatuwhera ** Tautuhinga > Taupānga > Tirohia nga taupānga katoa**, ka tango i te AnyDesk, TeamViewer QuickSupport, Zoho Assist, tetahi momo awhina ranei "AdControl / mono". Panuku, whakatuwheratia Tautuhinga> Urunga -> Taupānga kua tikiakehia me te mohio kaore he mono mana mamao e mau ana i nga mana uru. - I te iPhone / iPad: I runga i te iOS, kaore e taea e AnyDesk me TeamViewer te neke tika i o maihao, engari ka rere to mata iPhone ora (tae atu ki nga haki SMS 2FA taumai) ma te toronga Panui Mata a Apple. Patohia ki raro mai i te kokonga matau-matau ki te whakatuwhera i te ** Pokapū Mana **, manatokohia te whero **Whakaahua Mata / Paoho Matapihi Matapihi ** kua whakawetohia, mukua te AnyDesk, TeamViewer ranei taupānga mai i to Mata Kainga, ka tirohia ** Tautuhinga> General> VPN & Whakahaere Pūrere ** ki te whakakore i nga korero whirihoranga kore mohiotia.
Wāhanga 4: Te pupuri putea mena ka utua e koe, ka takiuru koe ki to peeke, ka tukuna ranei he ID¶
Mena ka kite te kaipahua i a koe e takiuru ana ki to peeke, ka whakaae koe ki te utu mo te "5-tau ohaurunga paahi ahi," i tinihangatia ranei koe ki te "$40,000 overpayment refund" whakatika HTML:
- Mena kua takiuru koe ki te Peeke Ipurangi i te wa e hono ana te kaipahua:
- Waea wawetia to putea Te Tari tinihanga. Mea atu ki a ratou: "I pa ahau ki tetahi mahi tinihanga tautoko hangarau-a-mamao, na te tangata hara i whakahaere taku rorohiko ma te AnyDesk/ScreenConnect i te wa e tuwhera ana taku waahi putea ipurangi."
- Tonoa te peeke kia:
- Katia o nama kaute kaute me te penapena moni ka whakatuwhera i nga nama kaute hou (na te mea ka whakatuwherahia e te hunga tinihanga nga korero a-marama PDF ki roto i to tomokanga peeke ki te kape i to Tau Ararere me te Nama Kaute mo nga mahi tinihanga a ACH a muri ake nei).
- Whakakorea nga whakawhitinga ACH e tarewa ana, nga utu Zelle, nga arowhai Pire Utu, nga whakawhitinga waea ranei.
- Tirohia mena i whakawhiti moni te kaipahua i waenga i o ake kaute o roto (hei tauira, neke
$25,000mai i to Tiaki, i to Raina Moni Moni Kaainga ranei ki roto i to putea Takitaki ki te rūpahu he "whakahoki utu nui"). - Whakakorehia nga tohu whakahiato OAuth kaha katoa (Plaid, Yodlee, Finicity) ka tautuhi ano i to ingoa kaiwhakamahi putea ipurangi, kupuhipa, me nga patai haumaru.
- Mena i hokona e koe a Target, Apple, Razer Gold, Lowe's, Home Depot, he Kaari Koha Steam ranei:
- Ahakoa kua panuihia e koe nga nama PIN kei muri o nga kaari koha ki te kaipahua, ** waea atu ki te nama Tiaki Kaari Koha / Ratonga Kaihoko kei muri tonu o te kaari tinana** me te rīhiti kāri kei te ringaringa. Ka taea e nga kaituku nui (Apple, Target, Home Depot, Lowe's, Walmart) te whakatio i te toenga kaore i whakapaua ki runga i nga nama kaari koha tahae me te whakahoki mai ki a koe mena ka mau i mua i te whakakorenga o te kaihokohoko putea koha-kaari tinihanga.
- Mēnā i tukuna e koe tō Tau Haumaru Hapori, tau Hauora Hauora, he whakaahua rānei o tō Raihana Atekōkiri / Uruwhenua:
- Whakatakotoria he Security Freeze ki runga i o ripoata nama i Equifax, Experian, me TransUnion (me ChexSystems mo nga putea putea) ma te whakamahi i ta maatau whakautu tahae tuakiri me te whakaora nama aratohu.
Aukati: Me pehea te mahi tinihanga i to rorohiko me te tiaki i nga matua me o whanaunga¶
Mena kei te horoi koe i tetahi rorohiko mo koe, ma te matua, ma te koroua ranei i muri i te tinihanga tautoko hangarau, whakamahia enei arai hangarau e wha i roto i te rima meneti kia kore ai e taea e te kaipahua te hono ano:
- Tāutahia he Ad & Malvertising Blocker (
uBlock Origin/uBlock Origin Lite) i ia kaitirotiro: Neke atu i te 90 paiheneti o nga pahū-ake huaketo Microsoft me Apple mata-katoa e tukuna ana na roto i nga whakawhitinga whakawhiti korero kino i runga i nga purongo, tohutao, kupu whakawhiti, paetukutuku paopao ranei. Ko te whakauru i te uBlock Origin ka aukati i te 99.9 paiheneti o nga rohe pakū-ake tautoko hangarau rūpahu i mua i te utaina. - Whakawhitihia te pouara kaainga, te DNS tirotiro ranei ki tetahi Kaitautoko DNS-Araia-Malware (
1.1.1.2ranei9.9.9.9): Tautuhia te DNS rorohiko, pouara ranei ki Cloudflare mo nga Whanau (1.1.1.2a1.0.0.2) ranei Taua9 (9.9.9.9), ka aukati aunoa i nga rohe tinihanga tautoko hangarau hou i te paparanga DNS. - Waihangahia he Rahuitanga Pūmanawa Windows / AppLocker, Parepare Ture Aukati ranei
AnyDesk.exe,ScreenConnect, aUltraViewer: I runga i te rorohiko o te whanaunga karekau rawa e whakamahi tika i nga taputapu papamahi mamao tuatoru, huri i a raatau putea Windows ia ra mai i te kaute Kaiwhakahaere ki te putea Kaiwhakamahi Paerewa (te pupuri i tetahi kaute Kaiwhakahaere kua parea-kupuhipa mo te tiaki IT whanau) kia kore e taea e ratou te whakauru wahangu.SYSTEM-taumata ratonga RMM kahore he PIN kaiwhakahaere. - Rīpiahia he tapanga whakamaumahara tinana ki te bezel o runga o te kaupane rorohiko: Tuhia kia marama ki runga i te tapanga iti: "Microsoft, Apple, Geek Squad, a KARE rawa to Peeke e puta ake he nama waea ki te mata, ka tono ranei koe kia whakauruhia AnyDesk/UltraViewer. Pēhia Ctrl+Shift+Esc ki te kati."
Pātai auau¶
The scammer opened the black Windows Command Prompt (`cmd.exe`) on my screen, typed `tree` or `netstat` or `eventvwr`, and showed me hundreds of "Errors, Warnings, and Foreign Hackers Connected." Wasn't that proof my PC was infected?
No, every single one of those commands is a classic theatrical parlor trick used by scam call centers for the past 15 years. Typing `tree` in Command Prompt simply lists all the normal folders on your hard drive while the scammer types `"0 Viruses Found... Trojan Detected."` at the very bottom line before hitting Enter. Typing `netstat -ano` lists normal background connections to Microsoft, Google, and Akamai web servers, which the scammer lies and calls "foreign hackers." Opening **Windows Event Viewer (`eventvwr.msc`)** on a brand-new, 100% healthy computer out of the box always shows thousands of routine yellow "Warning" and red "Error" log entries from background service timeouts. None of them are viruses.
I logged into my real bank account on my own computer while on the phone with the scammer, and my real checking balance genuinely went up by $20,000. How did they do that if they didn't send me money?
They used two tricks together: First, while your screen was momentarily blacked out (or while they had mouse control), the scammer logged into your **Savings account, Overdraft Line of Credit, or Credit Card Cash Advance** inside the same bank portal and transferred **$20,000 of your own money** into your Checking account. Second, they right-clicked your Savings account row on the webpage, clicked **"Inspect Element" (`F12`)**, and deleted the Savings row from the HTML page on your monitor so you wouldn't notice the money came out of your own savings. If you didn't have a savings account, they simply edited the HTML text of your checking balance from `$1,500.00` to `$21,500.00` inside your browser window (which disappears the instant you press `F5` to refresh the page or check the official bank mobile app on your smartphone).
If I only clicked on the pop-up, heard the loud siren, and forced my computer off with the power button without calling the phone number, do I need to wipe my computer or pay Geek Squad to clean it?
No. If you **never called the phone number**, never typed a code into a remote support site, and never downloaded and ran an `.exe`, `.msi`, or `.pkg` file, **your computer was never infected or accessed by anyone**. The loud siren and flashing Microsoft/Apple warning was 100 percent contained inside a normal web browser tab, identical to watching a noisy YouTube video in full-screen mode. Simply force-close the browser, re-open it without restoring the old tab, clear your browser cache, and continue using your computer normally.
Since the scammer had AnyDesk or ScreenConnect on my computer for 30 minutes, is uninstalling the remote program enough, or should I do a full Windows "Reset this PC" / clean reinstall?
Uninstalling the RMM agents and disabling their services (while offline) stops immediate remote control, **but if a scammer had unattended administrative access to your computer behind a blacked-out screen for 20 to 60 minutes, the safest gold-standard recovery is to back up your personal documents/photos to an external USB drive and perform a clean Windows Reset / macOS Erase and Reinstall**. Because the scammer had Administrator privileges, they could have dropped a secondary commodity infostealer, modified Windows Defender exclusions (`Get-MpPreference`), or installed a scheduled task backdoor. While you prepare for a clean OS reinstall, keep the computer disconnected from the internet and change all your passwords from a separate, clean device.
Nga kaiarahi e pa ana¶
- Malware, ransomware, me te mate torotoro
- Ko te kaipahua mai i nga wa o te wa, te kaipatu korero kino, me te whakakore i te kupuhipa
- Te pakaru o nga putea putea me nga whakawhitinga waea kore mana
- Identity theft response and credit recovery
- Ka kati te kaiwhakahaere kupuhipa me te whakaora ohorere
- Deepfake voice clone and AI impersonation scams
- Whaiaronga nama ohorere
Kua tirohia nga puna¶
- Federal Trade Commission (FTC) (United States): Me pehea te Tirotiro, Ape, me te Purongo i nga Whakatupato Tautoko Hangarau (Whakatupato Pahū-ake, Whakahoki Moni Moni Utu, me te Mahi tinihanga Kaari Koha).
- Cybersecurity and Infrastructure Security Agency (CISA), FBI, me NSA Joint Cybersecurity Advisory (AA23-025A) (United States): Te Tiaki i te Whakamahi Kino o te Aroturuki Mamao me te Whakahaere (RMM) Pūmanawa (ConnectWise ScreenConnect me AnyDesk Tukino).
- National Cyber Security Center (NCSC) & Mahi tinihanga (United Kingdom): * Te Whakataunga ki nga Waea Tautoko Hangarau Hupatopa me te Tango Uru Mamao Kare i Whakamana*.
- Te Pokapū Whakautu Haumarutanga Microsoft me te Haumarutanga Paerewa Apple: He Aratohu Whaimana mo nga Hangarau Tautoko tinihanga (
support.microsoft.com/security), Pūtirotiro Mata Katoa/PointerLock Tukino, me te Tango i nga Kōtaha Whirihoranga Kore Whakamana.