Beware of Hicurdismos: It’s a fake Microsoft Security Essentials installer that can lead to a support call scam

[+Warwagon MVC]

 

Quote

 

Wouldn’t it be a shame if, in trying to secure your PC, you inadvertently install malware and run the risk of being scammed?

 

We recently discovered a threat detected as SupportScam:MSIL/Hicurdismos.A that pretends to be a Microsoft Security Essentials installer. Microsoft Security Essentials is our antimalware product for Windows 7 and earlier. In Windows 10 and Windows 8, Windows Defender provides antimalware protection and is installed and enabled by default when Windows is installed. However, some users may believe they also need to download and install Microsoft Security Essentials.

 

Hicurdismos uses a fake Windows error message (sometimes called a “blue screen of death”, or BSoD) to launch a technical support scam. A real BSoD is a fatal error in which the screen turns blue and the computer crashes. Recovery from a BSoD error typically requires the user to reboot the computer.

 

The fake BSoD screen includes a note to contact technical support. Calling the indicated support number will not fix the BSoD, but may lead to users being encouraged to download more malware under the guise of support tools or software that is supposed to fix a problem that doesn’t exist.

 

Interestingly, the fake BSoD screen used by Hicurdismos mimics an error message used in Windows 8 and Windows 10, so users of these new Windows versions could also be at risk of being tricked by Hicurdismos.

 

 

 

 

 

http://www.zdnet.com/article/microsoft-beware-this-fake-windows-bsod-from-tech-support-scammers-malware/

 

 

[+Zagadka Subscriber²]

I've had three support calls about these types of phishing attempts. They can be really hard to get out of unless you know exactly what you're doing. Best thing to do is to let people know not to call in anywhere and use task manager to verify what warnings are from.

[+Warwagon MVC]

2 minutes ago, Zagadka said:

I've had three support calls about these types of phishing attempts. They can be really hard to get out of unless you know exactly what you're doing. Best thing to do is to let people know not to call in anywhere and use task manager to verify what warnings are from.

 

 

 

 

This disables the Task manager according to the article. Typically on a fake popup, simply restarting the computer gets rid it. But this seems to be tied to a fake security essentials download. So I think in this case, it would come back after a restart because it would be running on startup and actively running in memory.