McAfee subscription dodginess

bazzabear

bazzabear

bazzabear

Soldato
Joined
2 Nov 2013
Posts
4,280
Trying to help my M-I-L here, who I'm pretty certain has been the victim of a phishing attempt.

She bought a McAfee subscription from Amazon which gives a code you have to activate on McAfee's site. When trying to do so (and she says that she didn't click a link on the email - she searched for mcafee activate on google and accessed from there) she gets an error message "mca361p" saying the key was redeemed successfully, but setup couldn't start. The page had online chat help, which she accessed.

She then gets told by the helpdesk person that she has a trojan and has visited 3 porn sites - this is all before he'd even accessed her computer. Tries to convince her to buy some anti-hacker software for £300 a year. He's 'locked the security on her computer' and she needs to take immediate action. She refused to, so he provided his email address - which is just a gmail address, not Mcafee related - for her to contact him.

I ask whether he ever accessed her computer, and he tried to later in the call, but she says she thinks it hadn't worked by the time she stopped the whole thing because her computer / internet are slow as anything anyway.

Trying again later to access Mcafee website and use the activation code, it seems to say it has already been redeemed - but seems to be to this guys email address, not her own.

So, I'm pretty certain this guy was dodgy as sin. But I'm not quite sure how the scam has been perpetrated, given it seems certain she went to the genuine McAfee site.

I'm now trying to get into her computer to see what I can do in terms if getting it working. But I'm wondering whether he did get into it and has locked it up - because I know she said it was running slowly, but I couldn't even get the network options up to connect to my wifi. When I tried to run task manager it took 2 minutes and then told me that HP assist couldn't run because it was already running under another user. Couldn't get anything working after that. Have tried a hard reboot, but for the last many minutes just have a black screen with a rotating 'loading' icon.

So, after that essay - any suggestion or advice? of course, if I can't even get the thing to start, there's not a lot I can do!
 
I've at least got the thing running now. Incredible slowness starting up was because windows updates were running. Task manager works now. Going to try getting ccleaner and malwarebytes on there see if they find anything.
 
My latest theory is that the purchased key was fine, but the link she clicked having googled 'Mcafee activate' was where the dodginess lay.

It seems to me that they have a fake activation site which tells you it's failed so you use their online chat - they then get the key details from you and activate it themselves at the real site (hence it being activated to his email address) and install it on your computer using Anydesk.

Whether their endgame is purely getting you to pay them the additional subscription price, or they also take the opportunity to install keyloggers or similar I don't know.

Her computer running so outregeously slowly actually saved her I think. Stopped him achieving anything before she got suspicious and shut the call down.

I have run malwarebytes. Found three problem items - but they looked like just the usual slightly dodgy cookies.

Running Reason now, partly as a double check, but mostly to get at their "Should I remove it" utility.

Then ccleaner to check for anything in the registry, and I'll be satisfied.

I know you're all correct that it'd be better to do a clean install. But without any of the background information (like product key) , and with it not being mine I'm going to avoid it if possible.

Thanks to all for the thoughts and advice.

Disk performance is showing 100% use at the moment - but it is mid-scan. :)
I'm not sure what I should look for to indicate it's on it's way out. Any suggestions?
 
To add - the issue with the dodgy activate link is that if you google Mcafee activate, you get 5 or 6 links towards the top of your results, all of which look like they are legitimate. Presumably one of them is, but not all.

She has agreed with me to go down the route of just uninstalling Mcafee altogether. I don't rate it anyway.
 
You must log in or register to reply here.
Back
Top Bottom