Norton total security 2016 free trial windows#

The payment portal shows that they are Silurian Tech Support.Ī cursory background review of this company revealed some startling details including the fact that they were an official member of the Symantec Partner Program:

A one year warranty with Norton for $249.Īt this point we still don’t know who this company is and the only information we have is their toll free number from the fake warning page.

A one time fix and installation of Norton for $199.

A couple of different support plans are offered: Having finished the diagnostic in a record 5 minutes, the technician proceeds to the sales part of his script.

That’s all the scammer really needs to make his point, without even scanning or checking whether the process in question is the real one or a piece of malware. Googling for csrss.exe returns several pages that promote registry scanners to look for errors associated with that file name, as well as descriptions labeling this process as a Trojan.

Norton total security 2016 free trial windows#

This file is a core Windows program but as is often the case, malware authors often rename their samples to look like a legit file and use the same naming conventions. This time he opened up the TaskManager and pointed out a particular process called csrss.exe. Not satisfied with this, the technician figured he could pull another well-known trick to seal the deal. Of course, for a scammer it’s the perfect way of claiming those are infections or viruses. Sadly, Microsoft’s central log and error reporting tool can all too easily be leveraged thanks to those yellow and red warnings, which the majority of the time are perfectly normal. Once the technician was logged in, he wasted no time in going for the most infamous trick used by tech support scammers, the Windows EventViewer. With remote access, scammers can literally do whatever they want on the user’s machine including stealing documents to installing (real) malware. This process is a core part of the scam because it allows crooks to tighten their hold on potential victims. (Note: we strongly advise to never let anyone or any company you do not feel comfortable about, get remote access to your computer.) We were instructed to go to to allow the technician to take remote control of our computer, therefore enabling him to perform a diagnostic. Our expectations were not very high but we were not prepared for what we would eventually find out. We decided to call the toll-free line to see what kind of support we may get. Of course this screen is completely fake, but combined with an alarming audio message playing in the background, it may be enough to dupe some users. If you are not able to click on this button, Immediately contact Support toll Free Helpline 1-85” The alert message is displayed via a web page hosted on /norton and urges users to call for support immediately saying: “System Critically Infected. In one of the worst cases of abuse we have seen so far, a company that happens to be an active member of the Symantec Partner Program is scamming people with fake warnings designed to look like Symantec’s flagship product, Norton Antivirus. Security vendors may not be aware of these practices let alone what kind of sales pitch scammers use to force those sales. In many cases, these crooks sell free security products (or straight up pirate them) for hundreds of dollars more than their actual retail price. Fraudulent tech support companies are well-known for taking advantage of unsavvy computer users by reeling them in with scare tactics and charging large amounts of money for bogus services.