888-414-4284

Some fake virus warnings on a scam website with a .in domain will tell you to call this number for tech support. Do not call.

We saw this, too. India domain, fake message.

Watch out for the following Internet scam:

hxxp://www.helpsupport.in/systemadmin.html

"Microsoft Security Essential Detected An Attempt of Identity
theft or spyware bots attack on this device.
All attempts to quarantine the threats failed.
Please Contact Microsoft Administrator Live Support at
1-888-414-4284 (TOLL FREE)"

In my previous comment, a website domain name is misspelt. The actual spelling is "helpnsupport"

Had a pop up saying to call this number, cant get it closed, fellow with Indian accent saying they work for Microsoft? I asked but he wouldn't give me a company name or address to confirm with Microsoft.

I called (idiot) and eventually figured out they wanted to take over my computer and sell me a "one time fix" for adware virus for $99.99. Hung up at that point. I'm worried, though, because I let them take over my computer for a minute using some other software. Should I worry?

do not call! You're inviting some fake Microsoft support person to take over your computer. Annoying because the virus warning page will not close, so just do a system reset via: Programs>Accessories>System Tools>System Restore (to a previous date) and the bad guys go away!

Call this number as I was unable to shut down the popup that provided this number as a Microsoft support.    I did figure out it was a scam however not until I let him take over my computer to find out the virus that had took over my computer and then advised that it was going to cost me $199.99 to fix.   Called my internet software support line and they indicated that security was not damaged; still concerned that he did obtain password info....

Then you will have to change that particular password - but which password was it?
Log in to the computer itself ?

>> I let him take over my computer <<

Since the scammers accessed the computer, they probably did one or more of the following:
• Disabled the anti-virus software
• Added nasty malware to the computer
• Copied the Contact List (so they can spam/email your soon-to-be ex-friends)
• Copied any financial data or passwords they could find
• Compromised your ID
• "Zombied" the computer, so it would respond to THEIR commands sent via internet
• Deleted some important files
• Asked for money to repair the damage they caused

What can you do immediately after such an attack?
1.  Pull the cables on the computer, or otherwise disable it, so it cannot access the internet.
2.  Change ALL  passwords stored on the computer.
3.  Run FULL malware scans on the computer, in "SAFE" mode!
4.  Change the passwords again, particularly if the malware scans showed anything.
5.  Inform your bank and credit card companies.
6.  Sign up for credit monitoring, and check the status frequently
7.  You may have to bring the computer to a local repair shop, and tell them the story.
8.  Tell friends what happened, so they can be aware of strange emails from you.
9.  Connect to the internet only AFTER all the above have been done.
10.  Change the passwords on all online accounts.  Even better - access a "safe", uninfected  computer, and change your online account passwords RIGHT NOW.

NOTE:
If your computer set a "Restore Point" while it was infected, any "System Restore" you make will re-infect your computer.  Suggest you delete any potentially infected restore points and avoid setting such restore points until after your computer has been thoroughly cleaned!

You fell for one scam, and might be susceptible to others mentioned on this site:
http://phonehelp.2truth.com/facts.html
Read that info to educate and help protect yourself!

Honest computer companies do NOT cold-call people, or cause popups from websites to tell them their computers need fixing!

Some scammers even have websites, and falsely advertise they are associated with popular software packages or computer companies; so do NOT believe a "we will fix your computer remotely" site, and allow them access to your computer!

Read the info at these links.
http://news.softpedia.com/news/Cold-Call-Tech ... on-150170.shtml
http://www.consumer.ftc.gov/articles/0346-tech-support-scams

Lesson:
If your computer needs fixing, bring it to a local repair shop

Remember to return here, to 800notes.com, after you look at any of the information at the above sites, either to post more information, or to let us know you avoided the scam or fixed the computer correctly.

=== http://www.urlvoid.com/scan/helpnsupport.in/
The website is identified by 1 scanning engine, make sure to check the analysis report of the scanning engine to know why.

=== https://www.mywot.com/en/scorecard/helpnsupport.in
The site has a very poor reputation based on user ratings, but we don't know if it's suitable for children.
According to other users, this may be a fraudulent site attempting to obtain money or something else of value.

=== http://www.urlvoid.com/ip/160.153.71.129/
We have found in our database of already analyzed websites that there are 2 websites hosted in the same web server with IP address 160.153.71.129 and IP hostname ip-160-153-71-129.ip.secureserver.net. Remember that it is not good to have too many websites located in the same web server because if a website gets infected by malware, it can easily affect the online reputation of the IP address and also of all the other websites.

=== Websites hosted in 160.153.71.129 IP address:
#    Website
1     microsfthelp.com          --- notice how close the spelling is to "microsofthelp.com"
2     helpnsupport.in

=== http://whois.domaintools.com/helpnsupport.in

Email                  support@lizatechsolutions.com   is associated with ~4 domains
Registrant Org   LIZA TECH SOLUTION LLC is associated with ~2 other domains
Dates                 Created on 2015-05-04 - Expires on 2016-05-04 - Updated on 2015-05-04
IP Address         160.153.71.129 - 142 other sites hosted on this server
IP Location         United States - Arizona - Scottsdale - Godaddy.com Llc
Whois History     5 records have been archived since 2015-05-12
Whois Server      whois.inregistry.net

Whois Record ( last updated on 2015-06-28 )

Domain Name:       HELPNSUPPORT.IN
Created On:           04-May-2015 04:34:29 UTC
Last Updated On:  04-May-2015 04:34:30 UTC
Expiration Date:     04-May-2016 04:34:29 UTC
Sponsoring Registrar:GoDaddy.com, LLC (R101-AFIN)

Registrant ID:                    CR193894711
Registrant Name:              LIZA TECH SOLUTION LLC COMPANY
Registrant Organization:    LIZA TECH SOLUTION LLC
Registrant Street1:             2301 PEBBLE VALE DR 2114
Registrant City:                   PLANO
Registrant State/Province:  Texas
Registrant Postal Code:     75075
Registrant Country:            US
Registrant Phone:    +1.4693874609
Registrant Email:     support@lizatechsolution.com

Admin ID:CR193894713
Admin section : { same information as Registrant section }

Tech ID:CR193894712
Tech section : { same information as Registrant section }

© 2015 DomainTools

Registrant Name:  LIZA TECH SOLUTION LLC COMPANY
Registrant Organization:  LIZA TECH SOLUTION LLC
Registrant Street1:  2301 PEBBLE VALE DR 2114
Registrant City:    PLANO
Registrant State/Province:  Texas

Using Google Maps :

2301 PEBBLE VALE DR 2114, PLANO, TX

https://www.google.com/maps/place/2301+Pebble ... 35a8c8cb0556d88

Street View shows an apartment complex : Landmark at Collin Creek Luxuary Apartment Homes

https://www.google.com/maps/place/2301+Pebble ... 35a8c8cb0556d88

May be that's is also the fake address this scammers had put

Did fall for this fake takeover of our computers. Mainly because it says it is from Microsoft Help Desk. Made the 888 call only to talk to someone obviously from India or Pakistan. They wanted me to allow them to have access to my computer and then tell me that it was going to cost to have them remove spyware. Big red flag! My question is, how did they have access to my computer and freeze up my screen in order to make me believe there was a real problem?

This people usually takes the help of Google and Bing adverstisement , they run some kind of adds on famous website like you tube Facebook an all , so once we visited or try to visit the website we get this thing , this is not a virus they just using jquerry language as i can see being a web developer , to get rid of this problem you just need to shut-down the computer and turn it back on, this will definitely fix you problems.

Is this how all web developers spell? Exactly where did you get your education? Good ol' "Scam U."? A full page of 'it's a scam' comments & then along you come. Not going to work.

I got the pop up saying to call. I did not. But do I still need to worry about anything on my computer since that popped up? Am I still safe or need to take action?

Yes. I would. Using Task Manager see if there are programs/functions running that you do not recognize. Write them down and do an internet search on each. Same thing using MSCONFIG, see both what starts up and what services run. Note them and check out anything you do not recognize via a search engine. For worrisome programs, kill them in Task Manager, uncheck them in MSCONFIG, disable them in "SERVICES."  If you do not know how to do this, do an internet search on procedures. Consider deleting/uninstalling suspect programs. Also, download a copy of Malawarebytes and run it. Unfortunately, not all malware is so "easily" removed because it hides in the registry, but this is a start.

Thank you for all this.

You are safe