I'm currently working for Geek Squad at Best Buy in the front of the operation checking in client computers and I am frequently encountering bogus tech support scams which involves copious amounts of remote access software and who knows what else to gain complete access to the devices. In some instances the attackers cause data loss or disable the computers when the users don't pay for their "services".
My question is about how this happens because it's often very similar and it makes me wonder if these are connected organizations or there is some sort of script they go by when breaching someone's system. Often, there is text written in the Windows taskbar with something like "Tech Support 24/7: 1-800-555-5555" and even including the name of their "technician".
I've seen everything from VPNs installed, to VLC, and other software that somehow gets installed but doesn't appear to be malware and instead is legitimate business or enterprise software. How do they do this? Is there an initial infection with malware that they then use to install remote software, or is it that they somehow dupe these people to install these programs themselves thus not setting off any alarms with an antivirus?
From what I can tell, we will usually "clean" and remove the software, but to me, that seems like something I wouldn't be comfortable or satisfied with, and if it were my device, I would definitely opt for a complete wipe of the OS. Am I overreacting here about going nuclear with the response?
Oh, I would like to know how they make the label in the taskbar if anyone could explain that.