Crss.exe file

Question

Level 1

8 points

Crss.exe file

I called yahoo yesterday about an unresolved email issue with AT&T , gave them access to my computer...I am blind..and they informed me that a foreign address was hacking my computer through a crss.exe file. I was advised that their hacker team could remove it but that I had to purchase a network security shield first at a cost of $199+ or - depending on the package. I didn't purchase it but am very concerned about being hacked and having a virus. I had my keychain open at the time trying to discover how many passwords may have been confusing my ability to access my Mac mail and am worried that they were able to do even more damage. The yahoo tech had remote control of my computer. Pleas assist. My iMac is out of warrantee..bought in 09 and runs on lion . Thanks Valerie

Pages-OTHER, OS X Mountain Lion (10.8.2)

Posted on Jul 17, 2013 4:47 AM

Reply

Answer 1

MartinR

Level 6

19,061 points

Jul 17, 2013 5:56 AM in response to valerie141

crss.exe is a Windows system executable. It's part of Windows. And it is often the target of hackers. However, it will NOT run on a Mac unless you also have Windows installed and running. If you don't have Windows installed there is no way a hacker could use or replace crss.exe on your Mac.

"Yahoo network security shield" is longstanding fake security software; it will infest & ultimately damage your computer. No real Yahoo Customer Support Representative would suggest it - are you absolutely sure you were talking with someone at Yahoo?

If you truly have worries about your Mac, find a local, trustworthy computer support shop or person to help you.

Reply

Answer 2

andyBall_uk

Level 7

20,516 points

Jul 17, 2013 6:04 AM in response to valerie141

I'd post the number that you called so others can validate it... the advice you were given sounds dubious at best.

Reply

Answer 3

valerie141 Author

Level 1

8 points

Jul 17, 2013 6:21 AM in response to valerie141

First of all, thank you both for your prompt replies. The number I called was posted on the Yahoo site as technical support and was 855-7847428. I got a representative named "Nick". I have a little sight in the upper right quadrant of my right eye and he had remote access and was doing a scan on my computer. He showed me with the mouse that a crss.exe file was on my computer and that a foreign address was using it to hack into my system. I didn't buy the program, as I said and I do not have windows on my MAC. I wouldn't even know how to put windows on a mac. I'm a new mac user and don't have the understanding of the OS to be able to do that. I will post the number I called in the subject box of another question so that others are alerted to it. What should I do now? I do have an appointment with an Apple store at 2:30 this afternoon. This entire episode has scared the **** out of me.

Reply

Answer 4

andyBall_uk

Level 7

20,516 points

Jul 17, 2013 6:48 AM in response to valerie141

It's not Yahoo, perhaps an advertisement at yahoo's website? : http://www.help-technical.com/

Tell Apple what happened & see if they can check logs etc for added software, & change your passwords. Probably... they were just pretending to do things, in order to get your $200, but better safe.

Reply

Answer 5

valerie141 Author

Level 1

8 points

Jul 17, 2013 7:12 AM in response to valerie141

The number I gave you that I called for Yahoo Tech support was the number the tech gave to me. The number that I called was 855-554-4433. I know that the "This solved my question" was checked but I never noticed it until now. I still don't know what to do with regard to this issue besides see the APPLE store this afternoon. It doesn't answer my questions now as to what could have occurred yesterday. Was I scammed? Did they get into my computer and do something to it when I gave them remote access? Could they have hacked into it at that time? All these questions are disturbing me for obvious reasons. All the passwords, etc. could have been accessed through the keychain which WAS open. Any other reassurances or instructions as to what to do would be so helpful. Thanks, Valerie Also: Is there a history that I can access to see what he did?

Reply

Answer 6

valerie141 Author

Level 1

8 points

Jul 17, 2013 7:29 AM in response to valerie141

I called the number back this morning and was told that the trojan was a CSRSS.exe not the crss that I reported. Does this make a difference? Thanks Valerie

Reply

Answer 7

andyBall_uk

Level 7

20,516 points

Jul 17, 2013 7:54 AM in response to valerie141

Neither number is for the company 'yahoo' .

I think that they tried to scam you, and probably (hopefully) did no more than pretend to scan & inspect your computer. However, if you really gave them admin remote control, then anything's possible, and they could have altered logs etc to hide what was done.

The exact name they gave doesn't matter - it was untrue in any case & just a ruse to ask for money.

Reply

Answer 8

andyBall_uk

Level 7

20,516 points

Jul 17, 2013 8:00 AM in response to andyBall_uk

The second number is for http://emailhelponline.com/email-support/

also known as 'tech us online' & likely by other names too.

Reply

Answer 9

thomas_r.

Level 7

31,989 points

Jul 17, 2013 12:38 PM in response to valerie141

If you paid this company any money, you have been scammed. They are not Yahoo, as has been pointed out by others. They are offering you solutions that don't apply to a Mac, to problems that don't exist on a Mac. Do not call them again, and if you paid them anything, you should contact your credit card company immediately to report the charge as a scam and have it disputed.

As for your computer... I'd like to be able to say all is well, but if they actually got remote access somehow, they could have installed God knows what behind your back. Fortunately, there are some significant questions in my mind as to whether they actually had access, or just tricked you into thinking they did so they could sell you bogus software and bogus support. How did you give them access? Did they have you install something? What did you have to do to give them access?

For more information about this sort of thing, see:

Beware of fake tech support

(That link goes to my web site. Please let me know if there are any accessibility issues with it. I've never had any comments on it from a blind person, and would like to make sure that it is entirely usable for you, and others with vision problems.)

Reply