Fake Blue Screen of Death faux-freezes your system like the real McCoy

Thanks to Andrew O’Donnell of SophosLabs for his behind-the-scenes work on this article.

There’s a new fake support scam in town, hiding behind a file calling itself Microsoft Security Essentials, and it’s trying to trick victims into contacting bogus help centers.

The malware, known to Sophos as Troj/Diztakun-A (Microsoft calls it Hircurdismos), is strangely reminiscent of what many readers will know as lockscreen ransomware from back in 2012.

Lockscreen ransomware froze your computer with a web page that tried to squeeze you into paying a “fine”, often for alleged copyright infringement or porn-viewing “offences”, after which the lock screen would be removed.

Malware of this sort, such as the once-widespread Reveton, did its best to stop you switching away from the lockscreen, so that you couldn’t hack your way out of trouble using system tools such as Task Manager.

With Diztakun, the principle is similar but the outcomes are different.

Diztakun locks you up at a fake Blue Screen of Death (BSoD) screen, but instead of demanding payment via a web page, it kindly suggests that you might want to call for technical support, handily providing a toll free number to call.



These days, BSoDs are thankfully much rarer than they were, and usually vanish quickly of their own accord when your computer reboots automatically, but that’s not what happens with Diztakun.

The malware does the following so that you’ll think your system is truly locked up:

• Shows a frozen mouse cursor.
• Disables Task Manager to stop you from terminating the process.
• Fills the screen with the fake BSoD image.

Who’s at risk?
Microsoft Security Essentials is Microsoft’s anti-malware component for Windows 7 and earlier.

In Windows 8.1 and Windows, 10, you get Windows Defender instead; some users might not be aware of that, and assume that by installing a utility called Security Essentials, they’d be increasing their security rather than infecting themselves.

Whatever you do, if you see the fake BSoD above, don’t call the number! That won’t fix anything.

Instead, you’ll end up connected to a fake support call scammer, and your troubles will only get worse.

What to do?
When you need help with your computer, turn to someone you know, like and trust.

In this case, when we say “someone you know,” we mean “someone you’ve actually met in person,” as opposed to just online.

On Windows 10, Windows Defender is built in, so there’s no need to install Microsoft Security Essentials.

Tech support scams aren’t going away anytime soon, so keep an eye out for those that mimic real Windows messages.

And remember that old-school scams, where the crooks cold-call you instead of waiting for you to contact them, aren’t going away anytime soon, either.

Source: Sophos