What is Hallmark eCard Tech Support Scam

Tech support scam is one of the most widespread types of viruses. Actually, it’s not even a virus, because the part that enters user’s PC is very small and weak. Such scams are very popular among web-criminals, because they don’t need deep knowledge of programming, or large sum of money to start.

Hallmark eCard Tech Support Scam has all signs of typical tech-support scam, and acts similar. It enters the PC through bundled installation method with free software, with e-mail spam or via infected websites. The virus enters a PC in form of a Trojan that needs to be executed by user. When first executed, Trojan shows to user a big print of a Hallmark eCard, that covers the whole screen. The title says that the card is expired. This doesn’t make any sense, and this banner has only one purpose: to hide the installation of a scam virus that proceeds on a background.

After the installation, the virus sets the scheduled task to run on startup when the PC will be rebooted next time. When user turns the PC on, he sees a message, stating that Windows OS encountered a critical error, and he must call the (855) 518-8366 number to fix it. The banner with this message covers the screen and prevents victim to use any shortcuts on the desktop or on the task panel.

The picture says that the number is toll-free, and that’s the first lie. If you call that number, you will pay for every minute of conversation, and you will pay a lot. The operators are trained to respond slowly, and they will try to make the conversation as long as possible. Of course, there are no critical failures in your Windows, but the scammers will try to convince you that there is a failure, and they have software to fix it. By the way they ask the victims to give them a program code and a serial number of the currently installed version of Windows, and a number of credit card, to obtain a payment for their “useful” services. This scam can be extremely profitable if the victim is trustful enough to give the private information to third persons. If you see the “Hallmark eCard is expired” banner on your screen, or if there appeared a message that asks you to call some number – you should never do that. The Windows (and any other) tech-support doesn’t work this way.

How to get rid of Hallmark eCard Tech Support Scam

The first and the easiest method is to use the secret password of this program. The password is 642358497351, and it should be entered in “response code” box. This method may not work, because the password may be easily changed, but you should try it. The password (if it works) will immediately terminate the viral process and unlock the screen, so the victim will be able to run the AV software to remove the scam completely. Under this paragraph you will find detailed instruction on manual removal of Hallmark eCard Tech Support Scam, and the link to the reputable antivirus program.

Step 1. Boot into Safe mode

Safe mode

Start -> Msconfig.exe

Safe mode. Step 1

On the tab Boot select Safe boot

Safe mode. Step 2

Step 2. Check Startup folder

Start -> Msconfig.exe ->Disable unknown programs in the Startup tab


Step 3. Check hosts file

Modify hosts file, that located in C:\Windows\System32\drivers\etc\ .

Hosts file.Step 1

Open the file with Notepad and delete suspicious strings.

Hosts file.Step 2

It has to look like this:

Hosts file.Step 3

Step 4. Scan the system with antiviral scanner


Antivirus scanner

Why we recommend SpyHunter antimalware

Detects viruses fully: all files and even registry keys of malware will be found

Protects your system in the future

24/7 free support team

SpyHunter's scanner is only for malware detection. If program detects virus on the computer, you will need to purchase SpyHunter's malware removal tool to delete viruses. Uninstall steps and additional information EULA , Privacy Policy and Threat Assessment Criteria.

bwd  Instructions 1/2  fwd

Step 5. Disable Safe mode

Start -> Msconfig.exe ->Disable Safe boot in the Boot tab

Deactivate Safe mode

Add comment

Security code

This website uses cookies to improve your experience. If you continue using the site, we will assume that you accept our cookies policy.