Home Malware Programs Ransomware ‘Attention! For security reasons Windows has been blocked’ Fake Alert

‘Attention! For security reasons Windows has been blocked’ Fake Alert

Posted: April 9, 2012

Attention For security reasons Fake Alert Screenshot 1The 'Attention! For security reasons, Windows has been blocked' fake alert is a fraudulent pop-up warning that's used by ransomware Trojans to bully you into throwing money away on fake security software. Although an 'Attention! For security reasons, Windows has been blocked' fake alert uses logos from reputable PC security brands to seem respectable, SpywareRemove.com malware researchers warn that 'Attention! For security reasons, Windows has been blocked' fake alert pop-ups aren't affiliated with Kaspersky, Microsoft or any of the other type of legitimate PC security company. 'Attention! For security reasons, Windows has been blocked' fake alerts also threaten that an overall deletion of your files is imminent, but this threat is as hollow as an 'Attention! For security reasons, Windows has been blocked' fake alert's brand legitimacy, and any threats from 'Attention! For security reasons, Windows has been blocked' fake alert-related Trojans should be ignored. Although additional steps may be needed before you can completely remove a ransomware Trojan that's responsible for causing 'Attention! For security reasons, Windows has been blocked' fake alerts, sufficiently competent anti-malware programs are perfectly capable of deleting 'Attention! For security reasons, Windows has been blocked' fake alert-related PC threats without any difficulties.

What You Really Should Pay Attention to During a 'Attention! For security reasons, Windows has been blocked' Fake Alert

'Attention! For security reasons, Windows has been blocked' fake alert pop-ups are symptoms of infection by Trojans that are designed to promote fake security programs and gain access to your money and related financial information. Since an 'Attention! For security reasons, Windows has been blocked' fake alert will appear only after your PC has been compromised, SpywareRemove.com malware research team suggests scanning your computer as soon as possible after any evidence of an 'Attention! For security reasons, Windows has been blocked' fake alert. Ransomware Trojans that promote 'Attention! For security reasons, Windows has been blocked' fake alert may also be installed with other PC threats or use additional attacks that put the privacy and security of your computer in danger, and, as such, should always be removed by a comprehensive system scan from suitable software.

Although an 'Attention! For security reasons, Windows has been blocked' fake alert will try to present itself in the form of a seemingly legitimate warning message, there are several telltale signs of its fraudulent nature – in particular, SpywareRemove.com malware experts advise against purchasing any software that's promoted by warning messages that harm your PC, including harm caused by blocking other programs (such as anti-virus scanners and Windows diagnostic tools). Additionally, the version of the 'Attention! For security reasons, Windows has been blocked' fake alert that's being distributed currently also contains minor grammar errors as clues to its real nature, as can be seen in this sample of its warning below:

Attention!
For security reasons, Windows has been blocked
The reason may be visiting pornographic websites and malware.
The computer system is in critical condition, because of this system can lose all your documents and files to prevent this, you will need to download additional updates to the system of security.

What You Can Do to Close 'Attention! For security reasons, Windows has been blocked' Fake Alert for Good

Although the 'Attention! For security reasons, Windows has been blocked' fake alert claims that your files are close to being wiped from your hard drive, SpywareRemove.com malware researchers have found this to be an empty threat, and discourage any attempt to pay credence to an 'Attention! For security reasons, Windows has been blocked' fake alert's blustering. However, since ransomware Trojans that use 'Attention! For security reasons, Windows has been blocked' fake alerts may also block you from using security programs that are needed to disinfect your PC, you may need to use one of several basic PC security methods to disable the Trojan and 'Attention! For security reasons, Windows has been blocked' fake alert before you can go about your business. Strategies that SpywareRemove.com malware analysts have found success with include:

  • If applicable, booting Windows into Safe Mode, which can disable primitive PC threats. This mode is accessible by tapping F8 while your PC boots.
  • Loading an operating system from a remote location (such as a removable drive device or a locally networked drive).
  • Loading a second (and hopefully uninfected) operating system that's also installed on the same hard drive.

Once the Trojan that's responsible for your 'Attention! For security reasons, Windows has been blocked' fake alert problem is disabled, any good security scanner should be able to remove 'Attention! For security reasons, Windows has been blocked' fake alert effortlessly.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AllUsersProfile%\Application Data\~ File name: %AllUsersProfile%\Application Data\~
%AllUsersProfile%\Application Data\~r File name: %AllUsersProfile%\Application Data\~r
%AllUsersProfile%\Application Data\.dll File name: %AllUsersProfile%\Application Data\.dll
File type: Dynamic link library
Mime Type: unknown/dll
%AllUsersProfile%\Application Data\ File name: %AllUsersProfile%\Application Data\
%AllUsersProfile%\Application Data\.exe File name: %AllUsersProfile%\Application Data\.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s's:/ogn:/uyu:/dyd:/c'u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/'wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v'w:/rbs:'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'yes'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = 0'HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
Loading...