Home Malware Programs Trojans Fake Windows Activation Screen

Fake Windows Activation Screen

Posted: May 19, 2010

Fake Windows Activation Screen is a Trojan infection that pretends to be a Windows Activation program. Once infected, users will receive a screen simulating Microsoft Windows Activation which will state that Windows needs to be reactivated. The program will also ask users to enter their name, contact information and credit card details. Revealing credit card information is a huge mistake as users will end up losing money. The Trojan will not give up until the private data is revealed. As soon as users give access to bank accounts the credit card will be charged. Remove this badware from the system immediately using reliable anitspyware software.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Application Data\mtl.dll
    2 C:\WINDOWS\system32\.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\HKEY_CURRENT_USER\Software\AntiPiracyHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""

Additional Information on Fake Windows Activation Screen

  • The following messages's were detected:
    # Message
    1 "Microsoft Windows Activation
    Microsoft Piracy Control

    Your copy of Windows was activated by another user. To help reduce software piracy, please re-activate your copy of Windows now. We will ask for your billing details, but your credit card will NOT be charged. You must activate Windows before you can continue to use it. Microsoft is committed to your privacy. For more information, www.microsoft.com/privacy.

    Do you want to activate Windows now?"

Loading...