'Microsoft Windows a détecté des activités suspectes sur cet ordinateur' Technical Support Scam

The 'Microsoft Windows a détecté des activités suspectes sur cet ordinateur' Technical Support Scam is executed with the help of a screenlocker which might be spread as pirated software, fake software update, illegal media, game cracks, or CD key generator. When this malicious file is executed on an unprotected computer, it may display a new overlay window which will prevent the user from accessing other applications, as well as automatically disable the registry editor, command prompt, and task manager. The lock screen contains a message written in French which warns the potential victim that Windows has detected suspicious activity,

The message continues by telling the victim that they need to contact a Microsoft representative in order to receive an unlock code that will remove the overlay window, and restore Windows’ normal functionality. However, the message tells the victim to contact 33 970 449 279, and a quick web search reveals that this phone number is not linked to the Microsoft corporation. Instead, it is part of various online scams whose aim is to steal money and personal information from the victims.

The good news is that the con artists behind this scam have not coded a good screenlocker and the password used to restore access is hardcoded in the application. In fact, the authors have included three compatible passwords - mmmmm, g6r-qrp6-h2, or yt-mq-6w. Keep in mind that once you use one of these to unblock your PC, you should also make sure to run an anti-malware tool in order to fully dispose of the malicious program.