Fake Windows Activation screen. How to remove? (Uninstall guide)

removal by Alice Woods - - | Type: Malware
12

Fake Windows Activation virus

Fake Windows Activation virus is a Trojan horse that locks up the computer and insists that you are using a pirated version of Windows operating system which needs to be re-activated for anti-piracy reasons. The virus initiates a lockscreen on which it displays a system message, encouraging the user to activate Windows in the next 24 hours. Otherwise, you will be banned from using most of the Windows OS features. Do not panic or overturn your drawers looking for the Windows license key. This notification you have just received is fake and designed by the online scammers to generate illegal profit. Even if you find and submit a legitimate activation key, it will not be accepted, and you will receive another delusive message saying that:

Windows Helper is unable To Activate Windows
Contact Support To Activate.

You will also hear a spoken record of the same message every time you click on your computer screen. It is obvious – you are dealing with tech support scam here, and you need to remove Fake Windows Activation virus from your computer as soon as possible. But first, you have to solve the lockscreen problem. With your screen locked, you won’t be able to initiate the system scan which means that the virus will remain on your computer. Luckily, it has been found that entering “closecloseclosecloseclose” into the activation box can help eliminate the screen lock. The first thing you should do after regaining access to your browser is scan your computer for Fake Windows Activation malware using Reimage or other virus-fighting utilities.

Fake Windows Activation virus screenshot

Apart from the spoken message, this virus also displays a fraudulent phone number (1-888-479-3649) by which you can contact the supposed tech support and receive the instructions for Windows activation. You should know that this number will not connect you with the real Windows support. You are simply going to call the cyber-criminals, who will try to convince you that your old license key is expired and that you must purchase a new one for a considerable sum of $99.99 USD. In reality, there is no problem with your Windows and the key the scammers are trying to sell you is most likely non-existent. Be a security-minded person and if they ask you to reveal any personal details, banking information, or other sensitive information, don’t! To fix this problem, you must scan your computer with a reputable malware removal program and delete this virus from your system. We recommend using professional anti-malware software acknowledged by users worldwide.

How can you avoid becoming a victim of a tech-support scam?

Deceptive programs can be installed in various ways. Most of the time it happens due to negligence and failure to comply with the safe browsing rules. To avoid installing malicious programs, you should:

  • Never browse through high-risk websites. Do not try to access websites that your anti-virus program or the Google SafeSearch filter blocks;
  • Avoid clicking on suspicious banners or pop-up ads that intrusively show up on your screen;
  • Do not accept to install programs from websites that you accidentally end up on. If you notice that sometimes you are forced to visit websites that you did not intend to open, you should check your system with a reliable anti-spyware to see whether you do not have any suspicious apps installed on your system (e.g., browser redirect viruses).
  • Install ANY software ONLY using Advanced or Custom installation mode. You must perform this security check because the program that you wish to install MIGHT be corrupted and have suspicious optional apps attached to it. You can always refuse to install such additions by deselecting agreements to install “recommended downloads” or “suggested software.”
  • Never open e-mails from unknown senders, ever! Malware is mostly distributed via malicious emails, so that is the reason you should never open such letters AND files that might be attached to them!
    To find out how to remove this malware from your computer, continue reading the article.

How can you escape the Fake Windows Activation screen?

In order to eliminate this malware from your computer, you will have to shut your computer down and restart it in the Safe Mode with Networking and download an automatic tool to remove Fake Windows Activation virus from the system. If you have one already, you can skip straight to the virus elimination by running a system scan with it. It will detect and delete all malicious files on your PC. Just make sure it is updated to the newest version. Below you will find some recommendations how to eliminate the lockscreen before continuing to the Fake Windows Activation removal. If you encounter any problems while dealing with this Trojan, do not hesitate and contact us.

do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Fake Windows Activation screen you agree to our privacy policy and agreement of use.
Reimage is recommended to uninstall Fake Windows Activation screen. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Alternate Software
Plumbytes Anti-Malware
We have tested Plumbytes Anti-Malware's efficiency in removing Fake Windows Activation screen (2016-08-11)
Malwarebytes Anti Malware
We have tested Malwarebytes Anti Malware's efficiency in removing Fake Windows Activation screen (2016-08-11)
Hitman Pro
We have tested Hitman Pro's efficiency in removing Fake Windows Activation screen (2016-08-11)
Webroot SecureAnywhere AntiVirus
We have tested Webroot SecureAnywhere AntiVirus's efficiency in removing Fake Windows Activation screen (2016-08-11)

Fake Windows Activation screen manual removal:

Kill processes:
[random].exe

Delete registry values:
HKEY_CURRENT_USERSoftwareAntiPiracy

HKEY_CURRENT_USERSoftware

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = "1"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ""

Unregister DLLs:
mtl.dll

Delete files:
[random].exe

mtl.dll

Manual Fake Windows Activation screen Removal Guide:

Remove Fake Windows Activation screen using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

NOTE: To remove the lockscreen and access your desktop try entering “closecloseclosecloseclose” into the Windows verification code box. In case this method works, locate your antivirus utility immediately and run a full system scan of your device. Nevertheless, if the lockscreen still appears after the next reboot, follow the steps provided below.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Fake Windows Activation screen

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Fake Windows Activation screen removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Fake Windows Activation screen using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

You may try eliminating the lockscreen by pressing CTRL+ALT+DEL, locating the Productkeyupdate.exe process in the Task Manager and terminating it manually. After completing this task, scan your computer with Reimage without delay.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Fake Windows Activation screen. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Fake Windows Activation screen removal is performed successfully.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Fake Windows Activation screen and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Alice Woods
Alice Woods - Likes to teach users about virus prevention

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

More information about the author

Removal guides in other languages


  • Guest

    thank u for the info

  • noe

    freakiing virus app i am so glad i didnt call tha number

    • 8251

      I CALLED IT. A suspicious person asked me to pay money to a particular bank account. FAKE! Do not call the number. ITs a scam! Contact real windows support via their website if u have any probz

  • B055y

    its so easy to confuse this with real system alert! whats the difference between them??

  • mozammel anowar

    just download Windows 7 loader from 4shared.com
    there is an option install click it
    restart your computer and it will automatically active it