MoboPlay virus. How to remove? (Uninstall guide)

removal by Lucia Danes - - | Type: Malware
12

How to recognize MoboPlay Tech Support Scam

Tech Support Scams are one of this year’s fastest growing cyber threats and MoboPlay virus is one of the newest addition to this virus family [1]. Thus, we think it would be useful to discuss this particular virus in more detail and raise awareness about such viruses among the Internet community. The initial thing we should point out is that technical support scams do not travel as individual viruses but are rather brought by other potentially unwanted programs [2]. We elaborate more on the virus distribution and infiltration issues later in the article. As for now, you may continue reading this article and find out about the working principles of this virus or skip straight to the last paragraph to find out about MoboPlay removal options. If you have tried manual elimination already and it did not bring any good results, you should not hesitate to employ professional malware removal utilities such as Reimage and remove the virus from your computer automatically.

image of mogoplay tech support scam virus

To classify MoboPlay to a more particular group of tech support viruses, we should note that it is a Microsoft support scam, similar to “Windows has detected some suspicious activity from your IP address” virus. This means that such infection is especially targeted at Windows OS users [3]. Imitating representatives from Microsoft, the hackers try to scare people into thinking their computers are in a critical state with the following message:

Microsoft has detected some suspicious activity on this computer. All access to this device has been revoked due to a network security breach. Attackers might attempt to steal personal information, banking details, emails, passwords and other files on this system.
Please contact a Microsoft certified technician on
1-800-603-5246

To make the message more believable, the scammers display it in a lock screen [4] which actually obstructs the user from accessing the data on their computers, creating an impression of a blocked device. From an empty box and the “Activate Now” button we can presume that the users are required a Windows License key in order to get back the access to their account. Nevertheless, none of the legitimate keys will work and another alert urging to purchase a new key will pop up. The trick here is that your Windows license key is not actually expired and the scammers simply want you to pay for a fake product. Since no computer files can be accessed while this lock screen is active, this virus surely deserves a name of a ransomware-like infection [5]. Luckily, unlike with most of the actual ransomware, you can remove MoboPlay and access your personal files again. To do that, look at the recommendations below.

How do tech support scam viruses infect computers?

As we have already stated previously, tech support scams travel as potentially unwanted programs and use various techniques to infect computers. Perhaps one of the most widespread ways the infiltration is achieved is with the use of deceptive software bundling. For instance, the hackers may take a random application, for instance, MoboPlay, and bind it together with potentially unwanted program such as our discussed tech support virus. While the users think they are installing a regular application management program, the virus can easily slither inside the system and start its malicious activity on it. Advanced software installation is one way to prevent undesirable programs from entering your computer. Just pick “Custom” or “Advanced” installation modes when setting up new software on your computer and pick out potentially unwanted applications manually.

How to remove MoboPlay lock screen virus and get back the access to your computer?

MoboPlay virus is an infection that is not that easy to remove. The infected computer users might need to go through several steps of elimination, first having to go past the lock screen and only then moving on to MoboPlay removal. Luckily, below this article, you will find quick instructions which should help you terminate the lock screen. After you overcome this obstacle, you should then remove MoboPlay from your computer using specialized malware removal tools.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove MoboPlay virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall MoboPlay virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

Manual MoboPlay virus Removal Guide:

Remove MoboPlay using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

To remove the lock screen enter 8716098676542789 key in the box next to the “Activate Now” button. Once the lock screen is gone, proceed to the MoboPlay removal immediately. 

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove MoboPlay

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete MoboPlay removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove MoboPlay using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

If you cannot remove MoboPlay using the key given in the Method 1, you may also try to access Windows Task Manager and terminate the lock screen process there. You will recognize the malicious process from a high CPU utilization and unusual process name.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of MoboPlay. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that MoboPlay removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove MoboPlay from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by MoboPlay, you can use several methods to restore them:

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from MoboPlay and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Lucia Danes
Lucia Danes - Virus researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

More information about the author

References