Windows License Locked!

26 April 2011 Rogue 0 Comment

Windows License Locked! is a ransomware or desktop locking virus that is being distributed by pretending an update file for FireFox browser. It can be downloaded as file Firefox_update.exe. Windows License Locked! virus will use fake security web site usually published in French. This program will prevent any execution of installed application and advise users of possible software errors. It will repeatedly prompt to activate a copy of Windows by paying for the licensed which is actually a scam. Alert will contain the following message:

Windows License Locked!
This copy of Windows is locked. You maybe a victim of a fraud or there may be an internal system error.
To continue using Windows you should complete activation.
Activation is absolutely free and is simply a formality. You do not need to pay for the license and you will not be required to provide any personal data.

Windows License Locked! virus is not in any way part of the Windows operating system. It will be present on computers already infected with a Trojan. Main purpose of Windows License Locked! virus is to deceive users about the unlicensed version of Windows and force to activate by redirecting its browser to an online payment processing website where credit card information is required.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows License Locked! Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows License Locked!”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe,WindowsWebSecurity.exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows License Locked! Virus.
4. Registry entries created by Windows License Locked! must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows License Locked! start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe,WindowsWebSecurity.exe

7. Click Apply and restart Windows.

Windows License Locked! Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Windows License Locked!:
Internet-Explorer_update.exe
4F.tmp
Chrome_update.exe
Keygen-AUTODESK_AUTOCAD_MAP_3D_2011_x32_x64.exeInstall_Flash-Player.exe
Dc17.exe
WindowsWebSecurity.exe

Windows License Locked! Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WindowsWebSecurity.exe”