Win 7 no product key...huh?

[katz]

Three Win 7 PC's in here that have the product key removed. I recall a Win 8 thread on here a few days ago with a virus like this. I think it's odd/coincidence that I get three in like this all at the same time, esp. with Win 7 installed. Anyone seen this before? And the remote support across the top. When you click on one of them, it will take you to their website.

I can get explorer.exe to run either by clicking on the word, or thru task manager/ run new task, but the nag screen keeps popping up. Product key on the side of the pc doesn't fix it. I nuked & paved, all is well now.

 

[FremontPC]

This must be a bogus screen prompting for some "product key" that's of their own creation. Nothing to do with any MS product key.

Restart with a Win7 boot disk and get to System Restore, or slave the drive and copy the files from \Regback, then boot and use System Restore to get to a point just before the infection.

Does Task Manager list IE as running? You might be able to kill it that way.

 

[katz]

I thought that too, but when I check the activation/system pane, it does state that the pc is not activated. I noticed that "windowsactivate.exe *32" process is running. When I end that process, it restarts in a matter of a minute or two. I would do as you stated, but there is a ton of junk on here, ask/conduit/etc. The client could benefit from a new install and is not in a rush, so I opted for that route.

BTW, I needed to contact MS for activation on one of them. The new system, is where you can use your smartphone, so I did that and it prompted me to enter via. keypad the numbers on the PC screen. There were a bunch of zeros in the PC i.d. number, but on my smartphone, the MS activation keypad was labeled 1-9. How's that for quality control, lol.

 

[Markverhyden]

Dang, those scammers are getting craftier and craftier every day.

 

[FremontPC]

Yeah, sounds like a process that somebody invented and launched after they hosed the activation. I think you went the right route, sounds like the things were blasted with crud.

 

[Larry Sabo]

I recall a Win 8 thread on here a few days ago with a virus like this.

Yeah this one.

 

[katz]

That's the one, Larry.

Although with the ones I'm working with I don't have the "Product key activation" process running. I will go that route if I get any more in like this. Always learning something new.

 

[nlinecomputers]

http://www.bleepingcomputer.com/virus-removal/remove-fake-windows-product-key-screen

 

[glricht]

http://www.bleepingcomputer.com/virus-removal/remove-fake-windows-product-key-screen

Not to hijack this thread, but when reading the above article, it refers to an anti-malware scanner called "Zemana". I've never heard of Zemana. Has anybody used this before, and if so, what did you think of it?

 

[Encrypted Existence]

http://www.bleepingcomputer.com/virus-removal/remove-fake-windows-product-key-screen

From article linked above..."It is important to note that the the Product Key scam is bundled with and installed by free programs that did not adequately disclose that other software would be installed along with it." - SMH

 

[MDD1963]

Not to hijack this thread, but when reading the above article, it refers to an anti-malware scanner called "Zemana". I've never heard of Zemana. Has anybody used this before, and if so, what did you think of it?

Appears to be a Hitman pro clone, I've used it as a secondary scanner without issues....

 

[MDD1963]

Although for the above, assuming it will run anything, I'd be looking at rkill or roguekiller, and would be surprised if MBAM did not find anything...

 

[MDD1963]

freefixer is also pretty darned good at detecting the browser hijacks/redirects....

 

[Galdorf]

Not to hijack this thread, but when reading the above article, it refers to an anti-malware scanner called "Zemana". I've never heard of Zemana. Has anybody used this before, and if so, what did you think of it?

It is similar to hitman pro it detects man in the middle attacks and does keyboard encryption to prevent keyloggers from getting any info also paid version protects the copy and paste buffers ,Screen Logger Protection,Webcam and Microphone Logger Protection as well i have been using the free anti-keylogger for years it does a very good job.

http://www.bleepingcomputer.com/download/zemana-antilogger-free/