Danger level 8
Type: Malware
Common infection symptoms:
  • Can't be uninstalled via Control Panel
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • System crashes
  • Slow Computer

Windows Genuine Advantage Virus

The Windows Genuine Advantage virus is a warning notifying you if your Windows XP version is genuine. The Windows Genuine Advantage notification is displayed only when the computer fails WGA validation process. If you have a genuine copy of Windows XP, you will not receive this notification. Unfortunately, cyber criminals have already exploited Windows Genuine Advantage to deceive unsuspecting users into paying a ransom fee of either €50 or €100. The computer infection, categorized as ransomware and sometimes referred to as virus, locks the screen of the target computer and displays a bogus Windows Genuine Advantage warning, which informs the victim that the WGA validation process has failed; thus, he/she is forced to acquire either a license for Windows or upgrade to Windows 8.

It is crucial to ignore the warning of the Windows Genuine Advantage virus because it is a scam. If you have ever heard of ransomware, you probably know that the victims of this type of threats are usually made to use online payment systems. In the case of the Windows Genuine Advantage virus, the services of Ukash or Paysafecard are presented. Moreover, after paying the required sum of money, you would have to wait up to 12 hours to have the computer unlocked. There is no guarantee that the criminals behind the Windows Genuine Advantage infection will unlock the computer, which is why you should remove the infection instead of paying up.

The deceptive warning may be very convincing especially when it is written in your native language. It has been discovered that the Windows Genuine Advanced virus is capable of identifying your location and changing the language of the warning. Below you will find an excerpt from the warning in German:

Windows Genuine Advantage-Benachrichtigungen ist ein Bestandteil des Bemühens von Microsoft, Softwarepiraterie einzudämmen. Diese Software hilft dabei, zu bestimmen, ob es sich bei der auf Ihrem Computer installierten Windows Version um eine Originalversion oder Raubkopie handelt. Leider konnte diese Prüfung nicht erfolgreich abgeschlossen werden, daher wurde der Zugriff auf Ihren Computer temporär gesperrt. Als Gründe hierfür gelten eine abgelaufene oder mehrfach verwendete Windows-Lizenz, sowie eine illegal erworbene Windows-Lizenz (Raubkopie).

The fact that your computer is infected with a ransomware infection implies that the computer is not properly protected against various computer infections. Moreover, you should keep in mind that malicious programs such as the Windows Genuine Advantage virus can be installed on the computer in various ways, including insecure adult-oriented websites, P2P file exchange websites, and malicious email attachments. If you want to remove the Windows Genuine Advantage virus and browse the Internet safely, you should implement a reputable security programs; otherwise, you the computer remains susceptible to malware.

Below you will find our instructions on how to remove Windows Genuine Advantage, the malicious program, and, if have any questions concerning the removal, feel free to leave a comment below.

How to remove the Windows Genuine Advantage virus

  1. Restart the computer.
  2. Once the BIOS startup screen appears, start tapping the F8 key.
  3. Select Safe Mode with Networking.
  4. Open the Start menu and click Run.
  5. Type in msconfig and open the Startup menu.
  6. Click the Disable All button.
  7. Launch an Internet browser and go to http://www.pcthreat.com/download-sph to download SpyHunter.
  8. Install the program.
  9. Restart the computer and launch a system scan.
Download Spyware Removal Tool to Remove* Windows Genuine Advantage Virus
  • Quick & tested solution for Windows Genuine Advantage Virus removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Genuine Advantage Virus

Files associated with Windows Genuine Advantage Virus infection:

jsdhlexdqkllnbcxgai.bfg
ubvhynpxh.exe
%APPDATA%\updates
WINDED6.exe
wgsdgsdgdsgsd.exe
pYunY8m4VL3qLc.exe
ctfmon.exe
bf8h8d02hf.exe
msdtmsrd.exe
NTServiceManager.exe
DA0B.exe
Nbt.exe
rvcbcyks.exe
00b5d693.exe
%LOCALAPPDATA%\Temp
p1.exe
xctqakcqbeo.dll
MusicCollector.exe
%WINDIR%\system32
administration.exe
obvwo.exe
Task Scheduler.exe
systemcpl.exe
puozlkmyj.dll
xaZYOVJW.exe
Piranha.exe
%APPDATA%\Task Scheduler
OmaSG21e.exe
TimeDateMUICallback.exe
hwj3ba6j.dss
ieudator.dll
yaiiwockc.dll
2084473.dll
wjthvwjb.dss
najeoxtt.exe
dtkmujvo.exe
%ALLUSERSPROFILE%
idiokbbrv.exe
msavfit.exe
ssntvs.exe
uenovfiu.exe
dqnbdq7.dss
%AppData%
96dddda4.dll
n.
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
svchost.exe
mplayer2.exe
iner.exe
%ALLUSERSPROFILE%\Application Data
rool0_pk.exe
Other.res
ifgxpers.exe
msnmsgrr.exe
%WINDIR%\Temp
sqlncli.exe
secproc_isv.exe
xlqbteeb.exe
魔法桌面第三方主题破解补丁V1.1.exe
wlsidten.dll
csrsss.exe
m2PythonLoader.exe
UpgradeHelper.exe
scvhost.exe
3511172082012Build.exe
wpbt0.dll
UpdatePriv.exe
msshell.exe
Updating.exe
%LOCALAPPDATA%\lollipop
wlsidten.exe
ACEIEAddOn.dll
pmstcdjwz.exe
bzsbkotiu.exe
%UserProfile%
JfCqQ5JC.exe
b34btbztdb0vavaw.exe
ex3b.dll
audipbrd.exe
00qbipeq.exe
crack.exe
VaultSysUi.exe
brenasa.exe
Q3d38543.exe
zqmkrehUkpoKfsafsaZg.exe
87b2cb3916261d5c807bf44262755cb0.exe
setex.exe
%CommonProgramFiles%
50E1.exe
%SystemDrive%\????????????
msn.exe
xmlfilter.exe
taskhost.exe.exe
bvhylsviw.exe
%APPDATA%\system
skype.dat
install_0_msi.exe
C87C.exe
dyjdl.exe
questscan.dll
%TEMP%
WinSyncMetastore.exe
securitywindrv.exe
SyncHostps.exe
videotwisterSA.exe
aPr0hY9.exe
comeo.exe
DLL321.dll
Firewallservice.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
oygqyunapnp.exe
gcrwcoak.exe
acuvzomo.exe
wahneaqa.exe

Windows Genuine Advantage Virus DLL's to remove:

wlsidten.dll
wpbt0.dll
DLL321.dll
xctqakcqbeo.dll
2084473.dll
ACEIEAddOn.dll
ieudator.dll
questscan.dll
puozlkmyj.dll
ex3b.dll
yaiiwockc.dll
96dddda4.dll

Windows Genuine Advantage Virus processes to kill:

87b2cb3916261d5c807bf44262755cb0.exe
secproc_isv.exe
aPr0hY9.exe
mplayer2.exe
xlqbteeb.exe
b34btbztdb0vavaw.exe
najeoxtt.exe
acuvzomo.exe
crack.exe
50E1.exe
3511172082012Build.exe
xmlfilter.exe
C87C.exe
00qbipeq.exe
m2PythonLoader.exe
iner.exe
SyncHostps.exe
taskhost.exe.exe
WINDED6.exe
brenasa.exe
00b5d693.exe
bf8h8d02hf.exe
obvwo.exe
DA0B.exe
Nbt.exe
bvhylsviw.exe
TimeDateMUICallback.exe
pYunY8m4VL3qLc.exe
魔法桌面第三方主题破解补丁V1.1.exe
setex.exe
Task Scheduler.exe
msshell.exe
VaultSysUi.exe
systemcpl.exe
audipbrd.exe
securitywindrv.exe
csrsss.exe
Updating.exe
uenovfiu.exe
xaZYOVJW.exe
install_0_msi.exe
ifgxpers.exe
Q3d38543.exe
svchost.exe
comeo.exe
JfCqQ5JC.exe
wgsdgsdgdsgsd.exe
UpdatePriv.exe
oygqyunapnp.exe
Piranha.exe
rvcbcyks.exe
ubvhynpxh.exe
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
WinSyncMetastore.exe
Firewallservice.exe
bzsbkotiu.exe
gcrwcoak.exe
NTServiceManager.exe
videotwisterSA.exe
rool0_pk.exe
ctfmon.exe
ssntvs.exe
MusicCollector.exe
sqlncli.exe
p1.exe
pmstcdjwz.exe
dyjdl.exe
msnmsgrr.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
administration.exe
idiokbbrv.exe
scvhost.exe
OmaSG21e.exe
UpgradeHelper.exe
wlsidten.exe
msdtmsrd.exe
msn.exe
msavfit.exe
dtkmujvo.exe
zqmkrehUkpoKfsafsaZg.exe
wahneaqa.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.