Fake Windows Product Key Screen

If you discover a Fake Windows Product Key Screen on your Windows Desktop, it is most likely that all you can see is a misleading message. Malware slithers into your computer and replaces explorer.exe with a unique process that changes the appearance of your Desktop. According to our researchers, this infection replaces the Windows Shell configuration in order to expose you to this misleading screen. The Shell value is found in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon or HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon (could be in the HKEY_LOCAL_MACHINE path as well) registry keys. Luckily, this infection does not disable the Registry Editor, and there is a way to access this tool to get rid of malware. The problem is that when users face Fake Windows Product Key Screen, removing malware does not always cross their minds. This malicious infection warns users about supposedly active malware, and this is what they tend to focus on.

The malicious infection carrying the Fake Windows Product Key Screen travels via software bundles. This technique is often exploited by malware distributors who attach infections to harmless programs (or harmless-looking programs). Due to this, it is quite possible that your operating system is now infected with various other threats. Needless to say, these infections might stay hidden and perform malicious activity silently. Although Fake Windows Product Key Screen is not a silent infection, it is clandestine because it hides behind a mask of a helpful warning. Here is an excerpt.

Your Computer is suspected of malicious software, for the purpose of verification enter your window product key. You will find your product key on the box that windows Dvd came in or in the welcome email or on the certificate of authenticity sticker.

Although the window representing the Fake Windows Product Key Screen is called “Windows Activation Pro,” it was not issued by Microsoft, the creator of Windows. This is another misleading feature of the malicious infection, but it is likely to fool some users. If you enter the Windows license key into the “Product key” box, cyber criminals will record it. It is not known exactly how this key will be used, but one of the possible outcomes is that this key will be sold, and you might lose your status as a legitimate Windows user. If you are cautious, it should not take long for you to realize that someone is trying to scam you because of the fake Customer Support number (+1-844-459-8882) that is provided via the screen notification. If you cross-check this number, you will realize it is associated with schemers. Now, if you call this number, you might be tricked into thinking that you have reached reputable technicians, when, in reality, it is schemers. Note that they could trick you into disclosing your identity and even credit card information, which is likely to result in monetary loss.

Besides asking for a license key, the Fake Windows Product Key Screen also provides easy-access links to Teamviewer, Supremo, and LogMeIn sites. Obviously, we do not recommend downloading any software promoted by malware. The good thing is that if you click these links, a browser will be launched, and you will be able to browse the web and research the infection. The links are followed by the “Cmd” link that launches the Command Prompt, and this tool is very important for you because it will allow you to delete the malicious infection. Needless to say, it is exceptionally important to erase this threat because it was set up to scam you, and you do not want to become a victim of cyber criminals.

The removal of Fake Windows Product Key Screen is not very complicated. All you need to do is launch a Task Manager, kill a malicious process, and delete the malicious components. We strongly recommend following the guide below because it explains the process one step at a time. If you are unsure about the steps in this guide, please comment below. Also, do not forget about other infections that could have slithered into your operating system. If you do not erase them from your operating system in time, you might face even bigger security problems. Although you might be able to detect and delete these threats manually, we advise using automated anti-malware software. It will identify all active threats and erase them from your computer. Furthermore, it will ensure that malware cannot slither in again.

Removal Instructions

1. Click the Cmd button on the Fake Windows Product Key Screen.
2. In the Command Prompt type taskmgr and tap Enter.
3. In the Task Manager move to the Processes tab.
4. Select the process called Productkeyupdate and end/terminate it.
5. Go back to the Command Prompt and enter start regedit.
6. In the Registry Editor find the Shell value in one of these paths:
   • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
   • HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
   • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
7. Right-click the Shell value and select Delete.
8. Navigate to HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\.
9. Right-click and Delete the key called Productkeyupdate.
10. Navigate to HKLM\SOFTWARE\Wow6432Node and repeat step 9.
11. Launch Explorer (in the Command Prompt enter explorer) and enter one of these directories in the address bar to find the Productkeyupdate folder.
    • %ProgramFiles(x86)%
    • %ProgramFiles%
12. Right-click the Productkeyupdate folder and select Delete.
13. Restart the PC.