You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Panda Security Product Line 2012

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

FakeWindows.A

 
Threat LevelLow threatDamageHighDistributionNot widespread
Common name:FakeWindows.A
Technical name:Trj/FakeWindows.A
Threat level:Medium
Type:Trojan
Effects:  

It passes itself off as the activation process of Windows XP which is used to prevent that a Windows product could be used as pirate software. In order to activate it, users are required to enter certain data, including the banking details. Once entered, the computer will be blocked.

Affected platforms:

Windows 2003/XP/2000/NT

First detected on:Dec. 7, 2009
Detection updated on:Dec. 10, 2009
StatisticsNo

Brief Description 

    

FakeWindows.A is a Trojan that passes itself off as the activation process of Windows XP (MSOOBE.EXE) which is used to prevent that a Windows product could be used as pirate software.

In order to activate it, a window is displayed on screen requiring users to enter certain data, including the banking details. Once entered, the computer will be blocked.

FakeWindows.A reaches the computer in a file which has the icon of a pair of keys. However, it does not spread automatically using its own means.

Visible Symptoms 

    

FakeWindows.A is easy to recognize, as it shows the following symptoms:

  • It reaches the computer in a file called MS00BE32.EXE and which has the icon of a pair of keys:

  • If this file is run, it is copied to the system and the icon is deleted from the path where it has been run.
  • When the computer is restarted, a warning message that seems to be from Windows is displayed on screen, requiring users to activate their copy of Windows in order to prevent the use of pirate software: