x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Download Cloud Antivirus Gratis

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

FakeWindows.A

Threat LevelLow threatDamageHighDistributionNot widespread
Common name:FakeWindows.A
Technical name:Trj/FakeWindows.A
Threat level:Medium
Type:Trojan
Effects:  

It passes itself off as the activation process of Windows XP which is used to prevent that a Windows product could be used as pirate software. In order to activate it, users are required to enter certain data, including the banking details. Once entered, the computer will be blocked.

Affected platforms:

Windows 2003/XP/2000/NT

First detected on:Dec. 7, 2009
Detection updated on:Dec. 10, 2009
StatisticsNo

Brief Description 

    

FakeWindows.A is a Trojan that passes itself off as the activation process of Windows XP (MSOOBE.EXE) which is used to prevent that a Windows product could be used as pirate software.

In order to activate it, a window is displayed on screen requiring users to enter certain data, including the banking details. Once entered, the computer will be blocked.

FakeWindows.A reaches the computer in a file which has the icon of a pair of keys. However, it does not spread automatically using its own means.

Visible Symptoms 

    

FakeWindows.A is easy to recognize, as it shows the following symptoms:

  • It reaches the computer in a file called MS00BE32.EXE and which has the icon of a pair of keys:

  • If this file is run, it is copied to the system and the icon is deleted from the path where it has been run.
  • When the computer is restarted, a warning message that seems to be from Windows is displayed on screen, requiring users to activate their copy of Windows in order to prevent the use of pirate software: