A new sophisticated scam uses malware to show a fake Windows Update process that fails stating the license key is invalid. Victims have to pay $250 to 'activate' their Windows version again. The cybercriminals behind the scam distribute malware with e.g. a fake version of the Adobe Flash Player or PC optimization software.
Once the malware is active it waits till the user reboots the computer after which it shows the familiar Windows Update screen. The fake Update Screen is suddenly interrupted by a message stating, "Windows Update can not continue as your Software copy is Expired/Corrupt. Please enter a Valid product key to continue. Error Code: 0X00AEM001489". The screen also shows a notification stating "Invalid Product Key. Contact System Administrator or Call Support at 1-884-872-8686". It's not possible to close the fake screen by e.g. pressing ALT+F4 or other ways of closing applications
When a victim calls the number he is told to pay $250 for a new 'license'. Fortunately the malware developers hardcoded a keyboard combination and 3 valid license keys. By pressing CTRL + SHIFT and then pressing 's' the fake update window is closed. Licence keys that are accepted by the malware are "h7c9-7c67-jb", "g6r-qrp6-h2" or "yt-mq-6w".
The number of these kinds of 'Windows Lockers' appears to be increasing according to MalwareByte's Jerome Segura, "Needless to say this is a worrying trend because in comparison to fake (but mostly harmless) browser alerts, these Windows lockers are a real pain to get rid of and until you do so, your computer is completely unusable."
