Microsoft Windows Got De-Activated Removal Guide

Microsoft Windows Got De-Activated is a fake system alert that might be distributed with infected PCCleaner versions or possibly even other corrupted programs. Thus, if submitting your Windows Product key or calling the provided telephone number could get you into trouble instead of solving any problems. If you believe this is the threat that could have locked your screen and does not allow you to work on your computer, we urge you to read the rest of the article carefully. Also, we recommend using the instructions located at the end of the article as they will explain what to do to gain the control of your system again. Additionally, we will tell users how to remove the infected application possibly responsible for helping Microsoft Windows Got De-Activated fake alert settle on your system.

The sample our researchers tested was distributed through an infected program called PCCleaner. During the installation, the suspicious message modified a particular value name located in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon directory. As a result, the user’s explorer.exe process should get killed, and you would no longer be able to see your Desktop. Then the threat should quickly place its window on the screen to make it look it is a message from the computer’s operating system.

The Microsoft Windows Got De-Activated fake alert’s window is supposed to show a Windows logo and the message it contains might start with: “Microsoft Windows has detected some suspicious activities on this computer.” For instance, it could say there was a Network security breach, and because of this, your Windows got de-activated. Of course, for you to be able to use the computer again the suspicious message might ask to submit the Product key in the provided box. However, even if you type the correct key, it may still not do anything; not to mention there is a chance the threat’s creators could stead it. Below the box to submit the Product key, there should be a line with a technical support telephone number (e.g., 1-866-324-2085).

Calling the mentioned number could result in contacting scammers since we are almost one hundred percent sure it does not belong or is anyhow related to Microsoft. Besides, a real system notification would never ask you to call technicians; instead, you should receive instructions on what to do or how to get more information with further instructions. We cannot know for certain what could happen if you contact the scammers as we did not call them ourselves, but probably they would try to extort money from you by selling their remote services, security tools, or any other products and services you do not need. Therefore, if your screen gets locked by Microsoft Windows Got De-Activated fake alert we advise you not to pay any attention to the message it provides and try to get rid of it as fast as you can.

The instructions you should see below this text will show you how to close the alert’s window, restore explorer.exe and some other files that Microsoft Windows Got De-Activated alert could have modified. Then, it will explain how to erase the infected data belonging to the infected PCCleaner and other data related to the suspicious message.

Eliminate Microsoft Windows Got De-Activated

1. Press Ctrl+Shift+S to kill the threat’s window.
2. Press Windows key+R, type regedit and click Enter.
3. Navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
4. Locate a value name called Shell; its value data might say microsoft.exe.
5. Right-click this value name (Shell) and press Modify.
6. Instead of microsoft.exe type explorer.exe and click OK.
7. Restart the PC.
8. Repeat the second step.
9. Find the following paths:
   HKLM\SYSTEM\ControlSet001\Control\SafeBoot
   HKLM\SYSTEM\ControlSet002\Control\SafeBoot
   HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
10. Search for value names called AlternateShell, right-click them one by one and press Modify.
11. Instead of microsft.exe type cmd.exe and press OK.
12. Exit Registry Editor.

Erase PCCleaner and the fake alert’s data

1. Press Windows key+E.
2. Navigate to these two locations:
   %PROGRAMFILES%
   %PROGRAMFILES(x86)%
3. Search for folders called PC Cleaner Inc, right-click them and press Delete.
4. Then go to %Windir%
5. Locate the main fake alert’s file called microsoft.exe, right-click it and select Delete.
6. Close File Explorer.
7. Empty Recycle bin.