Fake Windows Defender Prevented Malicious Software Tech Support

Posted by Max Lehmann on December 8, 2016

What is Fake Windows Defender Prevented Malicious Software Tech Support?

Fake Windows Defender Prevented Malicious Software Tech Support is hard to miss once it slithers onto your system and activates its attack. This malware infection blocks and locks your screen with a blue window that poses as a Windows product key authentication screen; however, in reality, it is nothing else than a fake alert. We have seen similar threats in the past years emerging from time to time, including “License has Expired +1-888-303-5121,” “Windows Security Alert! 1-888-220-3607,” and “Fake Activation Support 1-877-784-7461.” Our malware researchers at anti-spyware-101.com say that these infections are typical technical support scams that try to fool unsuspecting computer users with a fake alert to call a given customer support phone number. However, calling this number could land you in the center of a scam in which you could lose hundreds of your hard-earned dollars if you are not careful. We recommend that you remove Fake Windows Defender Prevented Malicious Software Tech Support the moment you notice its presence. test

Where does Fake Windows Defender Prevented Malicious Software Tech Support come from?

Before you learn how you can put an end to this annoying malware infection, we believe that it is essential for you to understand how this fake alert can show up on your system and your screen without any previous signs. The most usual way to get infected with this fake alert is to click on the wrong third-party content. This means that you need to click on an unreliable third-party advertisement, such as a banner or a pop-up ad, or a hyperlink on a modified search results page in order to directly drop this threat onto your machine or download a full bundle of malware infections. Furthermore, you can also get redirected this way to malicious webpages where you could also download this malware along with other threats as well.

You may think that you can avoid these unsafe ads by not clicking on any of them. However, you should know that you cannot always tell the difference between a legitimate and a harmful advertisement. When you are presented with a constant flow of ads while you are browsing the web, chances are your system is infected with adware. Such an infection can spy on you and introduce you to customized ads; in other words, you may see totally relevant ads that you may also believe to be true and reliable. Also, you can even accidentally visit questionable torrent or freeware websites where you can find all kinds of disguised ads posing as fake buttons, notifications or links. If you are not familiar with the page you are viewing, you may easily get confused and click on corrupt contents that would result in undesirable consequences. If you find this fake alert on your screen, we suggest that you inspect your system by using a reliable malware scanner after you delete Fake Windows Defender Prevented Malicious Software Tech Support from Windows.

How does Fake Windows Defender Prevented Malicious Software Tech Support work?

The operations behind this malware infection are quite simple. Once you install it, this threat creates a Run registry key so that it can auto-run with Windows whenever you restart your computer. This is why even if you reboot, this threat will take over and lock your screen every time. The main goal of this screen lock is to make you believe that there is really a serious system security issue. This blue screen looks totally like a legitimate Microsoft window that is asking for your product key to unlock the screen. The reason why this window shows up is that there is an alleged malware attack going on and this fake alert claims that Windows Defender prevented this supposed malware from harming your system. Obviously, all this is just made-up. The goal of this fake alert is to persuade you to call the phone number shown at the top of the screen. This number (1-877-360-0485) is claimed to be a customer support. You would assume that a Microsoft technician or a certified support member would pick up the phone to assist you. However, in truth, this is just your usual sales trick, a technical support scam to push you to buy a service or software to fix your fake system errors. If you see this screen, there is nothing else for you to do than remove Fake Windows Defender Prevented Malicious Software Tech Support from your system.

How do I delete Fake Windows Defender Prevented Malicious Software Tech Support?

Our malware researchers say that if you have Windows 10, you could easily close this lock screen by changing the active window by pressing down the Alt+Tab combination. In the other cases, we suggest that you restart your computer in Safe Mode and then, you can delete the related file and the Run registry key. Please use our instructions below if you want to take matters into your own hands. Keep in mind that removing Fake Windows Defender Prevented Malicious Software Tech Support does not necessarily mean that your computer has become all safe. If you want to make sure that you are using a secure system, we advise you to download and install a trustworthy anti-malware program. This security tool could automatically hunt down all malware threats and protect your PC from them.

How to reboot your computer in Safe Mode

Windows XP/Windows Vista/Windows 7

Reboot your computer.
Press the F8 key a few times to launch the Boot menu.
Using your arrow keys, navigate to Safe Mode, and press the Enter key.

Windows 8/Windows 8.1

On the Metro UI screen press the Power icon.
Tap and hold the Shift key and click on Restart.
Select Advanced options from the Troubleshooting menu.
Navigate to Startup Settings and press Restart.
Press the F4 key to reboot in Safe Mode.

Remove Fake Windows Defender Prevented Malicious Software Tech Support from Windows

Tap Win+Q and enter regedit. Press the Enter key.
Locate and delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Flash Player value name (value data: “C:\Program Files (x86)\adobe flash player.exe”)
Close the Registry Editor.
Tap Win+E to launch the File Explorer.
Locate and bin the malicious executable: “%PROGRAMFILES(x86)%\adobe flash player.exe”
Empty your Recycle Bin.
Restart your computer in Normal Mode.