However, this was not an isolated incident, as Malwarebytes pointed to two more recently submitted examples of ransomware-like screen lockers that claim the Windows product key is invalid and list a fake tech support number. VirusTotal currently lists only 13 of 56 antivirus solutions detecting this tech support locker, which came bundled in a tainted version of PC Cleaner Cleaner.exe) Malwarebytes Anti-Malware detects it as Rogue.TechSupportScam.

Malwarebytes noted, “These may only work for this particular instance and not all versions of those lockers.” Security researcher who sent the malware sample to Malwarebytes, discovered that Ctrl+Shift+S “kills the winlocker and does nothing else.” The following hardcoded values, “h7c9-7c67-jb” or “g6r-qrp6-h2” or “yt-mq-6w” can be entered as the product key and may work to unlock the computer.

Thankfully there are options to bypass the lock screen, at least for this particular malware variant. No, this is essentially a piece of malware that starts automatically, and typical Alt+F4 or Windows key tricks will not get rid of it. To be clear, this is not a fake browser pop up that can easily be terminated by killing the application or restarting the PC.

If a victim refused to pay the extortion for the malware to be removed, he or she would seemingly be stuck with an unusable PC. The scammer refused to reveal more without being paid the $250 fee to unlock the PC. After Malwarebytes called the number, a fake Microsoft technician revealed a hidden functionality, that hitting Ctrl+Shift+T would bring up a built-in installer for TeamViewer. With the PC locked up, and the valid Windows product key being labeled as invalid, the average user would likely call the tech support number on the lock screen. 'The message looks legitimate with the license key and computer name being retrieved from the victim’s actual computer.” “More troubling is the next screen that comes up and effectively disables the computer because of an expired license key,' he said.

Is malwarebytes legitimate