All Access To This Device Has Been Revoked Scam
Written by Tomas Meskauskas on (updated)
What is "All Access To This Device Has Been Revoked"?
First discovered by MalwareHunterTeam, "All Access To This Device Has Been Revoked" is malware that displays a fake error message. Once infiltrated, this malware locks the computer screen and displays a message stating that there is a potential computer infection. From this point, users are unable to perform any further actions.
The message states that Microsoft has detected suspicious activity and the system has been locked due to a network security breach. It is also stated that sensitive data (logins/passwords, banking details, etc.) might be stolen.
These issues must be resolved immediately and, to do so, users must contact Microsoft certified technicians (via a telephone number ["1-888-879-0163"] provided) or enter a type of activation key. In fact, entering a genuine Windows activation key will not remove the lock screen.
After calling the telephone number, users supposedly receive help in fixing the aforementioned issues, however, be aware that "All Access To This Device Has Been Revoked" is a scam. This message is fake and has nothing to do with Microsoft (developers of the Windows Operating System).
Cyber criminals generate revenue by tricking users into paying for technical support that is not required - there is no infection or breach. The message is designed only to scare unsuspecting users. Furthermore, these people often demand remote access to victims' computers. Once connected, they change system settings and/or install malware.
They then claim to "detect" additional errors and offer help for an extra fee. Furthermore, cyber criminals often demand answers to various "yes" or "no" questions. The positive responses are then used as 'proof' that victims agreed to undertake online transactions (e.g., online purchases, credit card charge, and so on).
For these reasons, we advise you to ignore the "All Access To This Device Has Been Revoked" error and never call the telephone number.
Fortunately, MalwareHunterTeam analyzed this malware and found a key ("8716098676562789"), which can be used to unlock compromised systems. Note that, after unlocking, you must immediately scan the system with a legitimate anti-virus/anti-spyware suite and remove all dubious applications/browser plug-ins.
| Name | "All Access To This Device Has Been Revoked" virus |
| Threat Type | Ransomware, Crypto Virus, Files locker |
| Symptoms | Can't open files stored on your computer, previously functional files now have a different extension, for example my.docx.locked. A ransom demanding message is displayed on your desktop. Cyber criminals are asking to pay a ransom (usually in bitcoins) to unlock your files. |
| Distribution methods | Infected email attachments (macros), torrent websites, malicious ads. |
| Damage | All files are encrypted and cannot be opened without paying a ransom. Additional password stealing trojans and malware infections can be installed together with a ransomware infection. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Research has revealed dozens of fake errors similar to "All Access To This Device Has Been Revoked" including Windows Defender Prevented An Unrecognized Software, Threats Detected, Microsoft Has Blocked The Computer, and many others.
Unlike "All Access To This Device Has Been Revoked", most are delivered by malicious websites, however, they all claim that the system is damaged. These claims are merely attempts to extort money from unsuspecting victims.
"All Access To This Device Has Been Revoked" is more than likely to be proliferated by various potentially unwanted programs (PUPs) that infiltrate systems without permission.
Aside from spreading scams, PUPs generate 'malvertising' ads (coupons, banners, pop-ups, etc.), gather sensitive information, and misuse system resources to run unwanted processes (e.g., mine cryptocurrency). In doing so, potentially unwanted programs pose a direct threat to your privacy and Internet browsing safety.
How did potentially unwanted programs install on my computer?
To proliferate PUPs, developers employ a deceptive marketing method called "bundling" (stealth installation of third party applications together with regular software/apps), and malicious ads. Due to careless behavior and poor knowledge by many users, potentially unwanted programs often infiltrate systems without permission.
Research shows that cyber criminals conceal "bundled" apps within the "Custom/Advanced" settings or other sections of the download/installation processes, whilst 'malvertising' ads redirect to malicious websites and, in some cases, execute scripts that download/install malware/potentially unwanted programs.
Users often rush the download/installation processes and skip steps. In addition, they click ads without considering the consequences. In doing so, they expose their systems to risk of various infections.
How to avoid installation of potentially unwanted applications?
The key to computer safety is caution and, for this reason, pay close attention when browsing the Internet and especially when downloading/installing software.
Most 'malvertising' ads appear genuine, however, they redirect to dubious websites (such as adult dating, pornography, gambling, survey, etc.) As mentioned above, these ads are delivered by various potentially unwanted programs. Therefore, if you encounter 'malvertising' ads, immediately eliminate all dubious apps and browser add-ons.
In addition, select the "Custom/Advanced" settings, analyze each step of the download/installation procedures and decline all additionally-included programs. Note also that unofficial downloaders/installers are monetized using the "bundling" method (they promote malicious apps). Therefore, download your software only from trustworthy sources.
"All Access To This Device Has Been Revoked" error message:
Microsoft has detected some suspicious activity on this computer. All access to this device has been revoked due to a network security breach. Attackers might attempt to steal personal information, banking details, emails, passwords and other files on this system.
Please contact a Microsoft certified technician on 1-888-879-0163
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is "All Access To This Device Has Been Revoked"?
- STEP 1. "All Access To This Device Has Been Revoked" virus removal using safe mode with networking.
- STEP 2. "All Access To This Device Has Been Revoked" virus removal using System Restore.
"All Access To This Device Has Been Revoked" virus removal:
Step 1
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Go to the Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced Startup options, in the opened "General PC Settings" window select Advanced Startup. Click on the "Restart now" button. Your computer will now restart into "Advanced Startup options menu".
Click on the "Troubleshoot" button, then click on "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into the Startup Settings screen. Press "5" to boot in Safe Mode with Networking Prompt.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button.
In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Step 2
Log in to the account infected with the "All Access To This Device Has Been Revoked" virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.
If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.
Video showing how to remove viruses using "Safe Mode with Command Prompt" and "System Restore":
1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.
2. When Command Prompt Mode loads, enter the following line: cd restore and press ENTER.
3. Next, type this line: rstrui.exe and press ENTER.
4. In the opened window, click "Next".
5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the "All Access To This Device Has Been Revoked" virus infiltrating your PC).
6. In the opened window, click "Yes".
7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remnants of the "All Access To This Device Has Been Revoked" virus.
If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk.
Some viruses disable Safe Mode making it's removal complicated. For this step, you require access to another computer. After removing "All Access To This Device Has Been Revoked" virus from your PC, restart your computer and scan it with legitimate anti-spyware software to remove any possible remnants of this security infection.
Other tools known to remove this scam:
Outstanding!
▼ Show Discussion