McAfee has Blocked your Windows Screenlocker
Written by Tomas Meskauskas on (updated)
What is "McAfee has Blocked your Windows"?
"McAfee has Blocked your Windows" (or "Webroot has Blocked your Windows") is a fake security alert that locks the screen and encourages people to contact scammers ("technical department") via the telephone number provided. This is simply a scam and should not be trusted.
Scammers attempt to trick people into believing that McAfee or Webroot software has detected suspicious activity and blocked the computer. A pop-up window states that computers might be infected with viruses that steal credit card details or other sensitive information.
To avoid identity theft, financial loss, or other serious problems, people are encouraged to contact the McAfee or Webroot technical department via the (301) 900-8084 telephone number. To unlock their computers, users are urged to enter a license code that must be purchased from these scammers who pose as 'technicians' from Webroot or McAfee.
Do not contact these scammers or purchase this code from them. They are unlikely to provide any code (or if they do, it will probably not work). Furthermore, MalwareHunterTeam (who discovered this scam) have provided a code that can be used for both Webroot and McAfee scam versions to unlock the screen. The code is "H3J9-Z7K5-W5Y1-Q6L4".
After entering this code another pop-up window is likely to appear, encouraging users to call "Windows Technical Support" via the 1844-935-5335 number. It states that the user's computer might be infected and data such as passwords, browsing history, credit card details, and files stored on the computer might be at risk.
This fake virus alert/pop-up window should also be ignored. It cannot be closed in the normal way, so use Task Manager, find the process called "Advanced Ransomware", and terminate it using the "End task" (or "End Process") function.
| Name | "Webroot has Blocked your Windows" scam |
| Threat Type | Phishing, Scam, Social Engineering, Fraud. |
| Symptoms | Unauthorized online purchases, changed online account passwords, identity theft, illegal access of the user's computer. |
| Distribution methods | Deceptive emails, rogue online pop-up ads, search engine poisoning techniques, misspelled domains. |
| Damage | Loss of sensitive private information, monetary loss, identity theft. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
"Your Windows Has Been Banned", "ERROR_LOCAL_USER" and "You Have A ZEUS Virus" are examples of other fake virus/error alerts. Generally, these scams are used by cyber criminals who attempt to extort money from people. They encourage users to contact them to purchase keys, software, online services, and so on.
In this particular case, the scam occurs when a computer is infected with a ransomware-type program called Advanced Ransomware.
Programs of this type are usually proliferated through spam campaigns (email attachments), dubious software download sources (unofficial websites, Peer-to-Peer networks, third party downloaders, and so on), fake software updaters, software 'cracking' tools and Trojans.
There are many scam websites that display fake alerts and errors similar to "McAfee has Blocked your Windows". Redirects to these websites are usually caused by various potentially unwanted applications (PUAs).
McAfee screenlocker technical analysis:
- Detection names: Avast (Win32:Trojan-gen), BitDefender (Gen:Variant.MSILPerseus.178033), ESET-NOD32 (a variant of MSIL/FakeSupport.DF)
- Scammers' telephone numbers: (301) 900-8084, 1844-935-5335
- Full list of antivirus detections: VirusTotal
- Executable filename: McAfee Tool.exe
- Sample first submitted: 2019-03-28 (created 2019-03-13)
WebRoot screenlocker technical analysis:
- Detection names: Avast (Win32:Malware-gen), BitDefender (Gen:Variant.MSILPerseus.178033), ESET-NOD32 (a variant of MSIL/FakeSupport.DF)
- Scammers' telephone numbers: (301) 900-8084, 1844-935-5335
- Full list of antivirus detections: VirusTotal
- Executable file name: Webroot Tool.exe
- Sample first submitted: 2019-03-20 (created 2019-03-19)
How did potentially unwanted applications install on my computer?
Some potentially unwanted applications can be downloaded from their websites, however, they more commonly infiltrate systems without users' knowledge (users install them unintentionally).
These unwanted installations usually happen through clicked intrusive advertisements or when software developers use the "bundling" method, which can trick users into downloading and installing PUAs with other software. Unwanted apps are usually hidden in "Custom", "Advanced" and other similar options/settings of software download/installation setups.
Furthermore, many people download and install software without checking these settings, thus allowing themselves to be tricked into downloading and installing other, unwanted software.
How to avoid installation of potentially unwanted applications?
Download software from official and trustworthy sources, and using direct links. Do not use third party software downloaders, installers, torrents, unofficial pages, or other similar sources. Do not skip setup steps when downloading or installing software. Carefully analyze each step by checking each checkbox, "Custom", "Advanced" settings, and so on.
Avoid clicking intrusive ads, since this can lead to redirects to untrustworthy or suspicious websites (such as gambling, pornography, adult dating, etc.). If you encounter these advertisements or redirects, check the list of installed extensions, add-ons, and plug-ins on your browser and remove dubious or unknown entries immediately.
Also apply this to unwanted programs installed on the operating system. If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate them.
Text presented in "McAfee has Blocked your Windows" pop-up:
McAfee has Blocked your Windows.
This PC has been blocked because of Suspicious Activity Detected. To Protect the Windows Services and its members all McAfee Technical Department (301) 900-8084. McAfee Security Alert Code: 055BCCAC9FEC
Your PC has been blocked because we detected an unusual activity on your computer. Your Computer might be Infected by Harmful Viruses. These viruses are well known for identity and credit card theft. Further action on this computer or any other device on your network might reveal private information and involve serious risks. McAfee Technicians will help you getting the Code to Unblock your Computer. Please Call McAfee Technical Department (301) 900-8084.
Call McAfee Technical Department: (301) 900-8084
Screenshot of the "Webroot has Blocked your Windows" version:
Text presented in this variant:
Webroot has Blocked your Windows.
This PC has been blocked because of Suspicious Activity Detected. To Protect the Windows Services and its members Call Webroot Technical Department (301) 900-8084. Webroot Security Alert Code: 055BCCAC9FEC
Your PC has been blocked because we detected an unusual activity on your computer. Your Computer might be Infected by Harmful Viruses. These viruses are well known for identity and credit card theft. Further action on this computer or any other device on your network might reveal private information and involve serious risks. Webroot Technicians will help you getting the Code to Unblock your Computer. Please Call Webroot Technical Department (301) 900-8084.
Call Webroot Technical Department: (301) 900-8084
Screenshot of a pop-up window that appears after entering the code provided by MalwareHunterTeam:
Malicious "Advanced Ransomware" process running in Task Manager:
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is "McAfee has Blocked your Windows Screenlocker"?
- STEP 1. "McAfee has Blocked your Windows Screenlocker" virus removal using safe mode with networking.
- STEP 2. "McAfee has Blocked your Windows Screenlocker" virus removal using System Restore.
"McAfee has Blocked your Windows Screenlocker" virus removal:
Step 1
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Go to the Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced Startup options, in the opened "General PC Settings" window select Advanced Startup. Click on the "Restart now" button. Your computer will now restart into "Advanced Startup options menu".
Click on the "Troubleshoot" button, then click on "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into the Startup Settings screen. Press "5" to boot in Safe Mode with Networking Prompt.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".
In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Step 2
Log in to the account infected with the "McAfee has Blocked your Windows Screenlocker" virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.
If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.
Video showing how to remove viruses using "Safe Mode with Command Prompt" and "System Restore":
1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.
2. When Command Prompt Mode loads, enter the following line: cd restore and press ENTER.
3. Next, type this line: rstrui.exe and press ENTER.
4. In the opened window, click "Next".
5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the "McAfee has Blocked your Windows Screenlocker" virus infiltrating your PC).
6. In the opened window, click "Yes".
7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remnants of the "McAfee has Blocked your Windows Screenlocker" virus.
If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some viruses disable Safe Mode making removal more complicated. For this step, you require access to another computer.
After removing "McAfee has Blocked your Windows Screenlocker" virus from your PC, restart your computer and scan it with legitimate anti-spyware software to remove any possible remnants of this security infection.
Other tools known to remove this scam:
Summary:
Commonly, adware or potentially unwanted applications infiltrate Internet browsers through free software downloads. Note that the safest source for downloading free software is via developers' websites only. To avoid installation of adware, be very attentive when downloading and installing free software. When installing previously-downloaded free programs, choose the custom or advanced installation options – this step will reveal any potentially unwanted applications listed for installation together with your chosen free program.
Post a comment:
If you have additional information on "webroot has blocked your windows" scam or it's removal please share your knowledge in the comments section below.
Outstanding!
▼ Show Discussion