Delete Fake “Microsoft Office Activation Wizard” Warning Virus

Fake Microsoft Office Activation Wizard is a tech support scam designed to extort money from Windows users. The malware locks your computer and asks for Microsoft Office software activation. It pretends to be a legitimate warning and looks like a component of the operating system. In reality it is just a malware limiting the access to your computer. Sometimes it appears even if you do not have Microsoft Office installed on your computer at all.

The scammers provide a fake Toll-Free phone support line. You are required to call the line in order to receive an activation code. The criminals will ask for a payment before providing the code. The line might charge high rates for calling as well since it is not a legitimate Windows support center. You should never follow the instructions provided by the scammers. Instead, read below on how to remove this fake “Microsoft Office Activation Wizard”.

The required product key has already been discovered by virus researchers and it is possible to remove this fake warning quite easily. However, after unlocking you should remove the malware from your computer completely. Therefore, we have an automatic tool which will scan your PC and remove the threats. It will also protect it in the future. We also have a manual removal guide if you feel comfortable editing important Windows system files and settings. However, you will only remove the symptoms and a proper protection will still be needed in order to avoid infections in the future.


Recommended Method: Download Activation Wizard Scam Removal Tool

Version:   All Updated:   2 days ago Compatible OS:   All
This is the most suitable program for automatically removing the threat and repairing your PC.
Works with: Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP. Read instructions here
File name Size
mb3-setup.exe 56.5 MB

Click here to download alternative tool

What is Microsoft Office Home and Student Activation Wizard scam?

This fake warning targets unsuspecting Windows users and tries to persuade them that their Microsoft Office license needs activation. A limited number of days is given before “the product becomes unlicensed”. In reality the warning is unrelated to legitimate Microsoft Office software. The popup will still appear if you have an activated copy of the software installed or even if you do not have Microsoft Office at all.

The design is made to resemble legitimate Windows warning so even an experienced user might find it hard to distinguish between this and a real system popup. It even includes Help and Privacy Statement buttons and an option to activate the product over the internet (although not working and forcing you to call the support line). The only giveaway is that it usually limits other computer functionality as well by staying on top of other applications: a legitimate Microsoft Office error would only limit access to this software only. Also, you can spot spelling and grammar mistakes (e.g. misspelled word “becames”) although in general it is more professionally made than many other fake lockers.

Here is an example of a warning screen text:

Microsoft Office Home and Student 2016
Activation Wizard
Thank you for installing Microsoft Office Home and Student 2016. Activation is required to
authenticate this copy of Microsoft Office. This wizard will guide you through the
Activation process.
How do you want to activate your software?
* I want to activate the software over the Internet. (recommended)
* I want to activate the software by telephone.
Toll-Free : 1 800 935 6918
If you choose not to activate at this time, you may run the software for 29 more days before
the product becames unlicensed. Click Help for more information.

The next activation step shows the following instructions:

Enter your product key
Your product key is 25 characters and is typically found in your
product packaging . Toll-Free : 1 800 935 6918
See product key examples

Sign in with an active account instead
Attempt to automatically activate my product online.

The most common way to get infected by this trojan is by installing another software or downloading suspicious files, torrents and applications. It usually comes bundled with other programs and hides deeply in the installation settings which are usually skipped during the process. There are many ways for this trojan to spread and the only reliable way to save your computer from being infected is to have a proper antivirus software.

You should remove this virus as soon as possible. This is required in order to restore a regular access to your machine. Also, you need to remove all files belonging to the malware in order to make sure that the scammers do not have access to your personal data. We have prepared a manual removal guide, however, we recommend the automatic tool listed above as it is both the easiest and most reliable option. The removal tool will also protect your computer from any possible viruses in the future as well.

Here are some screenshots of Microsoft Office Activation Wizard virus:

  


 Manual Removal Instructions:

NB: Removing the virus manually will only remove the symptoms. We recommend using the automatic tool provided above in order to secure your computer from any possible breaches in the future as well.

Make sure you bookmark this page as a computer restart will be required. We recommend opening this instructions page on a separate page while working on the removal process.

Step 1:

Start by identifying the screen locker process.

IMPORTANT: You need to perform this action while the “Activation Wizard” popup is being displayed.

Press at the same time: CTRL + SHIFT + ESC to launch Windows Task Manager.

Alternatively you can launch the Task Manager by right-clicking on Windows toolbar/startbar and clicking Start Task Manager.

Look for Activation Wizard under the Applications tab.

Right-click on it and choose Go To Process.

This should open Processes tab and highlight the process belonging to the virus.

Right-click on it and choose Open File Location.

A new folder will open with the virus file highlighted.

Go back to Task Manager and click End Process.

Then Delete the file in the opened folder.

Step 2:

If you cannot identify the threat using the Step 1 you can simply enter this code in order to remove the locker:

THTY4-89LK6-RTI23-XZTOP-05ERY

Use this step only if the first one fails.

Step 3:

Clean up Windows temporary files as the virus might operate from this folder.

Removing all temporary files is completely safe for your computer.

Hold Windows () key and click R key.

Enter the following in the field:

%Temp%

Click OK.

Simply select all files and folders displayed in the temporary files directory and delete them permanently by simultaneously pressing CTRL + A and then SHIFT + DELETE.

Step 4:

Remove suspicious programs from your startup config so they would not launch as soon as you boot your computer.

Hold Windows () key and click R key.

Enter the following in the field:

msconfig.exe

Click OK.

Go to the Startup tab and uncheck all suspicious entries.

The infected or fake startup items usually have “Unknown” listed as Manufacturer. However, sometimes they might pretend to be legitimate programs.

Check process location by hovering your mouse over the “Command” column. Navigate to the location and scan the file using virustotal.com if it looks suspicious but you are not sure.

Click OK when you are finished unselecting all potentially dangerous processes.

Step 5:

Check for any recent changes in all the other important files.

Press and hold Windows () key and click R key.

Enter the following in the field:

%AppData%

Click OK.

You don’t need to delete anything here. Just search for any recent changes (by “Date Modified”) in the files. If you see that the files have just been changed, then scan them with virustotal.com and remove if needed. If there are no suspicious changes just leave everything as it is.

Repeat this step with the following three directories:

%LocalAppData%
%ProgramData%
%WinDir%

Remember: delete something only if it has been modified recently and is infected according to VirusTotal scans. Otherwise you might remove critical system files!

Step 6:

This is an additional step to make sure you remove all impact to your system settings made by this fake Activation Wizard.

You need to have a relatively recent restore point in order to restore your settings successfully. If you restore a very old restore point some unwanted settings might come back. Also, make sure the restore point has been created before the infection happened.

Restore the old system settings using System Restore.

Press and hold Windows () key and click R key.

Enter the following in the field:

rstrui.exe

Click OK.

Click Next.

Check Show more restore points.

If you see any restore points, restore the system. Make sure you select a point that has been created before the infection happened but is not too old.

It will restore your system settings only and will not affect your files.

If you do not see any restore points they might have never been created.

After removing the virus

When you have finished removing the virus make sure to protect your computer by installing a good antivirus suite that would identify the threats online and in programs you have downloaded. Also avoid downloading unofficial torrents, illegal cracks or other files from P2P networks to make sure fake “Microsoft Office Activation Wizard” or any other malware does not infiltrate your machine again.


Share your experience with us by leaving a comment!

Leave a comment to tell us about your experience removing this threat!
We can also help you if you run into any problems during the process, just don't hesitate to ask!

Leave a Reply

Your email address will not be published. Required fields are marked *