There is a new trojan making the rounds that targets Windows Activation. While not a direct target, it attempts to mimic the activation process, saying your copy of Windows is locked. A series of phone numbers are listed to call and get an activation code to unlock your data. If you encounter this, do not call the numbers.
While these numbers may look like generic service numbers, they aren’t. They go to various countries ("00" is the prefix for international dialing). The countries are: São Tomé and Principe (239), Denmark (45), Madagascar (261) and Globalstar Mobile Satellite Service (8819).
The trojan claims that the call is "free of charge" but it isn’t, and the trojan author will earn money from the call via a technique known as short stopping. This method involves rogue phone operators who route the expensive calls to cheaper countries.
After three minutes or so, the caller is given this unlock code: 1351236.
The unlock code appears to be the same every time the number is called.
It’s a pretty clever bit of social engineering and some victims may never even realize that they’ve been scammed.
