How to Remove MS Office Activation Wizard Scam

MS Office Activation Wizard Scam Removal Guide

Remove MS Office Activation Wizard Scam

MS Office Activation Wizard Scam Description and Removal Instructions:

Malware Category: Rogueware

MS Office Activation Wizard Scam is a malicious rogueware that looks like a legitimate office activation screen. However, it will display fake warnings that your MS Office suite is not activated. MS Office Activation Wizard Scam will ask you to call the toll free nuumber and purchase an activation key. The MS Office Activation Wizard Scam injects into the Operating System to change permission policies and to modify the registry. Most likely, MS Office Activation Wizard Scam was installed by the user not knowing that this program is malicious. The distribution of MS Office Activation Wizard Scam is most certainly related to downloading fake Windows updates, installing third-party programs “supposedly” required to properly view a webpage or watch videos, clicking on ads or banners, downloading attachments or receiving files through a social media.

MS Office Activation Wizard Scam might display warning message about corrupted Windows system files. The removal of such files might produce unwanted error messages or to crash your system. All alerts, scan results or pop-up messages are fake.

MS Office Activation Wizard Scam may also disable other software on your PC, like anti-virus security suites or the windows firewall. This is a protection mechanism. Also such rogue software may alter your browser settings and hide itself. Thus, making the removal quite challenging for beginners. If you`re not confident enough, we strongly recommend to remove the infection automatically.

MS Office Activation Wizard Scam may show some of these (or similar) alerts below:

“Microsoft Office Home and Student 2016
Activation Wizard
Thank you for installing Microsoft Office Home and Student 2016. Activation is required to
authenticate this copy of Microsoft Office. This wizard will guide you through the Activation process.
How do you want to activate your software?
* I want to activate the software over the Internet. (recommended)
* I want to activate the software by telephone.
Toll-Free : 1 800 935 6918
If you choose not to activate at this time, you may run the software for 29 more days before
the product becames unlicensed. Click Help for more information.”

The notifications are fake and are used to trick the user that one`s PC is at risk. Such marketing practice would generate income for the developers. Purchasing MS Office Activation Wizard Scam will expose your personal information to third-parties and there is a great change to become a victim of a credit card or identity fraud.

*Please note that such software could lead to more malware coming in your computer and even cause a loss of data. Such threats are not to be underestimated!


How To Remove:

There is an automatic removal, using specialized software suite like SpyHunter (recommended for novice users and fast removal), or manual removal method (recommended for experts), using your own skills to remove the infection.


Automatic MS Office Activation Wizard Scam Removal:

We recommend using SpyHunter Malware Security Suite.

You can download and install SpyHunter to detect MS Office Activation Wizard Scam and remove it.


SpyHunter will automatically scan and detect all threats present on your system.

Learn more about SpyHunter, or if you want to check out the Install Instructions. SpyHunter`s free diagnosis offers free scans and detection. You can remove the detected files, processes and registry entries manually, by yourself, or to purchase the full version to perform an automatic removal and also to receive free professional help for any malware related queries by the technical support department.


Manual MS Office Activation Wizard Scam Removal:

*Please note that you should proceed at your own risk. Some incorrectly taken actions might lead to loss of data or destroy your system. Therefore, the manual removal is strongly recommended for experts only. For everyday users, SpywareTechs.com recommends using SpyHunter or any other reputable security solution.

1. Remove MS Office Activation Wizard Scam by Restoring Your System to a Previous State:

1. Restart your PC into Safe Mode with Command Prompt. To do that, turn your machine off and then start it up again. Then, when the first POST screen appears (white text), start tapping the F8 key repeatedly.

***For Windows 8/10:

If you are using Windows 8/10, you need to hold the Shift button and tap the F8 key repeatedly, this should load the new advanced “recovery mode”, where you can choose the advanced repair options to show up. On the next screen, you will need to click on the Troubleshoot option, then select Advanced Options and select Windows Startup Settings. Click on the Restart button, and you should now be able to see the Advanced Boot Options screen.

2. Use the arrow keys on your keyboard to select the option “Safe Mode with Command Prompt” and hit “Enter”.

3. When the command prompt loads, type the following:

Windows XP: C:\windows\system32\restore\rstrui.exe and press Enter

Windows Vista/7/8/10: C:\windows\system32\rstrui.exe and press Enter

4. System Restore should start up. You will see a list of restore points. Try use a restore point created just before the date and time the problem occurred. When System Restore completes, start your computer in Windows normal mode and scan your computer using anti-spyware software like SpyHunter.


2. Remove MS Office Activation Wizard Scam Under Safe Mode or using a Bootable Disc

1. Reboot your computer by using the information above but select Safe Mode with networking. Alternatively, you can boot the computer from a Bootable CD that you need to prepare before the removal process.

2. *If you are under Safe Mode or Normal Mode, check for the following process running in memory and kill it:

%CommonAppData%\[RANDOM CHARACTERS]\ <random characters>.exe

3. Open Registry Editor (If using Bootable CD -> load the registry hive).


4. Check for the following registry keys for entries or values added by the infection and remove them:


HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell

*Default entry must be: Explorer.exe


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

*Default entry must be: C:\WINDOWS\system32\userinit.exe,


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

*Default entry must be:

Windows XP: rundll32 shell32,Control_RunDLL “sysdm.cpl”

Windows Vista/7/8/10: SystemPropertiesPerformance.exe /pagefile






*Please be extremely careful of modifying the default entries of Shell; UserInit and AppInit as you can break your system.


5. Check the following entries/values and remove/modify them:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ “MS Office Activation” = “MS Office Activation.exe”

6. Uninstall MS Office Activation Wizard Scam from Control Panel (if entry found)

Go to Control Panel and click on Programs and Features (Windows Vista/7/8/10) or Add/Remove Programs (Windows XP) and check the Uninstall Programs` List for any entries related to MS Office Activation Wizard Scam.

*(Start -> Control Panel -> Programs and Features or Add/Remove Programs) or “Win + R” keys to open “Run” and type in “control”, then hit enter.

7. Delete Any Files or Folders Related to MS Office Activation Wizard Scam:

Remove the following files, if found:

MS Office Activation.exe










John Moore

Owner of SpywareTechs.com. I specialize in malware and spyware removal. Researching new malware threats that emerge on the internet. Computers are my hobby since...well more than 10 years. I posses strong knowledge of computer internals and operating systems. However, I use my skills to join the everyday fight against malware and spyware. Follow me on Google+ to stay updated on how to remove the newest infections.

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.