If you ever find yourself confronted by the Windows activation window (the one you see immediately after installing Windows for the first time), at any point after that initial installation, then this trojan may be why.
Trojan.Kardphisher
If a system becomes infected with a trojan virus called Trojan.Kardphisher then a message window will pop-up on your screen.
This message will look identical to the activation window seen straight after a fresh install of the Windows operating system.
You will be issued with a warning that another person activated your copy of Windows -
“To help reduce software piracy, please re-activate your copy of Windows now. We will ask you for your billing details, but your credit card will NOT be charged.
You must activate Windows to continue to use it.
Microsoft is committed to your privacy.
For more information, visit www.microsoft.com/privacy.
Do you want to activate Windows now?”
The purpose of this little ruse should be obvious – any credit card details you may entered will be diverted to a scammer who can then commit fraud by taking funds from your credit card.
He may also be able to use your details to more devastating effect by then stealing your identity too.
Removal
Ideally, you should have a good anti-virus program installed to prevent such a Trojan from entering your system in the first place.
If you already have Kardphisher on your system then it can be removed, though it is not a simple process.
Instructions for removal of this virus can be found on the Semantec site.