Beware the “Windows Was Blocked Due To Questionable Activity” Scam Pop-up

The “Windows was blocked due to questionable activity” pop-up is a common tech support scam designed to trick users into calling fraudulent “support” numbers and giving remote access to their computers. This elaborate scam utilizes intimidation and fear to manipulate users into believing there is a serious issue with their device that requires immediate tech support.

In this comprehensive guide, we will cover everything you need to know about the “Windows was blocked due to questionable activity” scam, including how it works, what to do if you are targeted, and how to protect yourself going forward.

An Overview of the Scam

The “Windows was blocked due to questionable activity” scam is one of the more persistent and troubling tech support scams targeting Windows users today. It works by redirecting the user’s browser to a fake website and displaying an alarming pop-up message warning of hacking activity or viruses detected on the computer.

This message is designed to appear as if it originates from Microsoft or Windows Security. The pop-up will say that due to the detected questionable activity, Windows has blocked access to the computer to prevent further damage.

To purportedly regain access and remove the non-existent threats, the user is instructed to call a listed “support” number. In reality, this number connects to a fraudulent call center run by cybercriminals.

Once on the phone with the scammers, victims are pressured into allowing remote access to their computer and paying for useless or harmful “security” software and services. The scammers may also obtain private information or install malware during the remote access session.

This scam is very convincing due to its official look and urgent warning messages. Many users are understandably frightened into calling the number, believing Microsoft has detected a real issue. However, the pop-up is fake and the phone number connects to scammers, not Microsoft support.

How the Scam Works

The “Windows was blocked due to questionable activity” scam is orchestrated in several steps designed to convince and pressure victims. Here is a breakdown of how this scam typically operates:

1. The Redirect

The first step is redirecting the user’s browser to the scam website. There are a few common ways this is accomplished:

• Malicious ads or pop-ups: Advertisements infected with malware may automatically redirect to the scam site when clicked.
• Search engine results: Certain search terms may trigger scam sites to appear at the top of results. Clicking these links brings users directly to the fake pop-up.
• Malicious links: The scam website URL may be disguised as a legitimate link sent through email or messaging apps. Clicking the link triggers the redirect.
• Software bundles: Some free software downloads bundle the scam malware, causing an automatic redirect when the software is installed.

Once on the scam website, the threatening pop-up is displayed full screen, preventing easy exit from the browser.

2. The Pop-Up Message

The fake pop-up is designed to look like an official Windows Security alert. It will appear with the Windows logo and contain the following types of messages:

• “Windows Detected Suspicious Activity” – Claims hackers or viruses have been detected on your computer and Windows was forced to block access to protect your data.
• “Microsoft Support Alert” – Says Microsoft support has detected malware or suspicious activity and access is blocked until you contact support.
• “Windows Firewall Warning” – Claims the firewall has been disabled by questionable activity and your IP address is at risk.

These messages instill fear and a sense of urgency in the victim that their computer is in jeopardy and only Microsoft Support can help. Various threats about permanent damage or stolen data are used to scare and manipulate the user.

3. The “Support” Number

The pop-up will prominently display a toll-free number stated to be Official Microsoft Support. The message urges the user to call the number immediately to remove viruses/blockers and regain access to their computer.

Of course, this number does not actually connect to Microsoft. Instead, it routes to a call center run by cybercriminal scammers posing as “certified technicians.” Once on the phone, their goal is to trick the victim into paying for fake tech support services.

4. The Phone Call

When victims call the number, the scammers pose as helpful Microsoft Support technicians and walk callers through a series of convincing steps designed to prove the computer has security issues.

For example, they may:

• Ask the user to open Windows Event Viewer, then point out harmless error logs as “proof” of viruses, hacking, or other issues.
• Direct the victim to open a Command Prompt and type “assoc” and “tasklist” to showcase normal background processes as suspicious activity.
• Claim legitimate Windows files are infected files.

These techniques give the appearance of advanced technical knowledge and make victims believe the scammers have uncovered real threats on their system. The scammers present themselves as the only ones who can fix these dire issues.

5. Demands for Payment

Once the scammers have gained the user’s trust, they will request remote access to the computer to begin removing the non-existent viruses and hacking activity. This gives the scammers full control of the device without the owner monitoring what they are doing.

At this point, the scammers may:

• Install genuine antivirus software trials, then pretend to remove threats it detects (which are harmless, common files).
• Run fake security scans that always indicate dangerous problems.
• Open innocuous system files or logs and claim they are malware.
• Download actual malware disguised as “security software.”
• Quietly access any personal data on the device.

After fabricating extensive problems, the scammers will insist on payment to clean and secure the computer properly. The fees typically range from $100 to $500.

The scammers may request these payments through prepaid gift cards, bank transfers, credit cards, Bitcoin, or other hard-to-trace methods. Many victims pay the fees, convinced the issue is real.

Of course, after the payment is collected, the scammers disappear without fixing anything. The victim’s computer and personal information remains exposed to future cyber attacks.

What to Do If You Get the Fake Pop-up

If the “Windows was blocked due to questionable activity” pop-up appears on your screen, do not call the number or follow any instructions. This scam pop-up does not originate from Microsoft or your security software. Remember these key tips:

Close the Browser Immediately

As soon as the pop-up appears, close the browser window. This will prevent any malicious activity or software from being downloaded. Try closing the browser through the task manager if it will not close normally.

Do Not Call the Number

No matter how threatening the message seems, do not call the number listed on the pop-up. Microsoft will never provide a support number this way. Calling will only give scammers remote access to take advantage of you.

Disconnect from the Internet

After closing the browser, disconnect your computer from the internet and WiFi. This prevents remote access by scammers who may have already connected to your device. Do not go online again until the scam is cleaned from the computer.

Scan for Malware

Run a scan with Malwarebytes to detect and remove any potential viruses, spyware, or other malware that may have been downloaded due to this scam. Malware may have been installed to continue redirecting your browser.

Reset Your Browser

Reset your browser to default settings to clear out any dubious configuration changes, plugins, or cached files associated with the scam site. This helps prevent the browser being redirected again.

Update Your Software

Make sure your operating system, security software, browser, and any software installed on your computer is completely up to date. Software updates often patch vulnerabilities that scammers exploit to implant malware.

Change All Passwords

If you entered any login credentials, banking information, or other sensitive data during the scam pop-up or call, immediately change those passwords and enable two-factor authentication where possible.

Monitor Accounts for Suspicious Activity

Carefully monitor bank accounts, credit cards statements, and online accounts over the next weeks for any unauthorized charges or activity. Report any suspicious transactions to the relevant institutions.

Make an FTC Complaint

File a complaint with the U.S. Federal Trade Commission (FTC) about the scam call. This helps authorities track and shutdown scammer operations.

By promptly following these steps, you can contain the scam before any significant damage is done. Do not let the convincing pop-ups or calls trick you again in the future.

What If You Already Called the Scammers?

If you have already called the number and given scammers remote access to your computer, take the following actions immediately:

End the Call

If you are still on the phone with scammers, hang up immediately. If they call back, do not answer. They may try to pressure or reassure you, but cease all communication.

Disable Remote Access

Go into your computer’s settings and disable any remote access tools that have been enabled, such as AnyDesk, TeamViewer, UltraViewer, or similar. This revokes the scammer’s control over your computer.

Run Anti-Malware Scans

Run thorough scans to detect and remove any malware, spyware, or other illegitimate software the scammers may have installed during the remote session. Delete anything suspicious or unfamiliar.

Disconnect from the Internet

Disconnect your computer from the internet, WiFi, and any wired connections. Do not reconnect until you are sure all remote access has been disabled and malware removed.

Reset Passwords

Change the passwords for all accounts that have been accessed during the scam, including online banking, email, social media, etc. Enable two-factor authentication if possible.

Shut Down the Computer

Performing a full shutdown will kick out any active remote connections. When restarting, carefully check for any suspicious new programs that may have been installed.

Contact Banks and Credit Cards

Alert your financial institutions of potential fraud if banking information or credit cards were accessed. Have them monitor for unauthorized transactions and issue new cards if needed.

Factory Reset the Computer

If you are unsure whether all malware and scammer access has been removed, perform a factory reset to wipe the computer and start fresh. Make sure to backup important files externally first.

Inform the Authorities

Notify the FTC and local law enforcement about the fraudulent call and provide any details that may help track the scammers. File a cybercrime report if sensitive information was compromised.

Performing these steps quickly can help limit the damage from providing scammers remote access. But always be more vigilant going forward and never trust unsolicited calls or pop-ups.

Remove Malware from Windows

To check you device for malware and remove it, follow the bellow steps:

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Malwarebytes Anti-Malware to remove malware and unwanted programs
• STEP 4: Use HitmanPro to scan your computer for badware
• STEP 5: Use AdwCleaner to remove adware and malicious browser policies

STEP 1: Uninstall malicious programs from Windows

In this first step, we will manually check if any unknown or malicious programs are installed on the computer. Sometimes adware and browser hijackers can have a usable Uninstall entry that can be used to remove them.

Now that the malicious programs have been removed from your computer, we can proceed with the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Malwarebytes Anti-Malware to remove malware and unwanted programs

In this third step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes stands out as one of the leading and widely-used anti-malware solutions for Windows, and for good reason. It effectively eradicates various types of malware that other programs often overlook, all at no cost to you. When it comes to disinfecting an infected device, Malwarebytes has consistently been a free and indispensable tool in the battle against malware. We highly recommend it for maintaining a clean and secure system.

1. Download Malwarebytes for Windows

   You can download Malwarebytes by clicking the link below.

   

   MALWAREBYTES FOR WINDOWS DOWNLOAD LINK
   (The above link will open a new page from where you can download Malwarebytes)
2.  

   Install Malwarebytes

   After the download is complete, locate the MBSetup file, typically found in your Downloads folder. Double-click on the MBSetup file to begin the installation of Malwarebytes on your computer. If a User Account Control pop-up appears, click “Yes” to continue the Malwarebytes installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   When the Malwarebytes installation begins, the setup wizard will guide you through the process.

   • You’ll first be prompted to choose the type of computer you’re installing the program on—select either “Personal Computer” or “Work Computer” as appropriate, then click on Next.

     

   • Malwarebytes will now begin the installation process on your device.

     

   • When the Malwarebytes installation is complete, the program will automatically open to the “Welcome to Malwarebytes” screen.

     

   • On the final screen, simply click on the Open Malwarebytes option to start the program.

     

4. Enable “Rootkit scanning”.

   Malwarebytes Anti-Malware will now start, and you will see the main screen as shown below. To maximize Malwarebytes’ ability to detect malware and unwanted programs, we need to enable rootkit scanning. Click on the “Settings” gear icon located on the left of the screen to access the general settings section.

   

   In the settings menu, enable the “Scan for rootkits” option by clicking the toggle switch until it turns blue.

   

   Now that you have enabled rootkit scanning, click on the “Dashboard” button in the left pane to get back to the main screen.

5. Perform a Scan with Malwarebytes.

   To start a scan, click the Scan button. Malwarebytes will automatically update its antivirus database and begin scanning your computer for malicious programs.

   

6. Wait for the Malwarebytes scan to complete.

   Malwarebytes will now scan your computer for browser hijackers and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check the status of the scan to see when it is finished.

   

7. Quarantine detected malware

   Once the Malwarebytes scan is complete, it will display a list of detected malware, adware, and potentially unwanted programs. To effectively remove these threats, click the “Quarantine” button.

   

   Malwarebytes will now delete all of the files and registry keys and add them to the program’s quarantine.

   

8. Restart your computer.

   When removing files, Malwarebytes may require a reboot to fully eliminate some threats. If you see a message indicating that a reboot is needed, please allow it. Once your computer has restarted and you are logged back in, you can continue with the remaining steps.

   

STEP 4: Use HitmanPro to scan your computer for badware

In this next step, we will scan the computer with HitmanPro to ensure that no other malicious programs are installed on your device.

HitmanPro is a second-opinion scanner that takes a unique cloud-based approach to malware scanning. HitmanPro scans the behavior of active files and also files in locations where malware normally resides for suspicious activity. If it finds a suspicious file that’s not already known, HitmanPro sends it to its clouds to be scanned by two of the best antivirus engines today, which are Bitdefender and Kaspersky.

Although HitmanPro is shareware and costs $24.95 for 1 year on 1 PC, there is no limit on scanning. The limitation only kicks in when there is a need to remove or quarantine detected malware by HitmanPro on your system and by then, you can activate the one-time 30-days trial to enable the cleanup.

1. Download HitmanPro.

   You can download HitmanPro by clicking the link below.

   HITMANPRO DOWNLOAD LINK
   (The above link will open a new web page from where you can download HitmanPro)

2. Install HitmanPro.

   When HitmanPro has finished downloading, double-click on “hitmanpro.exe” (for 32-bit versions of Windows) or “hitmanpro_x64.exe” (for 64-bit versions of Windows) to install this program on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow HitmanPro to make changes to your device. If this happens, you should click “Yes” to continue with the installation.

   

3. Follow the on-screen prompts.

   When HitmanPro starts you will be presented with the start screen as shown below. Click on the “Next” button to perform a system scan.

   

   

4. Wait for the HitmanPro scan to complete.

   HitmanPro will now begin to scan your computer for malicious programs.
   

5. Click on “Next”.

   When HitmanPro has finished the scan, it will display a list of all the malware that it has found. Click on the “Next” button to have HitmanPro remove the detected items.

   

6. Click on “Activate free license”.

   HitmanPro may now require to activate the free 30-days trial to remove the malicious files. To do this, click on the “Activate free license” button to begin the free 30 days trial and remove all the malicious files from your computer.
   

   When the malware removal process is complete, it will display a screen that shows the status of the various programs that were removed. At this screen, you should click on the Next button and then if prompted you should click on the Reboot button. If HitmanPro does not prompt you to reboot, please just click on the Close button.

STEP 5: Use AdwCleaner to remove adware and malicious browser policies

In this final step, we will use AdwCleaner to remove the malicious browser policies that were set by browser hijackers on your computer and delete malicious browser extensions.

AdwCleaner is a free popular on-demand scanner that can detect and remove malware that even the most well-known anti-virus and anti-malware applications fail to find. This on-demand scanner includes a lot of tools that can be used to fix the side effects of adware. browser hijackers and other malware.

1. Download AdwCleaner.

   You can download AdwCleaner by clicking the link below.

   

   ADWCLEANER DOWNLOAD LINK
   (The above link will open a new web page from where you can download AdwCleaner)

2. Double-click on the setup file.

   Double-click on the file named “adwcleaner_x.x.x.exe” to start AdwCleaner. In most cases, downloaded files are saved to the Downloads folder.
   

   AdwCleaner program will now open and you will be presented with the program’s license agreement. After you read it, click on the I agree button if you wish to continue. If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.

   

3. Enable “Reset Chrome policies” to remove malicious browser policies.

   When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable “Reset Chrome policies“.

   

4. Click on the “Scan” button.

   On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

   

5. Wait for the AdwCleaner scan to finish.

   AdwCleaner will now scan your computer for malware. This process can take a few minutes.

   

6. Click on “Quarantine” to remove malware.

   When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button to remove the malicious programs from your computer.

   

7. Click on “Continue” to remove the malicious programs.

   AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean. Click on the “Continue” button to finish the removal process.
   

   AdwCleaner will now delete all detected malware from your computer. When the malware removal process is complete, you may be asked to restart your computer.

Protecting Yourself in the Future

Once you have freed your computer from the “Windows was blocked due to questionable activity” scam, take measures to prevent it from occurring again in the future:

Keep Your Software Patched and Updated

Continuously update Windows, your browser, antivirus software, and all installed programs and apps. Software updates often include vital security patches. Out-of-date apps are vulnerable to exploitation.

Exercise Caution with Links and Ads

Never click on random links, pop-up ads, or unfamiliar email attachments and links. Verify the source first, and scan any downloaded files with antivirus software before opening.

Use Ad and Pop-up Blockers

Install ad-blocking and pop-up blocker extensions in your browser. Use the pop-up blocker settings in Windows Security. These prevent malicious ads – a common redirect method.

Be Wary of Searches

Closely check search engine results for scam sites. Avoid clicking questionable links even if they appear at the top of results. Stick to well-known legitimate sites.

Don’t Call Unsolicited Numbers

Microsoft, Apple, and other tech companies do not send unsolicited notifications instructing users to call tech support. Any pop-up with a phone number is fraudulent.

Hang Up on Suspicious Callers

If you answer an unsolicited call claiming to be tech support, just hang up. Real support will not call unexpectedly with claims of viruses or account compromise.

Never Allow Remote Access

Do not grant remote control of your computer to any unsolicited caller. Microsoft and legit support will not request this type of access. Remote tools enable scammers to steal data and install malware.

Use Strong Passwords

Create unique, complex passwords for all online accounts. Enable two-factor authentication where possible. With remote access, scammers can steal account credentials and data.

Back Up Your Data

Regularly back up important data to an external hard drive or cloud service. Backups protect you from the threat of scammers encrypting files and demanding ransom (another common scam technique).

Install Anti-Malware Protection

Protect devices with comprehensive anti-malware software from trustworthy vendors like Norton, McAfee, Avast, AVG and others. Run frequent scans to detect and halt any malicious activity.

Staying vigilant against suspicious calls, links, pops-up and unfamiliar downloads can protect you from this scam. But if you do receive the fake alert, avoid panic and refrain from calling the number or complying with demands. With the right precautions, you can detect these scams and keep your device secure.

Here is an FAQ section about the “Windows was blocked due to questionable activity” tech support scam:

Frequently Asked Questions

What is the “Windows was blocked due to questionable activity” scam?

This is a fraudulent tech support scam where victims receive a fake pop-up message claiming to be from Microsoft/Windows Support. The pop-up says a security issue was detected and access to your computer has been blocked. You are instructed to call a provided number to get the supposed issue resolved. In reality, the number leads to scammers who will request remote access or payment to “fix” non-existent problems.

Why do I see a pop-up saying Windows blocked my computer?

The pop-up is not real and does not come from Microsoft. Scammers create the fake security pop-ups to scare users into calling them for fraudulent “support services”. Your computer has likely not been hacked or infected. The pop-up is simply attempting to trick you.

Is there really a virus infecting my computer?

No, the pop-up is a scam tactic to make you think your computer has a security issue. They want to trick you into allowing remote access or paying for useless services. Unless indicated by your current security software, your computer likely does not have any real threats present.

Should I call the number listed on the pop-up?

No, you should never call the number shown on unsolicited security pop-up messages. The numbers connect you to scammers, not legitimate Microsoft Support. Calling them gives the scammers an opportunity to remotely access your computer.

What if I already called the number?

If you already spoke to someone claiming to be Microsoft Support and allowed remote access, disconnect from the call immediately. Then disable remote access tools, run anti-malware scans, reset passwords, monitor financial accounts, and contact authorities – see the steps outlined above.

Does Microsoft really block computers like this?

No, Microsoft does not block users from accessing their own devices in response to questionable activity. The company has no ability to lock consumers out of their own computers. Any pop-up claiming to do so is fraudulent.

How can I prevent this scam pop-up in the future?

Install comprehensive security software, avoid clicking suspicious links/ads, refrain from calling unsolicited numbers, never allow unexpected remote access to your computer, and keep software updated. See the prevention tips above for more details.

What should I do if I see this pop-up again?

Follow the steps outlined above – close the browser, do not call the number, run anti-malware scans, etc. Report the scam pop-up to the FTC to help identify and shutdown these scammers going forward.

Who do I contact for legitimate Microsoft Support?

Go directly to Microsoft’s Support webpage at https://support.microsoft.com/ or start an online chat with a verified Microsoft agent if you require legitimate technical assistance. Never call random numbers that pop-up on your screen.

This FAQ covers the key questions regarding the “Windows was blocked due to questionable activity” scam. Remember – any pop-up claiming your computer is locked while providing a phone number is fraudulent. Use caution and critical thinking before calling unverified numbers or allowing remote system access.

The Bottom Line

The “Windows was blocked due to questionable activity” scam is a persistent fraudulent pop-up and call designed to extort money and compromise your computer. Its alarming messages and claims are false but can seem quite real and concerning.

If this scam pops up on your device, close the window immediately and do not call the number. Disconnect from the internet and run anti-malware scans to check for other malware or unwanted remote connectivity tools. Never allow unsolicited callers claiming to be Microsoft support to access your computer.

With some vigilance and updated security software, you can protect yourself and avoid becoming a victim of this scam. Do not fall for the fake warnings – Microsoft will never lock your computer or demand you call a provided support number. Following prudent security practices will help safeguard you from the many deceptive tech support scams targeting unsuspecting users across the internet today.