Beware the “Windows Was Blocked Due To Questionable Activity” Scam Pop-up

The “Windows was blocked due to questionable activity” pop-up is a common tech support scam designed to trick users into calling fraudulent “support” numbers and giving remote access to their computers. This elaborate scam utilizes intimidation and fear to manipulate users into believing there is a serious issue with their device that requires immediate tech support.

In this comprehensive guide, we will cover everything you need to know about the “Windows was blocked due to questionable activity” scam, including how it works, what to do if you are targeted, and how to protect yourself going forward.

An Overview of the Scam

The “Windows was blocked due to questionable activity” scam is one of the more persistent and troubling tech support scams targeting Windows users today. It works by redirecting the user’s browser to a fake website and displaying an alarming pop-up message warning of hacking activity or viruses detected on the computer.

This message is designed to appear as if it originates from Microsoft or Windows Security. The pop-up will say that due to the detected questionable activity, Windows has blocked access to the computer to prevent further damage.

To purportedly regain access and remove the non-existent threats, the user is instructed to call a listed “support” number. In reality, this number connects to a fraudulent call center run by cybercriminals.

Once on the phone with the scammers, victims are pressured into allowing remote access to their computer and paying for useless or harmful “security” software and services. The scammers may also obtain private information or install malware during the remote access session.

This scam is very convincing due to its official look and urgent warning messages. Many users are understandably frightened into calling the number, believing Microsoft has detected a real issue. However, the pop-up is fake and the phone number connects to scammers, not Microsoft support.

How the Scam Works

The “Windows was blocked due to questionable activity” scam is orchestrated in several steps designed to convince and pressure victims. Here is a breakdown of how this scam typically operates:

1. The Redirect

The first step is redirecting the user’s browser to the scam website. There are a few common ways this is accomplished:

• Malicious ads or pop-ups: Advertisements infected with malware may automatically redirect to the scam site when clicked.
• Search engine results: Certain search terms may trigger scam sites to appear at the top of results. Clicking these links brings users directly to the fake pop-up.
• Malicious links: The scam website URL may be disguised as a legitimate link sent through email or messaging apps. Clicking the link triggers the redirect.
• Software bundles: Some free software downloads bundle the scam malware, causing an automatic redirect when the software is installed.

Once on the scam website, the threatening pop-up is displayed full screen, preventing easy exit from the browser.

2. The Pop-Up Message

The fake pop-up is designed to look like an official Windows Security alert. It will appear with the Windows logo and contain the following types of messages:

• “Windows Detected Suspicious Activity” – Claims hackers or viruses have been detected on your computer and Windows was forced to block access to protect your data.
• “Microsoft Support Alert” – Says Microsoft support has detected malware or suspicious activity and access is blocked until you contact support.
• “Windows Firewall Warning” – Claims the firewall has been disabled by questionable activity and your IP address is at risk.

These messages instill fear and a sense of urgency in the victim that their computer is in jeopardy and only Microsoft Support can help. Various threats about permanent damage or stolen data are used to scare and manipulate the user.

3. The “Support” Number

The pop-up will prominently display a toll-free number stated to be Official Microsoft Support. The message urges the user to call the number immediately to remove viruses/blockers and regain access to their computer.

Of course, this number does not actually connect to Microsoft. Instead, it routes to a call center run by cybercriminal scammers posing as “certified technicians.” Once on the phone, their goal is to trick the victim into paying for fake tech support services.

4. The Phone Call

When victims call the number, the scammers pose as helpful Microsoft Support technicians and walk callers through a series of convincing steps designed to prove the computer has security issues.

For example, they may:

• Ask the user to open Windows Event Viewer, then point out harmless error logs as “proof” of viruses, hacking, or other issues.
• Direct the victim to open a Command Prompt and type “assoc” and “tasklist” to showcase normal background processes as suspicious activity.
• Claim legitimate Windows files are infected files.

These techniques give the appearance of advanced technical knowledge and make victims believe the scammers have uncovered real threats on their system. The scammers present themselves as the only ones who can fix these dire issues.

5. Demands for Payment

Once the scammers have gained the user’s trust, they will request remote access to the computer to begin removing the non-existent viruses and hacking activity. This gives the scammers full control of the device without the owner monitoring what they are doing.

At this point, the scammers may:

• Install genuine antivirus software trials, then pretend to remove threats it detects (which are harmless, common files).
• Run fake security scans that always indicate dangerous problems.
• Open innocuous system files or logs and claim they are malware.
• Download actual malware disguised as “security software.”
• Quietly access any personal data on the device.

After fabricating extensive problems, the scammers will insist on payment to clean and secure the computer properly. The fees typically range from $100 to $500.

The scammers may request these payments through prepaid gift cards, bank transfers, credit cards, Bitcoin, or other hard-to-trace methods. Many victims pay the fees, convinced the issue is real.

Of course, after the payment is collected, the scammers disappear without fixing anything. The victim’s computer and personal information remains exposed to future cyber attacks.

What to Do If You Get the Fake Pop-up

If the “Windows was blocked due to questionable activity” pop-up appears on your screen, do not call the number or follow any instructions. This scam pop-up does not originate from Microsoft or your security software. Remember these key tips:

Close the Browser Immediately

As soon as the pop-up appears, close the browser window. This will prevent any malicious activity or software from being downloaded. Try closing the browser through the task manager if it will not close normally.

Do Not Call the Number

No matter how threatening the message seems, do not call the number listed on the pop-up. Microsoft will never provide a support number this way. Calling will only give scammers remote access to take advantage of you.

Disconnect from the Internet

After closing the browser, disconnect your computer from the internet and WiFi. This prevents remote access by scammers who may have already connected to your device. Do not go online again until the scam is cleaned from the computer.

Scan for Malware

Run a scan with Malwarebytes to detect and remove any potential viruses, spyware, or other malware that may have been downloaded due to this scam. Malware may have been installed to continue redirecting your browser.

Reset Your Browser

Reset your browser to default settings to clear out any dubious configuration changes, plugins, or cached files associated with the scam site. This helps prevent the browser being redirected again.

Update Your Software

Make sure your operating system, security software, browser, and any software installed on your computer is completely up to date. Software updates often patch vulnerabilities that scammers exploit to implant malware.

Change All Passwords

If you entered any login credentials, banking information, or other sensitive data during the scam pop-up or call, immediately change those passwords and enable two-factor authentication where possible.

Monitor Accounts for Suspicious Activity

Carefully monitor bank accounts, credit cards statements, and online accounts over the next weeks for any unauthorized charges or activity. Report any suspicious transactions to the relevant institutions.

Make an FTC Complaint

File a complaint with the U.S. Federal Trade Commission (FTC) about the scam call. This helps authorities track and shutdown scammer operations.

By promptly following these steps, you can contain the scam before any significant damage is done. Do not let the convincing pop-ups or calls trick you again in the future.

What If You Already Called the Scammers?

If you have already called the number and given scammers remote access to your computer, take the following actions immediately:

End the Call

If you are still on the phone with scammers, hang up immediately. If they call back, do not answer. They may try to pressure or reassure you, but cease all communication.

Disable Remote Access

Go into your computer’s settings and disable any remote access tools that have been enabled, such as AnyDesk, TeamViewer, UltraViewer, or similar. This revokes the scammer’s control over your computer.

Run Anti-Malware Scans

Run thorough scans to detect and remove any malware, spyware, or other illegitimate software the scammers may have installed during the remote session. Delete anything suspicious or unfamiliar.

Disconnect from the Internet

Disconnect your computer from the internet, WiFi, and any wired connections. Do not reconnect until you are sure all remote access has been disabled and malware removed.

Reset Passwords

Change the passwords for all accounts that have been accessed during the scam, including online banking, email, social media, etc. Enable two-factor authentication if possible.

Shut Down the Computer

Performing a full shutdown will kick out any active remote connections. When restarting, carefully check for any suspicious new programs that may have been installed.

Contact Banks and Credit Cards

Alert your financial institutions of potential fraud if banking information or credit cards were accessed. Have them monitor for unauthorized transactions and issue new cards if needed.

Factory Reset the Computer

If you are unsure whether all malware and scammer access has been removed, perform a factory reset to wipe the computer and start fresh. Make sure to backup important files externally first.

Inform the Authorities

Notify the FTC and local law enforcement about the fraudulent call and provide any details that may help track the scammers. File a cybercrime report if sensitive information was compromised.

Performing these steps quickly can help limit the damage from providing scammers remote access. But always be more vigilant going forward and never trust unsolicited calls or pop-ups.

Remove Malware from Windows

To check you device for malware and remove it, follow the bellow steps:

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Malwarebytes Anti-Malware to remove malware and unwanted programs
• STEP 4: Use HitmanPro to scan your computer for badware
• STEP 5: Use AdwCleaner to remove adware and malicious browser policies

STEP 1: Uninstall malicious programs from Windows

In this first step, we will manually check if any unknown or malicious programs are installed on the computer. Sometimes adware and browser hijackers can have a usable Uninstall entry that can be used to remove them.

With the malicious programs removed, you’re ready for the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Malwarebytes Anti-Malware to remove malware and unwanted programs

In this third step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 4: Use HitmanPro to scan your computer for badware

In this next step, we will scan the computer with HitmanPro to ensure that no other malicious programs are installed on your device.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 5: Use AdwCleaner to remove adware and malicious browser policies

In this final step, we will use AdwCleaner to remove the malicious browser policies that were set by browser hijackers on your computer and delete malicious browser extensions.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

Protecting Yourself in the Future

Once you have freed your computer from the “Windows was blocked due to questionable activity” scam, take measures to prevent it from occurring again in the future:

Keep Your Software Patched and Updated

Continuously update Windows, your browser, antivirus software, and all installed programs and apps. Software updates often include vital security patches. Out-of-date apps are vulnerable to exploitation.

Exercise Caution with Links and Ads

Never click on random links, pop-up ads, or unfamiliar email attachments and links. Verify the source first, and scan any downloaded files with antivirus software before opening.

Use Ad and Pop-up Blockers

Install ad-blocking and pop-up blocker extensions in your browser. Use the pop-up blocker settings in Windows Security. These prevent malicious ads – a common redirect method.

Be Wary of Searches

Closely check search engine results for scam sites. Avoid clicking questionable links even if they appear at the top of results. Stick to well-known legitimate sites.

Don’t Call Unsolicited Numbers

Microsoft, Apple, and other tech companies do not send unsolicited notifications instructing users to call tech support. Any pop-up with a phone number is fraudulent.

Hang Up on Suspicious Callers

If you answer an unsolicited call claiming to be tech support, just hang up. Real support will not call unexpectedly with claims of viruses or account compromise.

Never Allow Remote Access

Do not grant remote control of your computer to any unsolicited caller. Microsoft and legit support will not request this type of access. Remote tools enable scammers to steal data and install malware.

Use Strong Passwords

Create unique, complex passwords for all online accounts. Enable two-factor authentication where possible. With remote access, scammers can steal account credentials and data.

Back Up Your Data

Regularly back up important data to an external hard drive or cloud service. Backups protect you from the threat of scammers encrypting files and demanding ransom (another common scam technique).

Install Anti-Malware Protection

Protect devices with comprehensive anti-malware software from trustworthy vendors like Norton, McAfee, Avast, AVG and others. Run frequent scans to detect and halt any malicious activity.

Staying vigilant against suspicious calls, links, pops-up and unfamiliar downloads can protect you from this scam. But if you do receive the fake alert, avoid panic and refrain from calling the number or complying with demands. With the right precautions, you can detect these scams and keep your device secure.

Here is an FAQ section about the “Windows was blocked due to questionable activity” tech support scam:

Frequently Asked Questions

What is the “Windows was blocked due to questionable activity” scam?

This is a fraudulent tech support scam where victims receive a fake pop-up message claiming to be from Microsoft/Windows Support. The pop-up says a security issue was detected and access to your computer has been blocked. You are instructed to call a provided number to get the supposed issue resolved. In reality, the number leads to scammers who will request remote access or payment to “fix” non-existent problems.

Why do I see a pop-up saying Windows blocked my computer?

The pop-up is not real and does not come from Microsoft. Scammers create the fake security pop-ups to scare users into calling them for fraudulent “support services”. Your computer has likely not been hacked or infected. The pop-up is simply attempting to trick you.

Is there really a virus infecting my computer?

No, the pop-up is a scam tactic to make you think your computer has a security issue. They want to trick you into allowing remote access or paying for useless services. Unless indicated by your current security software, your computer likely does not have any real threats present.

Should I call the number listed on the pop-up?

No, you should never call the number shown on unsolicited security pop-up messages. The numbers connect you to scammers, not legitimate Microsoft Support. Calling them gives the scammers an opportunity to remotely access your computer.

What if I already called the number?

If you already spoke to someone claiming to be Microsoft Support and allowed remote access, disconnect from the call immediately. Then disable remote access tools, run anti-malware scans, reset passwords, monitor financial accounts, and contact authorities – see the steps outlined above.

Does Microsoft really block computers like this?

No, Microsoft does not block users from accessing their own devices in response to questionable activity. The company has no ability to lock consumers out of their own computers. Any pop-up claiming to do so is fraudulent.

How can I prevent this scam pop-up in the future?

Install comprehensive security software, avoid clicking suspicious links/ads, refrain from calling unsolicited numbers, never allow unexpected remote access to your computer, and keep software updated. See the prevention tips above for more details.

What should I do if I see this pop-up again?

Follow the steps outlined above – close the browser, do not call the number, run anti-malware scans, etc. Report the scam pop-up to the FTC to help identify and shutdown these scammers going forward.

Who do I contact for legitimate Microsoft Support?

Go directly to Microsoft’s Support webpage at https://support.microsoft.com/ or start an online chat with a verified Microsoft agent if you require legitimate technical assistance. Never call random numbers that pop-up on your screen.

This FAQ covers the key questions regarding the “Windows was blocked due to questionable activity” scam. Remember – any pop-up claiming your computer is locked while providing a phone number is fraudulent. Use caution and critical thinking before calling unverified numbers or allowing remote system access.

The Bottom Line

The “Windows was blocked due to questionable activity” scam is a persistent fraudulent pop-up and call designed to extort money and compromise your computer. Its alarming messages and claims are false but can seem quite real and concerning.

If this scam pops up on your device, close the window immediately and do not call the number. Disconnect from the internet and run anti-malware scans to check for other malware or unwanted remote connectivity tools. Never allow unsolicited callers claiming to be Microsoft support to access your computer.

With some vigilance and updated security software, you can protect yourself and avoid becoming a victim of this scam. Do not fall for the fake warnings – Microsoft will never lock your computer or demand you call a provided support number. Following prudent security practices will help safeguard you from the many deceptive tech support scams targeting unsuspecting users across the internet today.