"Critical alert from Microsoft" Scam - How to remove

“Critical alert from Microsoft”, or “Microsoft has detected…” is fake online security warning and a tech support scam hosted on a site that spoofs a Microsoft support page. “Critical alert from Microsoft” is there to scam people and steal their passwords.

To be clear, Microsoft has absolutely nothing to do with this fake security warning. Microsoft’s name is being used in the text of “Critical alert from Microsoft” in order to discourage people from being suspicious and taking time to research the issue. The impersonators can actually be arrested when they’re found.

What “Critical alert from Microsoft” looks like

Here’s the text on the big red banner that shows up on the screen:

Microsoft has detected a malicious virus alert and blocked your computer.
The system has been infected with a virus.

A computer-generated voice ominously reads out the warning text from the red banner, including the phone numbers of the scammers. Warning sounds play when you try to get out of the “Critical alert from Microsoft” screen.

How it’s actually fake

Do not close this window and restart your computer.This computer’s registration key is blocked. Why your system has been blocked?

• Illegal windows’s registration key.
• This window is sending virus over the internet.
• This window is hacked.
• The location is undefined
• Pirated software is used..

“Critical alert from Microsoft” acts a lot like the other recent fake security warnings/tech support scams that have been spreading, like “Virus Alert from Microsoft”, “Windows Support Alert”, “Your Windows Is Infected With 5 Viruses!”, displaying an alarmist browser warning. It claims that the computer has pirated software installed, that it’s spreading viruses, that it’s hacked. Bans people from closing the browser window (which would actually be the best way of dealing with “Critical alert from Microsoft”) or restarting their computer. The “Critical alert from Microsoft” site makes it very difficult to actually close the browser window. All this is done to try to scare people and make them contact the scammers.

There’s only one thing you need to know to understand why “Critical alert from Microsoft” warnings are all lies: it’s that this warning originates in the browser. Anyone can see this website and see the exact same results, regardless of the state of their computer. Hilariously, even my Android phone gets a “Critical alert from Microsoft”!

The scam “Critical alert from Microsoft” is not connected to Microsoft despite using their name. The phone number +1-888-879-3955(Toll Free) does not belong to Microsoft and the real URL of Window help doesn’t match the URL of the scam. The site that hosts “Critical alert from Microsoft” is lazily constructed from images imitating the original Windows help page. You can even see that by the compression artifacts visible on the “menu” — it’s a screenshot!

How it could be dangerous

If you manage to get off the “Critical alert from Microsoft” website without downloading or revealing anything and contacting anyone, you should be fine. But the site does pose some serious danger.

First, “Critical alert from Microsoft” tries to download files. In case your browser is configured to allow pop-ups and redirects, you’ll be prompted to download and save a file. If you actually download it without your browser crashing, it would be safest to delete it.

“Critical alert from Microsoft” also tries to phish for your Windows credentials. A pop-up asks for your username and password, claiming that it’s required if you’re to receive help from Windows agents. The pop-up is reopened immediately after you close it (except on Firefox), whether you input your credentials or not. Phishing is dangerous because stolen passwords and usernames can be used to hijack online accounts which have saved payment information or hack your computer through Remote Desktop. If you think that your password has been exposed to those behind “Critical alert from Microsoft”, change it as soon as you can.

Most obviously, “Critical alert from Microsoft” is a tech support scam. These scams can trick people and cost them real money. Not a few dozen dollars like some legitimate cybersecurity tools might — tech support scammers cheat people out of hundreds of dollars.

How to get rid of the “Critical alert from Microsoft” warning

You might have trouble closing the browser window. Try to close the window using shortcuts, or end the browser process. Or, if you don’t have unsaved work, restart your computer and do not restore the tabs on your browser.

If you only saw “Critical alert from Microsoft” once, and it’s not repeating, it’s possible that a malicious ad or link took you there. That could mean a problem with the websites that you visit (they should be more careful about what ads they allow to be displayed) or maybe spam emails or messages that spread the malicious link to this scam, but doesn’t necessarily mean that you’re infected with malware (though it can’t hurt to perform a scan).

On the other hand, if you’re constantly being directed to the “Critical alert from Microsoft” page, it’s likely that your computer is infected with some aggressive adware. If that’s the case, a professional antivirus tool like Spyhunter should be able to detect the malware. Then you can work on removing it.

Automatic Malware removal tools

How to remove "Critical alert from Microsoft" Scam using Windows Control Panel

Many hijackers and adware like "Critical alert from Microsoft" install some of their components as regular Windows programs as well as additional software. This part of malware can be uninstalled from the Control Panel. To access it, do the following.

• Start→Control Panel (older Windows) or press Windows Key→Search and enter Control Panel and then press Enter (Windows 8, Windows 10).
• Choose Uninstall Program (if you don't see it, click in the upper right next to "View by" and select Category).
• Go through the list of programs and select entries related to "Critical alert from Microsoft" Scam . You can click on "Name" or "Installed On" to reorder your programs and make "Critical alert from Microsoft" easier to find.
• Click the Uninstall button. If you're asked if you really want to remove the program, click Yes.
• In many cases anti-malware programs are better at detecting related parasites, thus I recommend installing Spyhunter to identify other programs that might be a part of this infection.