"Critical Alert From Microsoft" Scam - How to remove

“Critical alert from Microsoft”, or “Microsoft has detected…” is fake security alert that leads to a tech support scam. The alert isn’t dangerous on its own, but the phone number that it promotes leads to scammers.

The “Critical alert from Microsoft” scam is meant to steal people’s money and their personal information. To be safe, don’t interact with it – just close it.

To be clear, Microsoft has absolutely nothing to do with this fake security warning. Microsoft’s name is being used in the text of “Critical alert from Microsoft” in order to discourage people from being suspicious and taking time to research the issue. The impersonators can actually be arrested when they’re found.

About the “Critical alert from Microsoft” scam:

Type of threat	Scam, phishing.
What the scam looks like	The “Critical alert from Microsoft” warning looks like a Microsoft support page, it says that your computer is blocked because of viruses, it asks you to call a phone number to “reactivate” your computer.
How to recognize fake alerts	They appear in your web browser, they ask you to call a phone number.
How to protect yourself from the “Critical alert from Microsoft” scam	Close the page with the warning, block malicious websites and ads, Protect your computer with antivirus programs (Spyhunter, others).

What “Critical alert from Microsoft” looks like

Here’s the text on the big red banner that shows up on the screen:

Microsoft has detected a malicious virus alert and blocked your computer.
The system has been infected with a virus.

Do not close this window and restart your computer.

This computer’s registration key is blocked. Why your system has been blocked?

• Illegal windows’s registration key.
• This window is sending virus over the internet.
• This window is hacked.
• The location is undefined
• Pirated software is used..

A computer-generated voice ominously reads out the warning text from the red banner, including the phone numbers of the scammers. Warning sounds play when you try to get out of the “Critical alert from Microsoft” screen.

“Critical alert from Microsoft” acts a lot like the other recent fake security warnings/tech support scams that have been spreading, like “Virus Alert from Microsoft”, “Windows Support Alert”, “Your Windows Is Infected With 5 Viruses!”, displaying an alarmist browser warning. It claims that the computer has pirated software installed, that it’s spreading viruses, that it’s hacked.

The “Critical alert from Microsoft” alert warns people to not close the browser window or restarting their computer. The alert insists that you must call the “support” phone number.

How to recognize fake security alerts

The “Critical alert from Microsoft” warnings are fake. There’s a simple way to recognize fake warnings: they originate in the browser.

Anyone can see this website and see the exact same results, regardless of the state of their computer. Even my Android phone gets a “Critical alert from Microsoft”!

The scam “Critical alert from Microsoft” uses Microsoft’s name but it’s not connected to the company.

You can look up the phone number given by the alert (in my case, +1-888-879-3955) – it does not belong to Microsoft. To reach out to Microsoft support, only use the Support.microsoft.com site.

The site address of the “Critical alert from Microsoft” warning is unrelated to Microsoft. In fact, the site that hosts “Critical alert from Microsoft” is lazily constructed from images imitating the original Windows help page. You can even see that by the compression artifacts!

How the “Critical alert from Microsoft” scam is dangerous

If you manage to get off the “Critical alert from Microsoft” website without downloading or revealing anything and contacting anyone, you should be fine. The scam is only dangerous if you follow its instructions.

First, “Critical alert from Microsoft” tries to download files. In case your browser is configured to allow pop-ups and redirects, you’ll be prompted to download and save a file. If you actually download it without your browser crashing, it would be safest to delete it.

“Critical alert from Microsoft” also tries to phish for your Windows credentials. A pop-up asks for your username and password, claiming that it’s required if you’re to receive help from Windows agents. The pop-up is reopened immediately after you close it whether you input your credentials or not.

Phishing is dangerous because stolen passwords and usernames can be used to hijack online accounts which have saved payment information or hack your computer through Remote Desktop. If you think that your password has been exposed to those behind “Critical alert from Microsoft”, change it as soon as you can.

Most obviously, “Critical alert from Microsoft” is a tech support scam. These scams can trick people and cost them real money. Not a few dozen dollars like some legitimate cybersecurity tools might – tech support scammers cheat people out of hundreds of dollars.

How to get rid of the “Critical alert from Microsoft” scam

You might have trouble closing the browser window. Try to close the window using shortcuts, or end the browser process. Or, if you don’t have unsaved work, restart your computer and do not restore the tabs on your browser.

If you only saw “Critical alert from Microsoft” once, and it’s not repeating, it’s possible that a malicious ad or link took you there. That could mean a problem with the websites that you visit (they should be more careful about what ads they allow to be displayed) or maybe spam emails or messages that spread the malicious link to this scam, but doesn’t necessarily mean that you’re infected with malware (though it can’t hurt to perform a scan).

On the other hand, if you’re constantly being directed to the “Critical alert from Microsoft” page, it’s likely that your computer is infected with some aggressive adware. If that’s the case, a professional antivirus tool like Spyhunter should be able to detect the malware. Then you can work on removing it.

Automatic Malware removal tools

How to remove "Critical Alert From Microsoft" Scam using Windows Control Panel

Many hijackers and adware like "Critical alert from Microsoft" install some of their components as regular Windows programs as well as additional software. This part of malware can be uninstalled from the Control Panel. To access it, do the following.

• Start→Control Panel (older Windows) or press Windows Key→Search and enter Control Panel and then press Enter (Windows 8, Windows 10).
• Choose Uninstall Program (if you don't see it, click in the upper right next to "View by" and select Category).
• Go through the list of programs and select entries related to "Critical Alert From Microsoft" Scam . You can click on "Name" or "Installed On" to reorder your programs and make "Critical alert from Microsoft" easier to find.
• Click the Uninstall button. If you're asked if you really want to remove the program, click Yes.
• In many cases anti-malware programs are better at detecting related parasites, thus I recommend installing Spyhunter to identify other programs that might be a part of this infection.