"McAfee has Blocked your Windows" Locker - How to remove

A technical support scam and a screenlocker, “McAfee has Blocked your Windows” is not actually affiliated with McAfee. It’s just a new iteration of the “Your Windows Has Been Banned” locker.

This “McAfee has Blocked you Windows” malware works like a screen locker, a type of ransomware. However, instead of asking for money directly, a fake alert is displayed on your computer screen, trying to scare and manipulate you into contacting scammers who can then trick people into paying money for fake PC protection, like a technical support scam.

The fake “McAfee has Blocked you Windows” warning urges you to contact the “McAfee Technical Department” by calling (301) 900-8084 to get the “Code to Unblock your Computer”, implying that you will not be able to use it without their help. These are just scare tactics — do not call the number, there is nothing to be gained from talking to tech support scammers.

What does it do? Is it dangerous?

This malware displays a message announcing that “Suspicious Activity” has been detected on the victim’s computer and that the computer is infected with “Harmful Viruses” that are “well known for identity and credit card theft”.

McAfee has Blocked your Windows

This PC has been blocked because of Suspicious Activity Detected. To Protect the Windows Services and it’s members Call McAfee Technical Department (301) 900-8084.

McAfee Security Alert Code: 055BCCAC9FEC

Your PC has been blocked because we detected an unusual activity on your computer.
Your Computer might be Infected by Harmful Viruses.
These viruses are well known for identity and credit card theft.
Further action on this computer or any other device on your network might reveal private information and involve serious risks.
McAfee Technicians will help you getting the Code to Unblock your Computer.
Please Call McAfee Technical Department (301) 900-8084.

Call McAfee Technical Department: (301) 900-8084

Please provide the McAfee Security Alert Code to our Technician.

In reality, the only virus in this situation is the one displaying the message.

“McAfee has Blocked you Windows” does disrupt work and is annoying to deal with. On its own, though, this specific screenlocker is not dangerous to your data: it won’t encrypt, steal, or delete your files. However, people who are unfamiliar with this type of malware can be vulnerable to the social engineering efforts. This malware implies that your banking information is in danger of falling into criminal hands, creating a sense of urgency; it feels wrong to not try and fix the “issue” as soon as possible, and the McAfee name provides authority and gains people’s trust.

Often tech support scammers trick their victims into installing on their personal computers remote access software and giving the scammers access to all the files on a computer. That’s when the victim can have their personal information stolen, spyware and even ransomware installed, and be tricked into believing that their computer is filled with viruses that the scammers offer to remove in exchange for the price of hundreds of dollars.

Tech support scams have long been successfully cheating people out of their money. Luckily, people are becoming more skeptical and more aware of the scammers out there. Still, scammers remain active and continue to improve their tactics.

How does “McAfee has Blocked your Windows” spread?

This malware likely infects computers the same way most malware does:

• Through unofficial or fake installers of desired software: malware can be installed in the background, without the user’s knowledge or consent.
• Through malicious emails, by distributing infected attachments or download links.

It is probable that, if you have this malware, there are other malicious programs lurking on your machine — after all, most of them spread the same way.

How to avoid it in the future?

Look at the message carefully. First of all, do you have McAfee installed at all? Research the warning, for example, type a few lines of the message into a search engine and see what other people are saying about it. Google the phone number before you call it.

Be careful about downloading software from unofficial sources. Always check the files you download with whatever antivirus program you are using. It is also a good idea to have a professional antivirus program installed, updated, and have it scan your files regularly. A professional antivirus app like Spyhunter, malwarebytes or another reputable program.

How to get rid of the “McAfee has Blocked your Windows” locker?

MalwareHunterTeam have already found the code that will unlock the “McAfee has Blocked your Windows” locker:

H3J9-Z7K5-W5Y1-Q6L4

That’s a weird conglomeration of ransomware and tech support scam ??‍♀️

— Lesley Carhart (@hacks4pancakes) April 3, 2019

Just type it into the bottom text field and click the “Submit” button.

After that, you will have to remove the virus from your computer. You can do that manually, by going to Control Panel, or with the help of an antimalware app.

Automatic Malware removal tools

How to remove "McAfee has Blocked your Windows" Locker using Windows Control Panel

Many hijackers and adware like McAfee has Blocked your Windows Locker install some of their components as regular Windows programs as well as additional software. This part of malware can be uninstalled from the Control Panel. To access it, do the following.

• Start→Control Panel (older Windows) or press Windows Key→Search and enter Control Panel and then press Enter (Windows 8, Windows 10).
• Choose Uninstall Program (if you don't see it, click in the upper right next to "View by" and select Category).
• Go through the list of programs and select entries related to "McAfee has Blocked your Windows" Locker . You can click on "Name" or "Installed On" to reorder your programs and make McAfee has Blocked your Windows Locker easier to find.
• Click the Uninstall button. If you're asked if you really want to remove the program, click Yes.
• In many cases anti-malware programs are better at detecting related parasites, thus I recommend installing Spyhunter to identify other programs that might be a part of this infection.