"Microsoft has detected" Scam - How to remove

“Microsoft has detected” is a strange warning about how Microsoft, the company which develops the Windows operating system, has revoked access to your computer.

Microsoft has detected some suspicious activity on this computer. All access to this device has been revoked due to a network security breach. Attackers might attempt to steal personal information, banking details, emails, passwords and other files on this system.

Please contact a Microsoft certified technician on 1-800-603-5246

This warning is fake, crafted to look realistic and scary. “Microsoft has detected” has features of screen-locking ransomware, scareware, phishing, and tech support scams. “Microsoft has detected” is not legitimate, has nothing to do with the real company Microsoft, and its message should not be taken seriously.

How does this scam work?

“Microsoft has detected some suspicious activity” comes in the form of a desktop application. It is a scam that’s ultimately meant to cheat money from people. The fake warning introduces a phone number, behind which sit people who pretend to be technical support specialists working for Microsoft; they aren’t — they’re there to convince you that your computer is horribly infected, to sell bogus scans and overpriced security protection plans.

To ensure that everyone reads the fake warning carefully, the “Microsoft has detected” window can’t be closed easily. You might have to start your computer or open the task manager to be able to use your computer normally again. “Microsoft has detected” may or may not indicate some more dangerous malware lurking on your computer, the situation is different for each individual.

The instructions by “Microsoft has detected” that tell you to call the provided phone number should be ignored. Even now, people still fall for tech support scams and lose time and even money to these criminals.

The real Windows does not show any phone numbers in its alerts, nor does it revoke access to your own computer because of some “network security breach”. Microsoft is certainly aware of the tech support scam problem and has even helped arrest some of the scammers, but programs and websites similar to “Microsoft has detected” continue to appear and trick people.

How did “Microsoft has detected” infect your computer?

In this case, “Microsoft has detected” is not a website, but a little malicious program. It comes attached to or disguised as some application, like this registry cleaner, or this fake Flash player. It’s obviously malware, and malware spreads in a variety of ways:

• False advertising. “Microsoft has detected” could have been downloaded by you voluntarily, while you believed that it was some useful program.
• Fake installers and updates. These can be used to advertise viruses by covering them up with the name of a known and trusted software developer, such as Adobe or Microsoft. They’re usually encountered thanks to malvertising or adware.
• Freeware bundles are known to be risky. Traditionally, shady software distributors attach PUPs (potentially unwanted software) or more serious malware to wanted programs.
• Pirated software can include malware. Pirating has always been risky, with miners, ransomware, and other viruses being distributed in filesharing networks. Being infected with the relatively harmless “Microsoft has detected” is sort of lucky.
• Malicious ads, usually found on shady websites. They might lead to a site that automatically downloads a malware installer, or that prompts you to do that.
• Infected files attached to e-mails. Archive files are especially suspicious, but documents and even images can also carry malicious code. Not to mention files with two extensions, like “picture.jpg.exe” — trying to open a picture would result in malware being run.
• Adware or a trojan that’s already installed on your computer. These viruses can invite malware to your computer.

There are other ways for viruses to spread, such as abusing security bugs in outdated software, or infiltrating a computer through Remote Desktop access. They don’t apply to “Microsoft has detected”, which is a rather unsophisticated fake warning that you could code yourself from scratch if you wanted to.

How to remove “Microsoft has detected”

“Microsoft has detected” screen locker can be got around by rebooting your computer using safe mode, or finding and closing its process, but it needs to be completely removed to get rid of it. If you know which specific program is responsible for the “Microsoft has detected” fake warning, uninstall it using the Control Panel. If you’re not sure, get Spyhunter, or another professional antivirus application to scan your device and see if anything bad is found.

Automatic Malware removal tools

How to remove "Microsoft has detected" Scam using Windows Control Panel

Many hijackers and adware like "Microsoft has detected" Scam install some of their components as regular Windows programs as well as additional software. This part of malware can be uninstalled from the Control Panel. To access it, do the following.

• Start→Control Panel (older Windows) or press Windows Key→Search and enter Control Panel and then press Enter (Windows 8, Windows 10).
• Choose Uninstall Program (if you don't see it, click in the upper right next to "View by" and select Category).
• Go through the list of programs and select entries related to "Microsoft has detected" Scam . You can click on "Name" or "Installed On" to reorder your programs and make "Microsoft has detected" Scam easier to find.
• Click the Uninstall button. If you're asked if you really want to remove the program, click Yes.
• In many cases anti-malware programs are better at detecting related parasites, thus I recommend installing Spyhunter to identify other programs that might be a part of this infection.