Fake "Microsoft has disabled your computer" screen leads to a call asking you to install UltraViewer

A fake Windows lock screen shows a "Microsoft Security" number. The person who answers asks you to download UltraViewer so they can get in.

By the Xcelcor Guardian team · Reported October 19, 2026

Is it a scam?

Yes, it's a scam. Microsoft didn't lock your computer and doesn't run that phone number, and real Microsoft support will never ask you to download UltraViewer.

Type

Fake warning pop-up

First reported

October 15, 2026

Status

Still active

Who it targets

Windows users who land on hacked websites, scam ads or spam links, mostly in the US

Tools it uses

UltraViewer, Microsoft (impersonated)

If your screen suddenly said Windows needed an update, then went full screen saying Microsoft has disabled your computer, with alarms and a "Microsoft Security" number, it's a scam. Your computer isn't locked and Microsoft didn't send it. Don't call the number, and don't install anything a caller asks for.

Researchers at the security company Infoblox described this scam on October 15, 2026. They traced it to a network that pushes people from hacked websites, scam ads, spam and social media posts onto fake Microsoft warning pages.

What does the fake Microsoft screen look like?

It starts with a notice that an update is required and your PC will restart. Then it takes over the whole screen with a message that Microsoft has disabled the machine, alarm sounds and a phone number to call. A computer voice tells you not to restart, and says the lock is "designed to stop illegal activity".

The page is very hard to close, which is what makes it so convincing. But it's only a web page in your browser. Nothing has happened to Windows.

How the call plays out

Infoblox researchers called one of the numbers, +1 855-616-3518. The man who answered said he was Microsoft Technical Support and promised there would be no charge. He asked whether the computer was personal or for work, and how the lock had appeared.

He then told them to press Ctrl + Alt + Delete and sign out and back in, which cleared the lock. That step makes the caller look like a real expert. Next he asked them to open a browser, go to ultraviewer.net and download UltraViewer, a real program that lets someone else control your computer.

When the researchers asked why they needed it, since Windows already has Microsoft Defender, the call ended. They never let him in, so the report doesn't show what he would have done next. In other tech support scams, once the caller is connected they show fake problems, ask for payment, or get into online banking.

How do I close it?

1. Don't call the number.
2. Press and hold the Escape key for a few seconds, then close the tab.
3. If that doesn't work, press Ctrl + Shift + Esc to open Task Manager, click your browser and choose End task.
4. When you open the browser again, don't restore the old tabs.

Restarting the computer is fine too.

I called and installed UltraViewer. What now?

Hang up if you're still on the call. Then:

• Disconnect the PC from the internet (unplug the cable or turn off Wi-Fi).
• Call your bank from another phone, using the number on the back of your card, and tell them a scammer may have had access to your computer.
• Change your email password from a different device.
• Uninstall UltraViewer and anything else they told you to install (Settings, then Apps, then Installed apps on Windows 11, or "Apps & features" on Windows 10).

Follow our step-by-step checklist for the rest, and see what to do after someone remotely accessed your computer. You can report it at ReportFraud.ftc.gov, ic3.gov and microsoft.com/reportascam.

How to tell it's fake next time

Microsoft never shows a phone number on a warning, and never asks you to call. Real Microsoft support won't ask you to download UltraViewer, AnyDesk or any other remote control program. A page that fills the screen and tells you not to restart is always a scam. More on these pages is in our guide to fake Microsoft pop-ups that say call this number.

If you or a parent might fall for a call like this, Xcelcor Guardian can help with the next step. It holds any new remote connection on a Windows 11 PC, including tools like AnyDesk, TeamViewer and Quick Assist, until the account holder approves it by email or on xcelcor.com. It doesn't block the pop-up itself.

Last updated October 19, 2026