Remove “Your Windows PC has been infected” scam (Support Scam Virus)

“Your Windows PC has been infected” is a scam that tries to trick Windows users into calling a fake tech support

Your Windows PC has been infected scam

“Your Windows PC has been infected” scam is a deceptive message that users might encounter during their web browsing sessions. The alert, which tries to imitate the Windows Blue Screen of Death (BSOD)^[1] crash window, informs users that their machine has been infected with malware and riskware and that personal information, such as credit card, banking, Facebook login, and personal files located on the computer is in the process of being compromised. Allegedly, users need to contact Microsoft support by calling 1-888-984-7569, 1-888-465-4185 (or another) number in order to resolve this issue.

However, “Your Windows PC has been infected” is a regular technical support scam that attempts to mislead users about their computer safety status and scare them by threatening with sensitive data compromise. If contacted, cybercriminals would attempt to offer users useless but expensive software, ask for a remote connection to install data-stealing malware and charge for allegedly provided support services. Therefore, never call the provided number, and quick the malicious page without thinking twice.

Name	Your Windows PC has been infected
Type	Fake alert, phishing, tech support scam
Related	System Blocked for Security Reasons, Your Device Has Been Blocked
Claim	The message claims that the computer has been infected and personal information is at risk
Aim	To make users call the fake Microsoft Support techniciants and make them pay money for the alleged services
Distribution	Malicious websites, adware
Risks	Financial losses, malware infections, personal file compromise, privacy issues, identity theft
Removal	You are not in danger, as long as you do not engage with the fraudulent message in any way. Simply close down the tab to leave the page. If you are unable to, call up the Task Manager and shut down the process of your web browser. You should also check your system for adware or other malicious software – you can find the instructions below
Further steps	If you called fraudsters and paid money, contact your bank and try to revert the payment. If your security software flagged something, you should also reset the installed web browsers and perform system fix with tools like Fortect Intego

One of the first signs of “Your Windows PC has been infected” BSOD deception is that it is actually not a Blue Screen of Death. These stop errors occur when Windows has to shut down to prevent damage to software or hardware on the computer (in case you encounter legitimate errors frequently, you can use Fortect Intego to fix them automatically).

However, the “Your Windows PC has been infected” scam notification shows up within the web browser instead. The truth is, no diagnostics about your machine can be performed by a website – even by Microsoft itself. Thus, if you see a suspicious URL trying to convince you about virus infections and asking you to call alleged support – don't, as you will get scammed and lose money.

Besides, while the legitimate error messages can be imitated precisely, it is important to note that Microsoft, Google, or any other reputable tech company would never provide tech support contact information within such an alert. If you are worried, you should instead visit the official website and retrieve the phone number from there.

While you might encounter the “Your Windows PC has been infected” scam alert seemingly out of nowhere, one of the most common reasons for suspicious redirects and ads is adware. This ad-supported software can come in various formats, including browser extensions or programs installed on the system either deliberately or not. The latter case usually happens due to a deceptive marketing technique called bundling, where several programs are offered within a single installer and some components deliberately hidden.

Nonetheless, one of the primary ways to remove “Your Windows PC has been infected” notifications, as well as other suspicious browser activities, is to uninstall the suspicious program from your system. Thus, you should check your browser extensions and the Programs & Features section, as listed below.

If you chose to perform a full system scan with tools such as SpyHunter Combo Cleaner or Malwarebytes Malwarebytes and nothing was detected, you should not be worried anymore. Just as a precautionary measure, you can delete web browser cache/data or reset Google Chrome, Mozilla Firefox, Safari, MS Edge, or another web browser that you are using. You can find all the instructions below.

“Your Windows Is Infected” popup – an older variant of a popular scam

Picture of

“Your Windows Is Infected” is a fake alert that asks to contact tech support service for immediate help to recover the computer from a potential threat. This warning shows up in the new browser’s window.

In the background of the malicious website, users can see unknown symbols on the red background. Once a person visits such site, it also delivers a warning popup saying that Windows 10 is infected with viruses and other malicious applications.

“Your Windows Is Infected” virus also tells that people need to perform virus removal immediately. But if they leave this website, the computer will remain “damaged and vulnerable.” However, it’s just another tactic used by crooks in order to convince users into calling a fake support line.

Cyber criminals as people to contact a “certified technician” by dialing (800) 497-5972. Although the first instinct might encourage to grab your phone, you should not do it for several reasons:

this phone called might be charged more than a regular call;
crooks might offer to purchase useless security software;
crooks might ask to install remote access tool in order to “fix the problem” quicker;
your PC might get infected with malware;
you might unintentionally reveal private information, such as credit card details.

Nevertheless, “Your Windows Is Infected” uses the name of Microsoft; you should never forget that they do not have a phone support line. Thus, seeing such alert should not trick you to call criminals. No one knows what exact purposes they might have. Most likely, you will suffer from cyber crime.

The same malicious website also provides a fake Windows Defender notification. The alert says that Windows Security Essential failed to block the virus. Thus, in order to protect privacy and computer, users have to call the support line.

To make this scam to look more realistic, crooks also included an error code 0x8024402c.^[2] However, this error has nothing in common with the scam you’re dealing with.

However, seeing such security alerts warns that your computer might be at risk. Redirects to the malicious site usually are triggered by an adware program that managed to infiltrate the system without your knowledge.

The quickest way to locate adware is to scan the computer with the anti-malware^[3] program. We recommend performing automatic “Your Windows Is Infected” removal with security tools. At the end of the article, you will find a guide that will help to remove “Your Windows Is Infected” entirely.

The illustration of

Fake Windows alert might be triggered by an adware program

The research revealed that behind redirects to “Your Windows Is Infected” usually stands an adware program. This potentially unwanted application may have entered the system during the recent installation of freeware.

To avoid similar cyber infections, you have to always opt for Advanced/Custom software installation instead of Basic/Standard. One of the steps will include pre-selected third-party apps that you need to unmark.

Additionally, “Your Windows Is Infected” scam might be spread via potentially dangerous sites. Thus, once you visit an adult-themed, gambling or illegal video streaming site, it might force you to visit this tech support scam site.

The virus is noticed spreading in the United Kingdom,^[4] the United States and several countries in Europe. What is more, it is expected to spread further.

Getting rid of “Your Windows Is Infected” virus scam

To remove “Your Windows Is Infected” malware from the computer, you need to find and delete adware program that is responsible for redirecting to this scam site. We highly recommend opting for the automatic removal option and dedicate this task for anti-malware.

However, we are aware that not all of you are willing to use additional tools to get rid of the adware. In order to help you, we created a manual “Your Windows Is Infected” removal instructions. Please follow them attentively.

If you decide to terminate this threat manually, make sure that you delete all adware-related components from the computer and web browsers. Leaving some entries installed may allow continuing these annoying activities.

Uninstall from Windows

Uninstall from Windows 10/8:

Type Control Panel into the Windows search box and open the result.
Under Programs, select Uninstall a program.

Uninstall from Windows 7/XP:

Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
In Control Panel, select Programs > Uninstall a program.

Remove the unwanted program:

In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
If User Account Control appears, click Yes to confirm, then complete the removal.

Delete from macOS

Remove the unwanted application:

From the menu bar, select Go > Applications.
In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:

Select Go > Go to Folder.
Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
Finally, empty the Trash to permanently remove the leftovers.

Reset Internet Explorer

Remove dangerous add-ons:

Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
Pick Manage Add-ons.
You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.

Change your homepage if it was altered:

Open IE and click on the Gear icon.
Select Internet Options.
In the General tab, delete the Home page address and replace it by your preferred one (for example, Google.com).
Click Apply and then select OK.

Delete temporary files:

Press on the Gear icon and select Internet Options.
Under Browsing history, click Delete...
Select relevant fields and press Delete.

Reset Internet Explorer:

Click on Gear icon > Internet options and select Advanced tab.
Select Reset.
In the new window, check Delete personal settings and select Reset.

Remove from Microsoft Edge

Delete unwanted extensions from MS Edge:

Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
From the list, pick the extension and click on the Gear icon.
Click Remove.

Clear cookies and other browser data:

Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
Under Clear browsing data, pick Choose what to clear.
Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:

Click the menu icon and choose Settings.
Then find On startup section.
Click Remove next to any suspicious startup page.

Reset MS Edge if the above steps did not work:

Press on Ctrl + Shift + Esc to open Task Manager.
Click on More details arrow at the bottom of the window.
Select Details tab.
Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge

Delete extensions from MS Edge (Chromium):

Open Edge and click select Settings > Extensions.
Delete unwanted extensions by clicking Remove.

Clear cache and site data:

Click on Menu and go to Settings.
Select Privacy, search and services.
Under Clear browsing data, pick Choose what to clear.
Under Time range, pick All time.
Select Clear now.

Reset Chromium-based MS Edge:

Click on Menu and select Settings.
On the left side, pick Reset settings.
Select Restore settings to their default values.
Confirm with Reset.
This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)

Remove dangerous extensions:

Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
Select Add-ons.
In here, select the unwanted extension and click Remove.

Reset the homepage:

Click three horizontal lines at the top right corner to open the menu.
Choose Settings.
Under Home, set your preferred homepage and new tab settings.

Clear cookies and site data:

Click Menu and pick Settings.
Go to Privacy & Security section.
Scroll down to locate Cookies and Site Data.
Click on Clear Data...
Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox

If clearing the browser as explained above did not help, reset Mozilla Firefox:

Open Mozilla Firefox browser and click the Menu.
Go to Help and then choose Troubleshooting Information.
Under Give Firefox a tune up section, click on Refresh Firefox...
Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome

Delete malicious extensions from Google Chrome:

Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:

Click on Menu and pick Settings.
Under Privacy and security, select Clear browsing data.
Select Browsing history, Cookies and other site data, as well as Cached images and files.
Click Clear data.

Change your homepage:

Click menu and choose Settings.
Look for a suspicious site in the On startup section.
Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

Click on Menu and select Settings.
In the Settings, scroll down and click Advanced.
Scroll down and locate Reset and clean up section.
Now click Restore settings to their original defaults.
Confirm with Reset settings.

Delete from Safari

Remove dangerous extensions:

Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:

Click Safari in the menu and pick Clear History.
Set Clear to all history and confirm with Clear History.

Reset Safari:

Click Safari in the menu and select Preferences > Advanced.
Enable Show Develop menu in menu bar.
From the menu bar, click Develop and select Empty Caches.

How to remove “Your Windows PC has been infected” scam

“Your Windows PC has been infected” is a scam that tries to trick Windows users into calling a fake tech support

“Your Windows Is Infected” popup – an older variant of a popular scam

Fake Windows alert might be triggered by an adware program