Fake Virus Warning? What to Do, and What to Do If You Called

Updated November 4, 2026 · The Computer Hospital, Midtown Houston

A full-screen warning flashes up: "Your computer is infected! Call Microsoft Support now." There's a siren, a countdown and a phone number. It's a scam. Real virus warnings never come with a phone number to call. We get calls about these pop-ups constantly — and we see many customers who have already called the number and let a "technician" onto their computer.

How to spot a fake virus warning

• It appears in your web browser while you're browsing.
• It shows a phone number and says to call "Microsoft," "Apple," "Windows Defender" or your antivirus company.
• It has alarms, flashing colors, a countdown or a voice telling you not to shut down.
• It says your files, bank accounts or identity are at risk unless you act now.
• The browser seems "locked" — full screen, and it won't close normally.

If you only saw the pop-up

Good news: a pop-up by itself usually hasn't done anything to your computer. It's a web page designed to scare you.

1. Close the browser. On Windows, press Ctrl + Shift + Esc, select your browser and choose End task. On a Mac, press Option + Command + Esc and force quit it.
2. Reopen the browser without restoring the old tabs.
3. If it keeps coming back, you may have a browser hijacker or adware. That's what our malware cleanup handles — see browser redirects and hijackers.

If you called the number or let someone on your computer

This is where we have to be blunt. Once a scammer has been on your computer, assume the worst — especially if you use that computer for banking, shopping, bills, business or anything involving money. Like any criminals, these people range from small-time to very sophisticated, and you can't tell which one you got.

Do these things now:

1. Disconnect the computer from the internet. Unplug the network cable or turn off Wi-Fi. Don't use it for anything else.
2. From a different device (your phone or another computer), change your passwords — your email first, then banking, then everything else. Turn on two-factor authentication where you can.
3. Call your bank and credit card companies using the number on the back of your card. Tell them what happened, and dispute any charges you paid the scammers.
4. Watch your accounts closely for the next few months.
5. Report it at ReportFraud.ftc.gov.
6. If they call back offering a "refund" — hang up. That's the second half of the same scam.

Why a virus scan isn't enough

Many people run their antivirus afterward, it says "no threats found," and they assume they're safe. Unfortunately, many of these scammers use software that virus scanners don't detect — often legitimate remote-access programs that antivirus is designed to allow, set up to let them back in whenever they want. A clean scan doesn't prove they're gone.

The only ways to know for sure that someone is out of your computer are:

• Reload the operating system — wipe the drive and install Windows or macOS fresh.
• Restore a backup made before the incident.
• Roll back with System Restore to a point before the incident — which undoes installed programs and settings, and which we follow up by checking the computer, since a restore point doesn't cover everything.

In our shop, the usual answer after a remote-access scam is our Nuclear option ($79.95 Internet Special): we back up your files if needed, wipe the drive and reload the operating system clean. Your personal files come back; the scammers' software doesn't. See virus removal for both options.

Frequently asked questions

Is the Microsoft virus warning with a phone number real?

No. Microsoft doesn't put phone numbers in warning messages. It's a tech support scam. Close the browser and don't call.

I let them on my computer but didn't pay. Am I OK?

Not necessarily. They may have installed software to get back in or looked at your files and saved passwords. Disconnect from the internet, change your passwords from another device, and have the computer reloaded.

My antivirus says the computer is clean. Is it?

Not if someone had remote access. Many scammers use tools that antivirus doesn't flag. Only a reload, a pre-incident backup or a rollback is a reliable fix.

Will I lose my files if you reload Windows?

No — we back up your personal files first and put them back afterward. Programs have to be reinstalled.

Got a scary pop-up or let a scammer in? Bring the computer to 3512 Travis Street in Midtown — no appointment needed — or call us at (713) 472-4357. That's our real number; we'll never ask you to call us from a pop-up.

Related: remote support scams · malware cleanup or reinstall? · phishing emails

Source: FTC, How to Spot, Avoid, and Report Tech Support Scams