McAfee has Blocked your Windows Screenlocker

What is "McAfee has Blocked your Windows"?

"McAfee has Blocked your Windows" (or "Webroot has Blocked your Windows") is a fake security alert that locks the screen and encourages people to contact scammers ("technical department") via the telephone number provided. This is simply a scam and should not be trusted.

Scammers attempt to trick people into believing that McAfee or Webroot software has detected suspicious activity and blocked the computer. A pop-up window states that computers might be infected with viruses that steal credit card details or other sensitive information.

To avoid identity theft, financial loss, or other serious problems, people are encouraged to contact the McAfee or Webroot technical department via the (301) 900-8084 telephone number. To unlock their computers, users are urged to enter a license code that must be purchased from these scammers who pose as 'technicians' from Webroot or McAfee.

Do not contact these scammers or purchase this code from them. They are unlikely to provide any code (or if they do, it will probably not work). Furthermore, MalwareHunterTeam (who discovered this scam) have provided a code that can be used for both Webroot and McAfee scam versions to unlock the screen. The code is "H3J9-Z7K5-W5Y1-Q6L4".

After entering this code another pop-up window is likely to appear, encouraging users to call "Windows Technical Support" via the 1844-935-5335 number. It states that the user's computer might be infected and data such as passwords, browsing history, credit card details, and files stored on the computer might be at risk.

This fake virus alert/pop-up window should also be ignored. It cannot be closed in the normal way, so use Task Manager, find the process called "Advanced Ransomware", and terminate it using the "End task" (or "End Process") function.

Threat Summary:

Name	"Webroot has Blocked your Windows" scam
Threat Type	Phishing, Scam, Social Engineering, Fraud.
Symptoms	Unauthorized online purchases, changed online account passwords, identity theft, illegal access of the user's computer.
Distribution methods	Deceptive emails, rogue online pop-up ads, search engine poisoning techniques, misspelled domains.
Damage	Loss of sensitive private information, monetary loss, identity theft.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

"Your Windows Has Been Banned", "ERROR_LOCAL_USER" and "You Have A ZEUS Virus" are examples of other fake virus/error alerts. Generally, these scams are used by cyber criminals who attempt to extort money from people. They encourage users to contact them to purchase keys, software, online services, and so on.

In this particular case, the scam occurs when a computer is infected with a ransomware-type program called Advanced Ransomware.

Programs of this type are usually proliferated through spam campaigns (email attachments), dubious software download sources (unofficial websites, Peer-to-Peer networks, third party downloaders, and so on), fake software updaters, software 'cracking' tools and Trojans.

There are many scam websites that display fake alerts and errors similar to "McAfee has Blocked your Windows". Redirects to these websites are usually caused by various potentially unwanted applications (PUAs).

McAfee screenlocker technical analysis:

• Detection names: Avast (Win32:Trojan-gen), BitDefender (Gen:Variant.MSILPerseus.178033), ESET-NOD32 (a variant of MSIL/FakeSupport.DF)
• Scammers' telephone numbers: (301) 900-8084, 1844-935-5335
• Full list of antivirus detections: VirusTotal
• Executable filename: McAfee Tool.exe
• Sample first submitted: 2019-03-28 (created 2019-03-13)

WebRoot screenlocker technical analysis:

• Detection names: Avast (Win32:Malware-gen), BitDefender (Gen:Variant.MSILPerseus.178033), ESET-NOD32 (a variant of MSIL/FakeSupport.DF)
• Scammers' telephone numbers: (301) 900-8084, 1844-935-5335
• Full list of antivirus detections: VirusTotal
• Executable file name: Webroot Tool.exe
• Sample first submitted: 2019-03-20 (created 2019-03-19)

How did potentially unwanted applications install on my computer?

Some potentially unwanted applications can be downloaded from their websites, however, they more commonly infiltrate systems without users' knowledge (users install them unintentionally).

These unwanted installations usually happen through clicked intrusive advertisements or when software developers use the "bundling" method, which can trick users into downloading and installing PUAs with other software. Unwanted apps are usually hidden in "Custom", "Advanced" and other similar options/settings of software download/installation setups.

Furthermore, many people download and install software without checking these settings, thus allowing themselves to be tricked into downloading and installing other, unwanted software.

How to avoid installation of potentially unwanted applications?

Download software from official and trustworthy sources, and using direct links. Do not use third party software downloaders, installers, torrents, unofficial pages, or other similar sources. Do not skip setup steps when downloading or installing software. Carefully analyze each step by checking each checkbox, "Custom", "Advanced" settings, and so on.

Avoid clicking intrusive ads, since this can lead to redirects to untrustworthy or suspicious websites (such as gambling, pornography, adult dating, etc.). If you encounter these advertisements or redirects, check the list of installed extensions, add-ons, and plug-ins on your browser and remove dubious or unknown entries immediately.

Also apply this to unwanted programs installed on the operating system. If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate them.

Text presented in "McAfee has Blocked your Windows" pop-up:

McAfee has Blocked your Windows.
This PC has been blocked because of Suspicious Activity Detected. To Protect the Windows Services and its members all McAfee Technical Department (301) 900-8084. McAfee Security Alert Code: 055BCCAC9FEC
Your PC has been blocked because we detected an unusual activity on your computer. Your Computer might be Infected by Harmful Viruses. These viruses are well known for identity and credit card theft. Further action on this computer or any other device on your network might reveal private information and involve serious risks. McAfee Technicians will help you getting the Code to Unblock your Computer. Please Call McAfee Technical Department (301) 900-8084.
Call McAfee Technical Department: (301) 900-8084

Screenshot of the "Webroot has Blocked your Windows" version:

Text presented in this variant:

Webroot has Blocked your Windows.
This PC has been blocked because of Suspicious Activity Detected. To Protect the Windows Services and its members Call Webroot Technical Department (301) 900-8084. Webroot Security Alert Code: 055BCCAC9FEC
Your PC has been blocked because we detected an unusual activity on your computer. Your Computer might be Infected by Harmful Viruses. These viruses are well known for identity and credit card theft. Further action on this computer or any other device on your network might reveal private information and involve serious risks. Webroot Technicians will help you getting the Code to Unblock your Computer. Please Call Webroot Technical Department (301) 900-8084.
Call Webroot Technical Department: (301) 900-8084

Screenshot of a pop-up window that appears after entering the code provided by MalwareHunterTeam:

Malicious "Advanced Ransomware" process running in Task Manager:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is "Webroot has Blocked your Windows" scam?
• How to identify a pop-up scam?
• How do pop-up scams work?
• How to remove fake pop-ups?
• How to prevent fake pop-ups?
• What to do if you fell for a pop-up scam?

How to identify a pop-up scam?

Pop-up windows with various fake messages are a common type of lures cybercriminals use. They collect sensitive personal data, trick Internet users into calling fake tech support numbers, subscribe to useless online services, invest in shady cryptocurrency schemes, etc.

While in the majority of cases these pop-ups don't infect users' devices with malware, they can cause direct monetary loss or could result in identity theft.

Cybercriminals strive to create their rogue pop-up windows to look trustworthy, however, scams typically have the following characteristics:

• Spelling mistakes and non-professional images - Closely inspect the information displayed in a pop-up. Spelling mistakes and unprofessional images could be a sign of a scam.
• Sense of urgency - Countdown timer with a couple of minutes on it, asking you to enter your personal information or subscribe to some online service.
• Statements that you won something - If you haven't participated in a lottery, online competition, etc., and you see a pop-up window stating that you won.
• Computer or mobile device scan - A pop-up window that scans your device and informs of detected issues - is undoubtedly a scam; webpages cannot perform such actions.
• Exclusivity - Pop-up windows stating that only you are given secret access to a financial scheme that can quickly make you rich.

Example of a pop-up scam:

How do pop-up scams work?

Cybercriminals and deceptive marketers usually use various advertising networks, search engine poisoning techniques, and shady websites to generate traffic to their pop-ups. Users land on their online lures after clicking on fake download buttons, using a torrent website, or simply clicking on an Internet search engine result.

Based on users' location and device information, they are presented with a scam pop-up. Lures presented in such pop-ups range from get-rich-quick schemes to fake virus scans.

How to remove fake pop-ups?

In most cases, pop-up scams do not infect users' devices with malware. If you encountered a scam pop-up, simply closing it should be enough. In some cases scam, pop-ups may be hard to close; in such cases - close your Internet browser and restart it.

In extremely rare cases, you might need to reset your Internet browser. For this, use our instructions explaining how to reset Internet browser settings.

How to prevent fake pop-ups?

To prevent seeing pop-up scams, you should visit only reputable websites. Torrent, Crack, free online movie streaming, YouTube video download, and other websites of similar reputation commonly redirect Internet users to pop-up scams.

To minimize the risk of encountering pop-up scams, you should keep your Internet browsers up-to-date and use reputable anti-malware application. For this purpose, we recommend Combo Cleaner Antivirus for Windows.

What to do if you fell for a pop-up scam?

This depends on the type of scam that you fell for. Most commonly, pop-up scams try to trick users into sending money, giving away personal information, or giving access to one's device.

• If you sent money to scammers: You should contact your financial institution and explain that you were scammed. If informed promptly, there's a chance to get your money back.
• If you gave away your personal information: You should change your passwords and enable two-factor authentication in all online services that you use. Visit Federal Trade Commission to report identity theft and get personalized recovery steps.
• If you let scammers connect to your device: You should scan your computer with reputable anti-malware (we recommend Combo Cleaner Antivirus for Windows) - cyber criminals could have planted trojans, keyloggers, and other malware, don't use your computer until removing possible threats.
• Help other Internet users: report Internet scams to Federal Trade Commission.

▼ Show Discussion