“Your computer is disabled. Please call Microsoft.” is a popup notification that pretends to be a message from Microsoft support. In fact, such banners are a sign of malware presence, primarily – potentially unwanted program (PUA). In this post, you will see why it is a bad idea to follow the instructions on this banner and how to get rid of it.
“Your computer is disabled. Please call Microsoft.” description
As I have mentioned before, this notification appears as a pop-up banner covering the browser’s content. There is no correlation between the websites you browse and the appearance of that banner. However, it states that your PC is blocked. The popup states that you got the malware after visiting the pornographic websites:
Do not restart or use your computer.
Your computer is disabled. Please call Microsoft.
Access is the block security reason for this computer.
Please contact us immediately. A technician will help you solve the problem.
This message can easily be skipped, and it will bring no effect to your computer. The possible consequences of closing the window or rebooting the PC are just a scarecrow. A virus, which shows you this message, tries to force you to call the specified number. It is presented as a Microsoft Support contact number. However, it isn’t. You can easily check its supporting methods on their official website. These scammers act similar to another group of cyber burglars, who exploit the FastSupport name.
The exact appearance of that popup alert
In some cases, “alert from Microsoft” in the shape of a pop-up message may completely block your web browser. It is impossible to use it in any possible method – the notification covers the whole window. Sometimes, that banner may even cover the upper panel – Close cross and minimize button will not be available to press. In such cases, the only way to close the web browser is to kill the process in Task Manager.
The virus that causes these pop-up advertisements can be classified as adware. That type of malware generates profit for its creators, showing different advertisements to the users who got it on their PCs. Common symptoms are well-known for all active PC users – ads are present on each page and cannot be removed with AdBlock; the browser window opens automatically and shows you the page full of ads. It is tough to predict what will happen if you press on one of these promotions, but, apparently, nothing good.
Why do they do it?
The developers of “Your computer is disabled. Please call Microsoft.” show you this annoying banner to make you call them. While talking, they will offer you to install several security tools, depending on which ones were pre-paid to them. Of course, these antivirus programs are rather a scareware, than a proper anti-malware tool. You will see numerous alerts about problems on your computer. As the programs state, they can be solved after purchasing the full version of these apps.
All these “problems” are 100% fictional. Fake anti-malware software can choose a random file and block it, stating that it is vulnerable or malicious. It can easily block the program’s file you use every day, so it will not start or run with errors. The other side of the problem is that many users trust these programs, purchase them and use them for daily activities. Its developers receive the stimulus and keep developing their “antivirus”. Users who understand that this app is malicious meet another trouble – scareware is hard to delete without the proper anti-malware tool. You are not able to find such antiviruses in the list of installed programs, and there is no uninstall.exe in their root directory.
Besides installing different potentially unwanted programs, scammers may also perform different social engineering tricks. These can be targeted on your credentials, personal data, or even online banking information. They generate profit not only for PUPs installation but also for ads it shows massively to its victims.
Is “Your computer is disabled. Please call Microsoft.” dangerous?
The virus itself can only be distracting and annoying because of mentioned popup banners and also random ads that appear from nowhere. As I have described, the main danger is that you can be caught on this lure and install fake security tools. The activity of the last ones is not destructive but can harm your daily activities: it is hard to design something if your Photoshop and Lightroom are blocked.
sAntivirus blocked OracleVM and one of Microsoft files.
Some of the fake antiviruses, however, are not so “peaceful”. Different malware analysts say that such apps as SAntivirus, SAproduct or Segurazo Antivirus have several signs of being a well-disguised spyware1. It steals the information about the user’s PC configuration, data about the system settings and the most used applications. There is no need for the antivirus program to use this information, hence, it can only be used for malevolent purposes.
How did this virus reach my PC?
In the majority of cases, you get the “Your computer is disabled. Please call Microsoft.” malware through the malicious advertisements on the web2, or through the free/hacked programs you get on the Internet. You can avoid the first way of spreading easily – get rid of the habit of clicking the ads on websites. Yes, you can find something useful on them, but something like winning a prize in a lottery you haven’t taken part in or purchasing a new PC with a 90% discount is likely a scam.
Example of malicious advertisements
Software bundling is a widespread practice among the virus developers. Users who hack the programs to make them usable without purchasing a license approve any offer to include another program in the pack because they are gaining money in such away. Check precisely the installation window for signs like “Advanced installation settings” or so. The ability to switch off the malware installation often hides under such items.
How to get rid of “Your computer is disabled. Please call Microsoft.” malware?
The removal process of that virus includes the browser reset. It is better to use anti-malware software to remove the adware and reset the browser. Manure removal is also possible. However, this virus has several locations where it keeps its files. It also makes big changes to browser configurations, which are very hard to revert. My choice for “Your computer is disabled. Please call Microsoft.” removal is GridinSoft Anti-Malware.3.
Removing the viruses with GridinSoft Anti-Malware
I hope this guide helped you get rid of this annoying banner. Share this article with your friends or colleagues who also got that virus. Good luck!
When the virus is removed, it is time to deal with the consequences of its presence in your browser. Here are the guides for reverting to default for all popular web browsers.
Reset browser settings to default
Manual method of browser reset
To reset Edge, do the following steps :
- Open “Settings and more” tab in upper right corner, then find here “Settings” button. In the appeared menu, choose “Reset settings” option :
- After picking the Reset Settings option, you will see the following menu, stating about the settings which will be reverted to original :
For Mozilla Firefox, do the next actions :
- Open Menu tab (three strips in upper right corner) and click the “Help” button. In the appeared menu choose “troubleshooting information” :
- In the next screen, find the “Refresh Firefox” option :
After choosing this option, you will see the next message :
If you use Google Chrome
- Open Settings tab, find the “Advanced” button. In the extended tab choose the “Reset and clean up” button :
- In the appeared list, click on the “Restore settings to their original defaults” :
- Finally, you will see the window, where you can see all the settings which will be reset to default :
Opera can be reset in the next way
- Open Settings menu by pressing the gear icon in the toolbar (left side of the browser window), then click “Advanced” option, and choose “Browser” button in the drop-down list. Scroll down, to the bottom of the settings menu. Find there “Restore settings to their original defaults” option :
- After clicking the “Restore settings…” button, you will see the window, where all settings, which will be reset, are shown :
When the browsers are reset, you need to make sure that your web browser will be connected the right DNS while connecting to the website you want. Make a text file named “hosts” on your desktop, after that open it and fill it with the following lines4:
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column, followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a ‘#’ symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
Find the hosts.txt file in C:/Windows/System32/drivers/etc directory. Rename this file to “hosts.old.txt” (to distinguish it from the new one), and then move the file you created on the desktop to this folder. Remove the hosts.old from this folder. Now you have your hosts file as good as new.
Nevertheless, there is one problem that makes things a lot harder to restore, especially without the anti-malware program. As I have mentioned, “Your computer is disabled. Please call Microsoft.” which implements serious changes in your web browser configurations. For some of them, it is impossible (or much harder) to do it manually since you need to open each config file and change the modified rows to their original state. Another problem is that any mistake on that step can make the browser completely unusable. So, using GridinSoft Anti-Malware for that target is a much more reliable choice.
Reset your browser settings with GridinSoft Anti-Malware
To reset your browser with GridinSoft Anti-Malware, open the Tools tab, and click the “Reset browser settings” button.
You can see the list of the options for each browser. By default, they are set up in a manner that fits the majority of users. Press the “Reset” button (lower right corner). In a minute, your browser will be as good as new.
The browser reset is recommended to perform through the antivirus tool by GridinSoft because last can also reset the HOSTS file without any additional commands.
User Review
( votes)References
- Gridinsoft about spyware
- Information about malvertising on Wikipedia
- GridinSoft Anti-Malware review and explanations why do I recommend this program
- Official Microsoft guide for hosts file reset.
