Computer malware virus

Question

My computer locked, a telephone # of (Phone number removed) which is UltraViewer took over my computer and I couldn't do anything. I called the # a person walked me through how to remove the message with hitting buttons on the keypad which I did. The message disappeared but then it asked me to download ultraviewer, that's when I realized it was a product sale.

Now I have a permanent icon square that is black & white on my computer. When I hit on it, it displays my open files all together...please help me with this!! I don't believe ultraviewer is your product and they are representing it is!!

Answer 1

Please download Malwarebytes Antimalware and run a scan. Eliminate every piece of malware it finds. Malwarebytes should also get rid of all adware and PUAs and browser hijackers.

https://www.malwarebytes.com/mwb-download/thankyou

Post the detection report here.

---

Note: the Malwarebytes setup may activate the Premium trial (15-day) version. After 15 days, it switches to the free version automatically.

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information.

Answer 2

The behavior described matches a common fake “tech support” or “Windows Defender” scam delivered through the web browser, not legitimate Microsoft support.

Key points about what happened:

• Microsoft does not display phone numbers in error or security messages and does not ask to call a number to “fix” or “unlock” a computer.
• Scammers often use full‑screen browser pop‑ups that appear to lock the computer and then instruct to call a number or install remote‑control tools such as UltraViewer.
• Allowing remote access and installing third‑party tools can let scammers change settings or install unwanted software.

To close and clear the fake alert (for next time):

1. Use Task Manager instead of calling any number:
   • Press Ctrl+Shift+Esc.
   • Select the web browser process (Edge, Chrome, etc.).
   • Select End task to close the browser.
2. If that fails, hold the power button until the PC turns off, then restart. When the browser asks to “Restore previous pages,” choose No.
3. Clear the browser cache and history so the malicious page does not reload.

About the new black‑and‑white square icon:

• Unwanted or deceptive software can install components that change the Windows experience, add new UI elements, or alter how windows and files are shown.
• If UltraViewer or related software was installed, it should be treated as unwanted software and removed.

Steps to remove unwanted software such as UltraViewer:

1. Uninstall via Control Panel:
   • Open Control Panel → Programs → Programs and Features.
   • Look for UltraViewer or any program that appeared around the time of the incident, or any program that is not recognized.
   • Select it and choose Uninstall, then follow the prompts and restart if requested.
2. If it does not appear there, try the built‑in uninstaller:
   • Open File Explorer and go to C:\Program Files and (if present) C:\Program Files (x86).
   • Look for a folder named UltraViewer or similar.
   • If found, open the folder and run the uninstall file (often named Uninst.exe, Uninstall, or similar) and follow the prompts.
   • Do not delete the folder manually if there is no uninstall file, as that can cause system problems.

Scan for malware or deceptive software:

• Run a full antivirus scan using the installed security software.
• Additionally, run Microsoft’s tools listed in the context (for example, Microsoft Safety Scanner or Windows Defender Offline) to detect and remove malware or deceptive software.

How to handle similar incidents in the future:

• Do not call any phone number shown in a pop‑up or error message. Genuine Microsoft messages never include a phone number to call.
• Do not install software or allow remote access when prompted by unsolicited messages or callers claiming to be from Microsoft.
• If a browser page claims the computer is locked or infected, close the browser using Task Manager or restart the PC and clear the browser cache.
• Consider installing an ad blocker extension in the browser to reduce malicious or misleading ads that can trigger such pop‑ups.

If remote access was granted and there is concern about data or accounts:

• Change passwords for important accounts (email, banking, Microsoft account) from a trusted device.
• Monitor financial accounts for unusual activity and contact the bank or card issuer if anything suspicious appears.
• Report the scam to Microsoft using the official technical support scam reporting form referenced in the context.

---

References:

• Microsoft resources and guidance for removal of malware and viruses
• Protect yourself from online scams and attacks
• Unexplained Windows or software behavior may be caused by deceptive software
• Avoid and report Microsoft technical support scams
• Unwanted software
• Microsoft Defender Scam or Do I have a virus on my computer - Microsoft Q&A
• How do I report a possible scam from Microsoft? - Microsoft Q&A
• possible virus, computer locked - Microsoft Q&A
• Who do I call for support? - Microsoft Q&A
• Disabled computer - Microsoft Q&A