Blue screen

Question

Blue screen

Stephen H 0

Is a blue screen with, "Configuring Windows updates. Don't turn off your computer" a legitimate Windows screen? While it is displayed I see that the mouse is moving around the screen.

0 comments

3 answers

Your answer

Answer 1

Clary-N 18,945 Microsoft External Staff Moderator

Hi Stephen H,

In addition to the checks already suggested, I’d also rule out a connected device causing the pointer movement. Once the computer is usable again, temporarily disconnect any external mouse, wireless USB receiver, controller, drawing tablet or docking station. If it’s a laptop, you can also temporarily disable the touchpad and see whether the pointer continues moving.

Was the pointer simply drifting or did it appear to be deliberately selecting or opening items? Did the update screen show a percentage or spinning indicator and has the pointer moved by itself again since Windows restarted?

You can also search for View reliability history from the Start menu and check what was recorded around the time this happened, such as an update, hardware error, app failure or unexpected shutdown.

Please let me know what you find and I’ll be happy to help you narrow this down further.

Clary-N 18,945 Reputation points Microsoft External Staff Moderator

2026-11-04T11:13:16.5966667+00:00

Hi Stephen H,

May I know if you have got any chance to check my answer?

I am glad to help if you have any other questions.
Stephen H 0 Reputation points

2026-11-05T01:36:38.4933333+00:00

Screenshot 2026-11-04 202840.png

This is screenshot of a video I was taking of the screen. The pointer kept moving and was switching between the, "index finger" and "pointer". It appeared that the pointer was moving deliberately. No percentage or spinning indicator.

I had access to an IT guy who discovered two hidden ScreenConnect client the HideUL. I had scanned the pc with Norton and Malarbytes but since this isn't malware I could not isolate the issue. We removed the ScreenConnect Client
Clary-N 18,945 Reputation points Microsoft External Staff Moderator

2026-11-05T07:25:34.3633333+00:00

Hi Stephen H,

Thank you for the update. Finding two hidden ScreenConnect clients is significant, especially since you did not knowingly authorize or install them. ScreenConnect is a legitimate remote-support tool, but it can be misused to maintain remote access, and standard antivirus scans may not flag the client itself as malware.

Removing the clients was the right first step. I recommend keeping the computer disconnected from the internet until your IT technician confirms that no other unknown remote-access tools, services, startup entries, or user accounts remain. From a different trusted device, change the passwords for your email, Microsoft account, banking, shopping, and any other important accounts used on this computer. Also enable two-step verification and review recent sign-in activity.

Because unauthorized remote access may have occurred, the safest option is to back up personal files and perform a clean installation of Windows rather than relying only on scans. Avoid backing up programs or unknown installer files.

The screenshot confirms that the pointer was visible as a hand-shaped cursor during the Windows update screen, but it cannot confirm remote control by itself. The unexpected ScreenConnect installations are the more important finding. If the pointer activity has stopped since their removal, that further supports a connection, although it is not conclusive.
Clary-N 18,945 Reputation points Microsoft External Staff Moderator

2026-11-06T08:22:59.7733333+00:00

Hi Stephen H,

Have you had a chance to check my answer yet?

Please let me know if there is anything I can help by leaving your comment down here.
Stephen H 0 Reputation points

2026-11-06T14:18:50.43+00:00

Hi Clary,

Yes, I reviewed your response and are taking steps to secure my device. I should be good for now regarding this issue. Thank you for your input.

Stephen

Answer 2

TaoLi 119.7K Independent Advisor

Hello, could you please provide a screenshot? This will help me assess the situation for you. Thank you.

Stephen H 0 Reputation points

2026-11-05T01:40:17.13+00:00

Screenshot 2026-11-04 202840.png

This is screenshot of a video I was taking of the screen. The pointer kept moving and was switching between the, "index finger" and "pointer". It appeared that the pointer was moving deliberately. No percentage or spinning indicator.

I had access to an IT guy who discovered two hidden ScreenConnect client the HideUL. I had scanned the pc with Norton and Malarbytes but since this isn't malware I could not isolate the issue. We removed the ScreenConnect Client

Answer 3

The message can be a legitimate Windows Update screen when it appears during a normal restart, but a pointer moving by itself—especially if the screen appeared while Windows was already in use—should be treated as possible unauthorized remote access.^1^

If the pointer is moving without anyone touching the mouse

Disconnect the computer from the network immediately.
- Unplug its Ethernet cable, or turn off the Wi-Fi router if the Windows screen prevents you from disconnecting Wi-Fi normally.
- Disconnecting the network can terminate an active remote-control session.
Do not call any telephone number displayed on the screen and do not enter passwords or payment information. Genuine Microsoft errors and warnings do not include support telephone numbers.^2^
After Windows becomes usable, remove unfamiliar remote-access software.
- Open Settings → Apps → Installed apps.
- Look for software installed immediately before this started, particularly anything someone instructed you to download for “support.”
- Uninstall suspicious applications. If another person was intentionally helping you remotely, contact that person independently before removing known software.
Run an offline malware scan.
- Open Windows Security → Virus & threat protection → Scan options.
- Select Microsoft Defender Offline scan → Scan now.
- The PC will restart and scan outside the normal Windows environment.
From another trusted device, change important passwords, starting with email and the Microsoft account. If anyone had remote access, Microsoft also recommends considering a Windows reset; resetting is more disruptive, so back up personal files first.^2^

If the screen appeared only after restarting for updates

That timing is consistent with a genuine update. Leave the PC connected to power and allow it to finish. Windows updates can require a restart to complete installation.^3^

A stationary pointer, a spinning progress indicator, or movement caused by someone touching a mouse or touchpad does not by itself indicate compromise. The warning sign is deliberate-looking pointer movement that nobody is causing, such as selecting buttons or opening items.

This is not a Windows “blue screen of death” unless it says something such as “Your device ran into a problem and needs to restart” and displays a stop code. Windows 11 stop errors may be blue or black depending on the version.^4^

References