Blue screen

The message can be a legitimate Windows Update screen when it appears during a normal restart, but a pointer moving by itself—especially if the screen appeared while Windows was already in use—should be treated as possible unauthorized remote access.^1^

If the pointer is moving without anyone touching the mouse

1. Disconnect the computer from the network immediately.
   • Unplug its Ethernet cable, or turn off the Wi-Fi router if the Windows screen prevents you from disconnecting Wi-Fi normally.
   • Disconnecting the network can terminate an active remote-control session.
2. Do not call any telephone number displayed on the screen and do not enter passwords or payment information. Genuine Microsoft errors and warnings do not include support telephone numbers.^2^
3. After Windows becomes usable, remove unfamiliar remote-access software.
   • Open Settings → Apps → Installed apps.
   • Look for software installed immediately before this started, particularly anything someone instructed you to download for “support.”
   • Uninstall suspicious applications. If another person was intentionally helping you remotely, contact that person independently before removing known software.
4. Run an offline malware scan.
   • Open Windows Security → Virus & threat protection → Scan options.
   • Select Microsoft Defender Offline scan → Scan now.
   • The PC will restart and scan outside the normal Windows environment.
5. From another trusted device, change important passwords, starting with email and the Microsoft account. If anyone had remote access, Microsoft also recommends considering a Windows reset; resetting is more disruptive, so back up personal files first.^2^

If the screen appeared only after restarting for updates

That timing is consistent with a genuine update. Leave the PC connected to power and allow it to finish. Windows updates can require a restart to complete installation.^3^

A stationary pointer, a spinning progress indicator, or movement caused by someone touching a mouse or touchpad does not by itself indicate compromise. The warning sign is deliberate-looking pointer movement that nobody is causing, such as selecting buttons or opening items.

This is not a Windows “blue screen of death” unless it says something such as “Your device ran into a problem and needs to restart” and displays a stop code. Windows 11 stop errors may be blue or black depending on the version.^4^

References

1. Configuring windows update. Don't turn off your computer
2. Protect yourself from tech support scams | Microsoft Support
3. [Windows 11](https://support.microsoft.com/windows/deployment/updates-lifecycle/keep-your-pc-up-to-date-with-active-hours#summary)
4. [Windows 11](https://support.microsoft.com/windows/experience/performance-optimization/troubleshooting-windows-unexpected-restarts-and-stop-code-errors#basic-troubleshooting-steps-for-windows-11-blue-screens,-black-screens-and-stop-code-errors)