Scam Response

Disconnect the PC from the internet immediately, run Microsoft Defender Offline, and secure potentially exposed accounts from a different trusted device.

1. Contain the remote access

• Turn off Wi‑Fi or unplug the Ethernet cable.
• Do not reconnect until the initial security scans are complete.
• Do not answer the scammers’ callback or permit another remote session.

The warning and telephone number were fraudulent: genuine Microsoft error messages do not include support telephone numbers, and scammers commonly request remote access to steal information or install malware ^1^.

Uninstalling UltraViewer was appropriate, but it cannot establish whether files were viewed or copied while the remote session was active. Treat information displayed or opened during that session as potentially exposed.

2. Check for anything else they installed

Since UltraViewer is already removed, check for other additions rather than reinstalling or removing it again:

1. Open Settings > Apps > Installed apps.
2. Sort by Date installed.
3. Review applications installed on or immediately before the call.
4. Remove other remote-control tools or unfamiliar applications installed during that period.

Scam incidents involving UltraViewer may also involve additional background or remote-access software ^2^. Do not remove software merely because its name is unfamiliar; search for its publisher or ask a trusted technician first.

3. Run an offline malware scan

Save all open work first because this scan restarts the PC.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Select Scan options.
4. Choose Microsoft Defender Antivirus (offline scan).
5. Select Scan now.
6. After Windows restarts, open Windows Security > Protection history and review the result.

The offline scan runs without loading normal Windows, making it harder for persistent malware to hide ^3^.

Afterward, reconnect to the internet, install available Windows updates, update Defender’s security intelligence, and run Windows Security > Virus & threat protection > Scan options > Full scan. Microsoft’s compromised-account procedure specifies clearing malware before changing passwords on that PC ^4^.

4. Protect accounts and financial information

Using a different, trusted phone or computer:

• Change the password for the primary email account first, followed by the Microsoft account, banking, shopping, and other important accounts.
• Change any password that was typed, displayed, stored in the browser, or reused elsewhere.
• Enable two-step verification where available.
• For a personal Microsoft account, open its Security page and review Recent activity. Mark unknown entries as This wasn’t me or select Secure your account ^5^.
• Check email forwarding, connected accounts, automatic replies, recovery details, and other settings for unauthorized changes.

If banking or card details were entered, shown, or accessed during the session, contact the bank or card issuer immediately through the number printed on the card or its official app. Ask them to review transactions and replace affected cards if necessary.

5. Report and monitor

Report the incident using Microsoft’s technical-support scam reporting process ^6^. Retain the caller’s number, date and time, screenshots, payment records, and any messages, but do not contact the scammer again.

If Defender detects threats it cannot remove, the scammer had administrator access for an extended period, security settings have changed unexpectedly, or suspicious behavior continues after scanning, stop using the PC for sensitive activity and have it examined by a reputable local technician. A clean Windows reset or reinstallation may be the safest fallback in a confirmed persistent compromise; back up personal documents first, but do not preserve unknown programs or installers.

References

1. Protect yourself from online scams and attacks
2. Threat pop-ups - Microsoft Q&A
3. Virus and Threat Protection in the Windows Security App | Microsoft Support
4. How to recover a hacked or compromised Microsoft account | Microsoft Support
5. What happens if there's an unusual sign-in to your account | Microsoft Support
6. Report a technical support scam