My desktop Optiplex 5000 is trying to be hacked by scammers

This might be a typical IT support scam pop up.

Turn the computer back on and see if this happens again.

If it happens again, can you please hold down Ctrl+Alt+Del, then launch Task Manager, and then end all browser items there to close it. That page is definitely scam, but as long as you didn't call the number and engage in any of the requested activities, your computer is not hacked. It is just a pop up page that can have some audio effect and display in full screen mode, so it appears the computer is locked.

Scammers use various methods to trigger these pop-ups. Pop-ups are a form of online advertising. They are often integrated into websites or applications through ad services. Many websites use third-party advertising services to display ads. Sometimes, these ad services might inadvertently allow scam ads to be displayed. This does not mean the website itself is malicious, but it indicates a lack of stringent ad vetting.

You can read more about this type of support scam here: https://support.microsoft.com/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435

The behavior described matches common tech support scam tactics rather than a legitimate Windows update.

Legitimate Microsoft updates:

• Do not show phone numbers to call.
• Do not show a mouse pointer or “hand” moving around on its own trying to open things.
• Do not ask to install remote-control tools from a pop-up or web page.

If this happens again immediately:

1. Do not click anything on the screen and do not call any phone number shown.
2. Close the browser:
   • Press Alt + F4 to close the current window.
   • If that does not work, press Ctrl + Alt + Del, open Task Manager, and end the browser process (for example, Microsoft Edge, Chrome).
3. If the screen is still blocked, restart the PC using the power button.

If any remote access or software was already allowed:

1. Uninstall anything that scammers asked to install. For details, see Repair or remove programs in Windows.
2. If remote access was given, consider resetting the device using the guidance in Recovery options in Windows.
3. Run a full scan with Windows Security to remove any malware. Instructions are in stay protected with the Windows Security app.
4. Apply all Windows security updates from Start > Settings > Update & Security > Windows Update as described in Install Windows updates.
5. Change passwords for important accounts, including the Microsoft account, using the steps in Change your Microsoft account password.
6. If any money was paid, contact the bank or card provider and explain it may have been a tech support scam.

How to avoid this in the future:

1. Treat any unsolicited “support” screen, pop-up, or call as a scam, especially if it:
   • Tells not to turn off the computer.
   • Shows a phone number to call.
   • Claims to be from Microsoft and asks for payment or remote access.
2. Remember:
   • Microsoft and other legitimate tech companies will never cold call to say there is a problem with the device.
   • Real Microsoft error messages and update screens never include a phone number.
3. If a browser page suddenly fills with scary warnings, close the browser with Alt + F4 or restart the PC.

Reporting:

• Report the incident to Microsoft at https://www.microsoft.com/reportascam so it can be investigated and blocked where possible.
• If someone was allowed to connect remotely (for example, through Quick Assist or other tools) and seems malicious, disconnect immediately and report to local authorities and any relevant IT support.

For more background and detailed guidance, see the Microsoft articles on tech support scams and what to do if scammers already have information.

References:

• Protect yourself from online scams and attacks
• Protect yourself from tech support scams
• Tech support scams
• Use Quick Assist to help users
• I WAS HACKED - Microsoft Q&A
• Microsoft Defender Scam or Do I have a virus on my computer - Microsoft Q&A
• Windows defender scam - Microsoft Q&A
• Who do I call for support? - Microsoft Q&A
• why can't you block AnyTech365.com....they are a scam company posing as Microsoft supported, stealing information? - Microsoft Q&A