The Windows Health is Critical Tech Support Scam is a Trojan from the Trojan.Tech-Support-Scam family that displays a fake security screen stating that a problem has been detected and that “Windows health is critical”. It then prompts you to call a phone number to receive technical support. This alert is only being shown to scare you into the calling the phone and other than this infection, there is nothing wrong with your computer. Therefore, do not call the number and buy any services from them.
The text of the screenlocker is:
Windows
A problem has been detected.
*** STOP: 0xFFFFFFFF (0xFFFFFFFF, 0xUUUUUUUU, 0xUUUUUUUU, 0xUUUUUUUU, 0xUUUUUUUU).
Windows health is critical.
Please call technical support at:
+46101388486
(toll free)
to avoid system failure.
This particular tech support scam does not contain a hidden way to close it and needs to be removed using Safe Mode with Networking.
How did the Windows Health is Critical Scam get on my computer?
It is not currently known how this Trojan is being distributed. It could be distributed using fake software cracks or through free programs you download off of the Internet. As more information becomes available, we will update it here.
While there is no way to quickly remove this infection, it is still possible to remove it using Windows Safe Mode. To remove this infection for free, you can use the removal guide below. If you have already called the listed number and purchased any services, I advise you to contact your credit card provider and dispute the charges.
9
MBAM will now start and you will be at the main screen as shown below.
We now need to enable rootkit scanning to detect the largest amount of malware and unwanted programs that is possible with MalwareBytes. To do this, click on the Settings button on the left side of the screen and you will be brought to the general settings section.
Now click on the Protection tab at the top of the screen. You will now be shown the settings MalwareBytes will use when scanning your computer.
At this screen, please enable the Scan for rootkits setting by clicking on the toggle switch so it turns green.
12
When MBAM is finished scanning it will display a screen that displays any malware, adware, or potentially unwanted programs that it has detected. Please note that the items found may be different than what is shown in the image below due to the guide being updated for newer versions of MBAM.
You should now click on the Remove Selected button to remove all the selected items. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.
23
HitmanPro will now begin to scan your computer for infections, adware, and potentially unwanted programs. When it has finished it will display a list of all the items that Hitman has found as shown in the image below. Please note that the items found may be different than what is shown in the image.
You should now click on the Next button to have HitmanPro remove the detected items. When it is done you will be shown a Removal Results screen that shows the status of the various programs that were removed. At this screen you should click on the Next button and then if prompted you should click on the Reboot button. If HitmanPro does not prompt you to reboot, please just click on the Close button.
Once your computer has has restarted or you pressed the Close button, you should now be at your Windows desktop.
Your computer should now be free of the Windows Health is Critical Tech Support Scam program. If your current security solution allowed this program on your computer, you may want to consider purchasing the full-featured version of Malwarebytes Anti-Malware to protect against these types of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:
Are Your Protected?
While Malwarebytes Anti-Malware & HitmanPro will scan and clean a computer for free, the free versions do not offer real-time protection. If you want to be fully protected at all times then it is recommended that you purchase a premium version.
Malwarebytes Anti-Malware
Purchase the full-featured version of Malwarebytes Anti-Malware, which includes real-time protection, scheduled scanning, and website filtering, to protect yourself against these types of threats in the future!
HitmanPro
Purchase the full-featured version of HitmanPro, which includes discover viruses, trojans, rootkits, spyware and other malware on up-to-date and fully protected computers using cloud protection and behavioral detections, to protect yourself against these types of threats in the future!
Disclaimer: While we do earn a commission from the sale of the above products, rest assured we only recommend them due to their effectiveness.