Microsoft Windows Error Info is a deceptive browser-based scam that masquerades as a legitimate Windows system error notification. Unlike actual malware that executes code on your machine, this threat operates primarily through malicious websites and aggressive browser pop-ups designed to trick users into believing their computer has critical security problems. Victims typically encounter alarming messages claiming Microsoft has detected viruses, system failures, or security breaches, complete with fake error codes and urgent instructions to call a "support" number or download supposed fix tools.
While technically classified as a browser hijacker or scareware rather than a traditional virus, Microsoft Windows Error Info can be surprisingly persistent once it gains a foothold in your browser settings. The scam often comes bundled with unwanted browser extensions, modified homepage settings, and redirects that repeatedly push victims toward fraudulent tech support operations. What makes this particular threat concerning is its ability to lock browser windows, create full-screen alerts that mimic genuine Windows interfaces, and generate audio warnings—all tactics designed to panic users into making hasty decisions before thinking critically about what they're seeing.
Threat Profile
| Threat Type | Browser Hijacker, Tech Support Scam, Scareware |
| Family | Fake Alert / Tech Support Scam variants |
| Aliases | "Windows Error Info", "Microsoft Security Alert", "Windows Defender Alert" (scam variations) |
| Platform | Cross-platform (affects Windows, macOS via browser manipulation) |
| Target Browsers | Chrome, Firefox, Edge, Safari—any browser can be affected |
| Primary Distribution | Malicious advertisements, software bundles, compromised websites, redirect chains |
| Persistence Methods | Browser extensions, modified shortcuts, homepage/search engine hijacking, scheduled tasks (in severe cases) |
| Primary Objective | Social engineering to extract payment for fake tech support services or install actual malware |
| Data at Risk | Credit card information (if victims pay), remote access credentials, personal information disclosed during scam calls |
| Observable Behaviors | Forced redirects to scam pages, browser lockup, audio warnings, full-screen fake alerts, multiple pop-up windows |
| Typical Artifacts | Unknown browser extensions, modified browser shortcuts with appended URLs, unfamiliar homepage settings |
| Removal Difficulty | Moderate (browser-level persistence requires thorough cleanup of settings and extensions) |
How It Spreads
Microsoft Windows Error Info primarily spreads through deceptive web redirects and bundled software installations. Users typically encounter this scam after clicking on misleading advertisements, visiting compromised websites, or installing free software that includes unwanted browser modifications in the installation package. The scam operators use sophisticated redirect chains—when you click on what appears to be a legitimate link or download button, you're silently passed through multiple intermediary sites before landing on the fake error page.
Software bundling represents one of the most common infection vectors. Free download sites often package legitimate programs with browser hijackers and adware that modify your browser settings without clear disclosure. During installation, users who click through setup wizards using "Express" or "Recommended" settings inadvertently agree to install additional components that facilitate these scams. The unwanted software then changes your homepage, default search engine, or new tab page to redirect you toward the scam infrastructure.
Common distribution methods include:
- Malicious advertising networks that inject fake error messages into legitimate websites through compromised ad placements
- Freeware and shareware bundles from download portals that include browser hijacking components in the installer
- Torrent files and pirated software packaged with unwanted modifications to browser settings
- Compromised websites where legitimate sites have been hacked to inject redirect scripts
- Spam email attachments or links that lead to landing pages hosting the scareware
- Fake software update notifications claiming your Flash Player, Java, or media codec needs updating
- Search engine poisoning where scam pages rank for common error messages users search for
What It Does On Your Machine
Once Microsoft Windows Error Info establishes itself in your browser, it creates a persistent loop of fake alerts and redirects designed to prevent you from normal browsing and push you toward the scam's ultimate objective—contacting fake tech support or downloading malicious "fix" tools. The scam typically displays convincing replicas of Windows system alerts, complete with Microsoft branding, official-looking error codes (often fabricated strings like "Error Code: 0x80070005" or "Threat Detected: Zeus Virus"), and countdown timers suggesting imminent data loss or system failure.
The browser hijacking component modifies several key settings to maintain control. Your homepage may change to a search engine you didn't choose, your default search provider gets replaced with one that injects sponsored results and redirects, and new tabs may open to advertising or scam pages. In more aggressive variants, the scam installs browser extensions that monitor your browsing activity, inject additional advertisements into pages you visit, and can intercept search queries to redirect you back to the scam infrastructure. These extensions often have innocent-sounding names and request broad permissions during installation, which users grant without reading carefully.
The psychological manipulation is sophisticated. The fake alerts often include audio warnings (synthesized voices stating "Your computer has been locked" or "Virus detected"), full-screen takeovers that hide your desktop and taskbar, and rapid-fire pop-ups that make closing the browser difficult. Some variants disable the close button or create new pop-up windows faster than you can close them, creating the illusion that your computer is malfunctioning. The messages typically include urgent language about imminent data theft, pornographic viruses, or system corruption, combined with time pressure to "call immediately" before "Windows blocks this computer for security reasons."
If victims call the displayed phone number, they reach scammers posing as Microsoft technicians who then attempt to extract payment for unnecessary services, sell worthless software subscriptions, or request remote access to install actual malware. The remote access component is particularly dangerous—scammers may install keyloggers, steal saved passwords, plant ransomware, or configure your computer to serve as part of a botnet. In severe cases where victims have paid, scammers return with additional demands, claiming new problems require further payment.
Manual Removal — Step by Step
Disconnect and Document
Disconnect from your network (unplug Ethernet or disable WiFi) to prevent additional redirects and communication with scam servers. If pop-ups are currently active, take a photo with your phone showing the phone number and messages displayed—this helps you remember what NOT to contact and can be useful if you've already paid and need to dispute charges. Do not call any numbers shown in the alerts.
Force-Close Your Browser
Open Task Manager (press Ctrl+Shift+Esc), locate all instances of your browser under the Processes tab, select each one, and click "End Task". If pop-ups prevent you from doing this, restart your computer. When Windows restarts, don't open your browser yet—you need to clean it first or it will immediately reload the scam pages from your previous session.
Boot to Safe Mode with Networking
Restart your computer and enter Safe Mode with Networking (on Windows 10/11: hold Shift while clicking Restart, then navigate Troubleshoot → Advanced Options → Startup Settings → Restart → press F5). Safe Mode prevents most unwanted software from loading automatically, making removal safer and more effective. You'll need networking enabled to download cleanup tools if you don't already have them.
Uninstall Suspicious Programs
Open Settings → Apps → Apps & features (or Control Panel → Programs and Features on older Windows). Sort by install date and look for programs installed around the time the pop-ups started appearing. Remove anything you don't recognize or didn't intentionally install, particularly items with generic names like "System Helper", "PC Optimizer", "Browser Assistant", or anything mentioning toolbars or search features. Uninstall these completely.
Remove Browser Extensions and Reset Settings
Open your browser (it should start in Safe Mode without triggering the scam). For Chrome: go to chrome://extensions/ and remove any extensions you don't recognize. For Firefox: open Add-ons Manager and remove suspicious extensions. Then reset your browser settings: In Chrome, go to Settings → Reset settings → Restore settings to their original defaults. In Firefox, go to Help → More Troubleshooting Information → Refresh Firefox. In Edge, go to Settings → Reset settings. This removes hijacked homepages, search engines, and restored tabs without deleting your bookmarks and passwords.
Check and Clean Browser Shortcuts
Right-click your browser shortcut (on desktop, taskbar, or Start menu), select Properties, and examine the Target field. It should end with the browser executable (like chrome.exe or firefox.exe) with no URLs or additional parameters after it. If you see a web address appended after the .exe, delete everything after the closing quotation mark following the executable path, click Apply, then OK. Repeat for all browser shortcuts.
Scan with Reputable Anti-Malware Tools
Download and run Malwarebytes Free (malwarebytes.com) or another reputable anti-malware scanner. Run a full system scan to catch any remaining components, including potential adware or PUPs (potentially unwanted programs) that facilitate the scam. These tools specifically target browser hijackers and scareware that traditional antivirus might miss. Remove everything the scanner identifies.
Check Scheduled Tasks
Open Task Scheduler (search for it in the Start menu), and review the Task Scheduler Library for any tasks created around the time the problem started. Look for tasks with random names, tasks that trigger at login or every few hours, and tasks whose actions involve opening browsers with URL parameters. Delete suspicious scheduled tasks by right-clicking them and selecting Delete.
Change Passwords If You Provided Information
If you called the scam number and provided any personal information, gave remote access to your computer, or made payment, immediately change passwords for all important accounts (email, banking, shopping, social media) from a different, clean device. Monitor your credit card and bank statements closely for unauthorized charges. Consider placing a fraud alert with credit bureaus if you disclosed sensitive personal information.
Restart Normally and Verify
Restart your computer normally (exit Safe Mode) and reconnect to your network. Open your browser and verify that your homepage, search engine, and new tab page are what you expect. Browse normally for a while to confirm you're not being redirected to scam sites. If pop-ups return, repeat the removal process or bring your computer to professionals—there may be deeper persistence mechanisms at work.
Prevention
- Never call phone numbers displayed in browser pop-ups. Legitimate Microsoft error messages appear through Windows itself, never in your web browser, and Microsoft never provides phone support numbers in error dialogs. If you need Microsoft support, visit microsoft.com directly using a bookmark you've created yourself.
- Use "Custom" or "Advanced" installation options for all software. When installing free programs, always choose custom installation and carefully read each screen. Decline any additional offers for toolbars, browser helpers, search engine changes, or "recommended" software that comes bundled with your intended program.
- Download software only from official sources. Avoid third-party download sites that bundle software with unwanted extras. Download programs directly from the developer's official website or from Microsoft Store. Be particularly cautious with download buttons on search results—some are advertisements leading to bundled installers rather than the actual software.
- Keep a reputable ad blocker installed. Browser extensions like uBlock Origin can prevent many malicious advertisements and redirect chains from ever reaching you. These tools block the advertising networks commonly used to distribute scareware and fake alerts.
- Maintain updated security software. Keep Windows Defender (or your preferred antivirus) active and updated. While these won't catch every browser hijacker, they provide baseline protection against known threats and can block many distribution mechanisms.
- Be skeptical of urgent security warnings. Legitimate security alerts don't use countdown timers, don't prevent you from closing windows, don't include phone numbers, and don't threaten immediate consequences. Real security software runs in the background and offers to quarantine threats—it doesn't take over your screen with panic-inducing messages.
- Review browser extensions regularly. Every few months, check your installed browser extensions and remove any you don't actively use or don't remember installing. Extensions require permission updates when browsers change, so legitimate ones will be maintained by developers you can research.
- Enable Click-to-Play for plugins. Configure your browser to ask before running Flash, Java, or other plugins rather than automatically executing them. Many exploit kits and malicious ads rely on automatic plugin execution to deliver payloads.
Bring It In
If you've tried the manual removal steps and still see redirects or pop-ups, or if you're concerned that scammers gained remote access to your computer, bring your machine to Computer Repair Roswell. Our technicians see these scams regularly and can thoroughly clean your system, verify that no actual malware was installed during remote access sessions, check for signs of data theft, and secure your browser against re-infection. We'll also help you understand what happened so you can recognize similar threats in the future. If scammers charged your credit card, we can advise on the dispute process and help document what was done to your system.
We're located in Roswell, Georgia, and we work on both PCs and Macs affected by browser hijackers and scareware. Call us at (770) 856-1578 to describe what you're seeing, or stop by our shop with your computer. Most browser hijacker removals can be completed the same day, and we'll make sure your system is genuinely clean before you take it home. Don't let fake error messages rob you of your peace of mind—or worse, your money. We'll get you back to safe, normal browsing.