How to identify a valid MS agent trying to download Ultrviewer

Cindy Martin 0 Reputation points
2026-04-06T17:49:44.1833333+00:00

My Surface suddenly gave an alert that my computer may be comprised and gave a number to call - 855-8496582. The person who answered claimed to be a MS employee - Jason White ID MS21672 - and wanted me to download an app - Ultraviewer - in order to see the problem. I started the process of downloading but decided not to continue until verifying if this was legitimate. Now I cannot operate my Surface and not sure what to do next.

Microsoft Security | Microsoft Defender | Microsoft Defender for Identity
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-04-06T17:50:01.77+00:00

    This is a classic tech support scam and not a legitimate Microsoft support interaction.

    Key points from the scenario:

    • Real Microsoft error or warning messages never include a phone number to call.
    • Microsoft does not make unsolicited support calls or ask customers to call random phone numbers shown in pop‑ups.
    • Scammers commonly ask victims to install remote‑access tools (such as UltraViewer) so they can “inspect” or “fix” the device; this is a known scam pattern.

    What to do now on the Surface:

    1. Close the fake alert and browser
      • If the browser is still open or the screen looks “locked”, press Ctrl+Alt+Del and open Task Manager, then end all browser processes (for example, Microsoft Edge, Chrome, etc.).
      • If that does not work, restart the Surface using the power button.
    2. Do not call that number again and do not install UltraViewer
      • Treat that number and any similar pop‑up numbers as malicious.
      • Do not provide any personal, financial, or sign‑in information to anyone who contacts using that number.
    3. Check whether anything was installed or changed
      • If the UltraViewer installation was not completed and no remote access was granted, the device is likely not compromised by that tool.
      • After restart, go to Settings → Apps and uninstall anything that was installed as part of this interaction, if present.
    4. Scan the device for malware
      • Run a full scan with Microsoft Defender Antivirus and install all available security updates.
    5. Change passwords and monitor accounts (if any access was granted)
      • If at any point remote access was allowed, or credentials were shared, change passwords for important accounts and monitor sign‑in activity and financial accounts for unusual activity.
    6. Report the scam to Microsoft
      • Submit details (phone number, what was shown on screen, what was requested) at https://www.microsoft.com/reportascam so Microsoft can investigate.
      • If there was any financial loss, also contact the bank or card issuer and consider notifying local law enforcement.

    How to recognize valid Microsoft support in the future:

    • Any contact with Microsoft support must be initiated by the customer through official channels (for example, the Microsoft Support site or built‑in Get Help app).
    • Microsoft will never:
      • Display a phone number in an error or warning dialog and ask to call it.
      • Cold‑call to say a device is infected.
      • Ask to pay for support with cryptocurrency or gift cards.
    • Use Microsoft Edge with Microsoft Defender SmartScreen enabled to help block known support‑scam sites and pop‑up loops.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.
  2. Pauline Mbabu 1,840 Reputation points Microsoft Employee
    2026-04-16T14:56:46.0766667+00:00

    Hello Cindy,
    This was not legitimate and it matches a well‑documented Microsoft technical support scam where fake pop‑ups claim your device is compromised, provide a phone number, and then pressure you to install remote access tools like UltraViewer so the attacker can control your PC; Microsoft has explicitly stated that it never displays error messages with phone numbers, never makes unsolicited support calls, and will never ask you to download remote access software in this way. Since you stopped the download, you did the right thing; to regain control safely, force‑restart the Surface by holding the power button for about 20 seconds until it shuts down, then start it up without clicking any on‑screen prompts, disconnect from the internet initially, run a full Microsoft Defender Offline scan, and if the device still appears locked by a browser pop‑up, start in Safe Mode and reset the browser settings. You should also report the incident to Microsoft using their official scam reporting page and review guidance on protection against tech support scams and fake security alerts to avoid recurrence, using these resource; protecting yourself from tech support scams https://support.microsoft.com/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.