“We Are Having Trouble With Firewall” Tech Support Scam

The “We Are Having Trouble With Firewall” scam is a fraudulent technical support scheme that attempts to deceive users into believing that their Windows Firewall has been compromised. This scam operates through fake pop-ups and bogus security warnings, tricking victims into calling a fraudulent support number where scammers seek to gain remote access to their systems or extract personal and financial information.

It is essential to recognize that this scam has no affiliation with Microsoft or Windows. Any claims made by the fraudsters are completely false and intended to exploit unsuspecting users.

---

Threat Summary

Attribute	Details
Name	“We Are Having Trouble With Firewall” tech support scam
Threat Type	Phishing, Scam, Social Engineering, Fraud
Fake Claim	Windows Firewall cannot be set as the default.
Disguise	Windows / Microsoft
Tech Support Scammer Phone Number	+1-877-371-5233 (Toll-Free)
Related Domains	windows[.]net
Detection Names	ESET (Malware), Yandex Safebrowsing (Phishing), VirusTotal (Full List of Detections)
Serving IP Address	20.60.43.238
Symptoms	Fake error messages, fake system warnings, pop-up errors, hoax computer scan.
Distribution Methods	Compromised websites, rogue online pop-up ads, potentially unwanted applications (PUAs).
Damage	Loss of sensitive private information, monetary loss, identity theft, possible malware infections.
Danger Level	High

---

How the Scam Works

The "We Are Having Trouble With Firewall" scam follows a multi-step approach to deceive users:

1. Fake Microsoft Website – The user lands on a malicious website impersonating Microsoft’s official site.
2. Fake Pop-Up Alert – A pop-up message appears, falsely claiming that Windows Firewall cannot be set as the default.
3. Bogus System Scan – Clicking on "Scan" initiates a fake scan animation that reports fabricated issues.
4. User Prompt for Credentials – The pop-up requests Microsoft ID and password, which can be harvested by scammers.
5. Fake Helpline Call – The pop-up instructs the user to call +1-877-371-5233 for "assistance."
6. Remote Access Takeover – If the victim calls, the scammer persuades them to install remote access software like UltraViewer or TeamViewer, allowing full control over their device.
7. Monetary and Data Theft – Scammers may request payments for fake services, steal sensitive information, or install malware like trojans and ransomware.

Fake Pop-Up Message Text

Microsoft
We are having trouble with Firewall
Windows Firewall cannot be set as the default firewall. This problem may be occurring because of an existing Group Policy or because you are using another Security firewall program. If you want to use Windows Firewall, exit this troubleshooter, uninstall the other firewall program, and then run this troubleshooter again. Call us our Security Helpline: +1-877-371-5233 (Toll-Free)

Scan
[Run the windows scan to fix the problem]
Exit
[Exit the troubleshooter]

---

How to Remove "We Are Having Trouble With Firewall" Scam

Step 1: Exit the Scam Page

• If you cannot close the pop-up normally, use Task Manager (Ctrl + Shift + Esc) to end the browser process.
• Restart the browser, but do not restore the previous session to avoid reopening the malicious page.

Step 2: Disconnect from the Internet

If you have allowed remote access, disconnect your device from the Internet immediately to prevent further interference.

Step 3: Remove Remote Access Software

• If scammers instructed you to install software like UltraViewer or TeamViewer, uninstall it immediately:
• Windows: Go to Control Panel > Programs & Features and uninstall.
• Mac: Drag the application to Trash and empty it.

Step 4: Scan Your System with SpyHunter

1. Download SpyHunter.
2. Install and run a full system scan to detect and remove malware.
3. Follow SpyHunter’s recommendations to eliminate all threats found.

Step 5: Change All Passwords

• If you entered your Microsoft ID or any login credentials, change your passwords immediately.
• Enable two-factor authentication (2FA) wherever possible.

Step 6: Monitor Financial Accounts

Check for unauthorized transactions in your bank statements and report any suspicious activity to your bank.

---

How to Prevent Future Infections

Be Wary of Pop-Ups and Fake Alerts

• Legitimate companies like Microsoft do not send security warnings through pop-ups.

Avoid Calling Unverified Tech Support Numbers

• Microsoft’s official support can be found on their website (support.microsoft.com).

Use an Ad Blocker

• Block deceptive pop-ups using browser extensions like uBlock Origin.

Keep Software Updated

• Regularly update your operating system, browser, and security software to stay protected from vulnerabilities.

Install a Reliable Anti-Malware Solution

• Use tools like SpyHunter to provide real-time protection against scams and malware.

Avoid Clicking on Suspicious Links

• Be cautious with emails, ads, or websites that appear untrustworthy.