Is this a fake Windows Update screen?

Browser is Firefox. Not sure if it was open at the time. Anyway, further investigation found files in \users\

This is MOST DEFINITELY fake, and the mouse moving is being controlled by someone else.

What I'm not certain of yet is where it's coming from. I attempted to remove it and even after my efforts, as well as a Windows Security scan, the screen still popped up a few hours later.

In my unfortunate experience, my mother was tricked by a scammer to click on something, and they were able to use this screen as cover for their actions behind the scenes to make charges to a paypal account through zoom.

I'd really like to get to the bottom of this.

The computer shows an "update" screen, perhaps once a week. Without moving the physical mouse, the mouse pointer moves. Clicking, or sometimes just waiting, the screen vanishes and the Web browser shows, displaying my banking Web site. No password for that is saved on the computer. The blue screen says, "Working on updates Do not turn off your system". There are no swirling dots typical of a real Windows Update. The text does not include any full stops, which I thought unusual.

Checking Windows Updates history shows no updates done at the time of the event.

Windows Defender and Malwarebytes scans find nothing.

This is for Windows 10 Home, so Windows Remote Desktop should not be usable.

Is this a valid Windows screen?

its not a microsoft screen.

My 90 year old friend had this happen to her today. I don't know what financial data they got, but this is how I removed it. They downloaded ScreenConnect onto her PC - WIndows 10.

I used CTRL-ALT-DEL to turn off her wifi and disconnect her from the internet.

I had to restart on airplane mode, then go into TASK MANAGER and look to see if ScreenConnect was a process that was running (it was).

I clicked on the process to find the location, which opened up a window that showed the components of the program.

I checked all the boxes in the process and deleted them but a few wouldn't delete because ScreenConnect was running. Keeping that window open,

I had to go back and end the two ScreenConnect process in Task Manager and then delete the remaining parts of the program.

Once I did that I was able to close down and restart cleanly.

\Local\Apps\2.0\\ of the form "scre...". Removed those files and remove mention of them from the registry and from Services and "Screenconnect..." no longer shows as a running program. So far, no pop-ups have recurred.EndFragment