someone keeps remote accessing my computer and opening browsers to install extensions!

Hi melissa duprey,

Thank you for reaching out.

It sounds like the behavior may be coming from browser-level settings, a remote-assistance tool, or another unwanted app that is still able to trigger actions even when standard scans look clean.

In addition to Q&A Assist's suggestions, you can try these extra checking steps for your peace of mind:

1, Review browser notification permissions

• In each browser, open Settings > Privacy > Site permissions / Notifications and remove any unknown or suspicious websites that are allowed to send notifications or open prompts.
• Scam or ad sites can repeatedly trigger unwanted browser actions this way.

2, Check for remote-help apps you do not use

• Look in Settings > Apps > Installed apps for tools such as Quick Assist, AnyDesk, TeamViewer, RustDesk, ScreenConnect, or similar remote-support software.
• If you do not use them, uninstall them.

3, Turn off Remote Desktop if your edition supports it

• Go to Settings > System > Remote Desktop and make sure it is Off.
• If it is already off, that helps confirm the issue is likely not coming from the built-in Windows Remote Desktop feature.

4, Change important passwords from a different, trusted device

• If you signed in to email, banking, shopping, or Microsoft accounts while this was happening, change those passwords from another clean device first.
• This is an important precaution if a scam or remote session may have exposed account access.

5, If Microsoft Edge or Chrome is synced, reset the affected browser profile - sometimes unwanted extensions or settings can return through browser sync.

• Sign out of sync temporarily, remove suspicious extensions/settings, then sign back in only after the browser is clean.
• Unwanted extensions are often browser-based rather than full installed programs.

6, If the issue continues, avoid sensitive activity on that PC until it is fully checked - do not use it for payments, email, or saved passwords until the behavior stops.

You can report a suspected tech-support scam here: Avoid and report Microsoft technical support scams.

Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

This behavior is most likely caused by deceptive or unwanted software (including browser-based tech support or advertising scams), not legitimate Windows Remote Desktop.

Key points from the scenario and context:

• Tech support and similar scams often try to get remote access or silently install unwanted software, including browser extensions and coupon/adware tools.
• Deceptive software may not appear clearly in normal locations and may not follow standard installation practices, so it can be missed by basic checks.
• Malicious or compromised websites and pop-ups can trigger unwanted installs or browser behavior without obvious signs of a virus.

Do the following, in order:

1. Remove suspicious programs
2. Open Start → Control Panel → Programs → Programs and Features.
3. In Uninstall or change a program, look for:
   • Programs you do not recognize.
   • Anything related to coupons, deals, shopping helpers, browser toolbars, or extensions that you did not intentionally install.
4. Select each suspicious item and choose Uninstall, following the prompts. Restart the PC if requested.
   • Be cautious: some unfamiliar names may be legitimate or preinstalled; only remove what is clearly unwanted or related to the problem.
5. Clean up browsers and extensions Unwanted coupon extensions are often installed in the browser, not as full programs.

• Open each browser used (Microsoft Edge, Chrome, etc.).
• Go to the browser’s extensions/add-ons page.
• Remove any extension related to coupons, shopping, or anything you do not recognize or remember installing.
• Also remove unused extensions to reduce risk.

3. Check for deceptive pop-ups and scam behavior Tech support and ad scams can:

• Show fake warnings or lock the browser in full-screen mode.
• Try to scare into calling a phone number or installing software.
• Use malicious or compromised websites to trigger pop-ups and unwanted installs. If a browser window suddenly appears trying to install something or claiming the device is infected:
• Do not call any phone number shown.
• Close the browser using Ctrl+Alt+Del → Task Manager and end the browser process if it will not close normally.

4. Run a thorough security scan Even if previous scans were clean, run a full, up-to-date scan:

• Ensure Microsoft Defender Antivirus is enabled and updated.
• Run a Full scan and follow any recommendations.

5. Keep Windows and browsers updated Malware and unwanted software can exploit vulnerabilities in outdated software:

• Install all available Windows updates.
• Update browsers to the latest version and remove unused browsers and extensions.

6. Be cautious with remote access and support offers From the tech support scam guidance:

• Microsoft error or warning messages never include phone numbers.
• Do not allow remote access to the PC to anyone who contacts unexpectedly.
• Only seek help through official support channels and never from pop-ups or unsolicited calls.

If the behavior continues after uninstalling suspicious programs, cleaning extensions, and running full scans, avoid using the device for sensitive activities (banking, email) until a trusted local technician or official support can examine it, as persistent deceptive software may still be present.

References:

• Protect yourself from tech support scams
• How malware can infect your PC
• Unexplained Windows or software behavior may be caused by deceptive software
• Three easy steps to improve your cybersecurity
• Protect yourself from online scams and attacks
• Microsoft Defender Scam or Do I have a virus on my computer - Microsoft Q&A
• I WAS HACKED - Microsoft Q&A
• why can't you block AnyTech365.com....they are a scam company posing as Microsoft supported, stealing information? - Microsoft Q&A
• How can I remove McAfee Norton Pop Ups on Windows 11? It is not showing up on Apps or Task Manager. - Microsoft Q&A