Is this a valid MS Updates screen??

Bardiferously · Apr 8, 2026

This doesn't look like valid for Windows 11. Has anyone seen this version and is it OK?

neemobeer · Apr 8, 2026

Can you ctrl+alt+del or alt+f4 out of it? It isn't one I've ever seen.

pseymour · Apr 8, 2026

Agreed. I've never seen them put "Microsoft" on that screen.

andrew129260 · Apr 8, 2026

Thats a fake message, might be clickfix. Notice the bars on the side? Microsoft logo is also not proper colors.

Also, google lens could not find this exact image online which is another red flag.

I would nuke and start over. Probably a Rat backdoor and they are using this to hide their actions.

New ClickFix wave infects users with hidden malware in images and fake Windows updates

ClickFix just got more convincing, hiding malware in PNG images and faking Windows updates to make users run dangerous commands.

www.malwarebytes.com

A lot of the fake update screens have gotten much better.

I actually came across an AI video that was made to mimic the exact windows official screen.

Standard security practice is now to test with ctrl alt delete to see if it is real.

Bardiferously · Apr 8, 2026

Windows Update is waiting to Restart Now --- with two updates:

Secure Boot Allowed Key Exchange Key (KEK) Update
2026-03 Update (KB5086672) (26200.8117)

I am very suspicious about the 1st one and not really sure about the 2nd one, either. Is there any way to get out of these two updates besides doing a factory reset (which I might be doing, anyhow), as I'm crunched for time right now and don't want to let these two get fully installed.

***** APPRECIATE your replies so far! ********

dalchina · Apr 8, 2026

Interestingly Google AI gives a reasonable response starting with

This is a known ClickFix malware scam designed to steal data or install viruses. Scammers use realistic, full-screen browser pages to mimic Windows updates, prompting you to run commands or call fake support numbers. Do not follow the on-screen instructions to press keys or call a number.

- I searched for
Fake Microsoft Working on updates Don't turn off your PC This will take a while.

Proceed with the utmost caution as above.

The first update description could relate to a real update:

https://www.reddit.com/r/Windows11/comments/1rpychd/what_is_this_secure_boot_allowed_key_exchange_key

Secure Boot Key update

Yesterday when I was using my Beelink Sei12 MiniPC running Windows 11 Pro, there was suddenly an update message requiring me to Restart the PC. I was surprised since I had paused updates for five weeks. Anyway I restarted my PC and then looked into the Windows Update History to find out what...

www.elevenforum.com

The second is this (from the News section where you can find a thread per update):

KB5086672 Windows 11 Out-of-band Update build 26100.8117 (24H2) and 26200.8117 (25H2) - March 31

UPDATE 4/14: https://www.elevenforum.com/t/kb5083769-windows-11-cumulative-update-build-26100-8246-24h2-and-26200-8246-25h2-april-14.46106/ Microsoft Support: March 31, 2026 - KB5086672 (OS Builds 26200.8117 and 26100.8117) Out-of-band This out-of-band update for Windows 11, version 25H2 and...

www.elevenforum.com

andrew129260 · Apr 8, 2026

Bardiferously said:
Windows Update is waiting to Restart Now --- with two updates:

Secure Boot Allowed Key Exchange Key (KEK) Update

2026-03 Update (KB5086672) (26200.8117)

I am very suspicious about the 1st one and not really sure about the 2nd one, either. Is there any way to get out of these two updates besides doing a factory reset (which I might be doing, anyhow), as I'm crunched for time right now and don't want to let these two get fully installed.

***** APPRECIATE your replies so far! ********

On that screen in your screenshot above, hit ctl alt delete. If it brings up the screen to select task manager its fake. Shutdown the computer

garlin · Apr 8, 2026

Bardiferously said:
Windows Update is waiting to Restart Now --- with two updates:

Secure Boot Allowed Key Exchange Key (KEK) Update

2026-03 Update (KB5086672) (26200.8117)

I am very suspicious about the 1st one and not really sure about the 2nd one, either. Is there any way to get out of these two updates besides doing a factory reset (which I might be doing, anyhow), as I'm crunched for time right now and don't want to let these two get fully installed.

First update is normal and good news for you. Your PC is fully supported for the upcoming Secure Boot migration to CA 2023 certs. Every PC needs a specific KEK certificate provided by their OEM (using Windows Update), or have the KEK already in the BIOS.

Other PC's are gradually receiving similar KEK updates. A reboot is required for the change to take place, but you won't see this screen appear for a KEK install.

Celery · Apr 8, 2026

Bardiferously said:
Secure Boot Allowed Key Exchange Key (KEK) Update

Secure Boot Allowed Key Exchange Key (KEK) Update.webp

glasskuter · Apr 8, 2026

It is advised to ctrl+alt+del , disconnect from internet, and run security scans offline. You definitely do not want to click anywhere on that screen.
However, personally, I would immediately restore an old image or clean install windows...but that's just me. I don't take chances.

The thing about malware is, hackers are very, very smart and can set triggers inside their malware. One does not always see any indication of infection as soon as one is infected, but when a user action triggers it. You could have gotten the malware today...or 6 months ago. One never knows.

You get such infections from fake tech support pages,malicious browser extensions, allowing someone remote access, bundled with shady downloads, clicking on malicious ads (Social media ads are notorious for containing malware)., cracked software(ie: sites like PirateBay) and malicious browser extensions.

Have you given anyone remote access to your system? If so all the more reason to clean install.

Celery · Apr 8, 2026

The “Secure Boot Allowed Key Exchange Key (KEK) Update” is a critical Windows security update that refreshes the Secure Boot certificates stored in your system’s UEFI firmware. You do need to install it, because older KEK certificates issued back in 2011 are expiring in 2026, and without this update your system may eventually fail to validate Secure Boot policies or block legitimate software from loading.

Secure Boot works by ensuring that only trusted, signed code can run during the boot process. To do this, your firmware maintains a set of certificates: the Platform Key (PK), Key Exchange Keys (KEKs), and signature databases (DB/DBX). The KEK is essentially the “master authority” that allows Microsoft to update the Secure Boot signature databases. If the KEK expires or is invalid, your machine cannot accept new Secure Boot updates, which undermines the integrity of the boot process.

Microsoft is rolling out new KEKs through Windows Update so that systems can continue to validate and apply Secure Boot updates beyond the expiration of the original 2011 certificates. This update does not change your operating system features or user experience, but it ensures that your device remains compliant with Secure Boot requirements and protected against firmware-level attacks. The update is marked “Pending restart” because the new KEK must be written into UEFI, which only happens during a reboot.

If you ignore the update, your system will continue to run for now, but once the old KEK expires, Secure Boot updates (such as revocation lists for compromised bootloaders) will no longer apply. That could leave your machine vulnerable to boot-level malware or prevent certain trusted software from loading. Installing the update guarantees that your device remains able to process future Secure Boot certificate changes.

What is this “Secure Boot Allowed Key Exchange Key (KEK) Update,” and do I actually need to install it? - Microsoft Q&A

learn.microsoft.com

glasskuter · Apr 8, 2026

IMO this user is in a catch 22 situation. He has a clickfix infection as well as a valid pending windows update waiting to be applied. Guess it depends on how gutsy he is to restart and apply the valid windows update without knowing what the result would be from the malware, especially if he acquired that malware from remote access.

Megahertz · Apr 8, 2026

Do a hard shutdown (press the power button till it shuts down. This way it doesn't install anything other than it already did).
If you do have your data backed up, do a clean install (deleting all partitions on the drive).
If you don't have your data backed up, boot from a WinPE or Linux live and copy all your data to an external drive and then do a do a clean install (deleting all partitions on the drive).

FrancoDT · Apr 8, 2026

Bardiferously said:
Secure Boot Allowed Key Exchange Key (KEK) Update

2026-03 Update (KB5086672) (26200.8117)

Those two updates themselves are totally legit. 26200.8117 is my latest WU build and the "Secure Boot Allowed Key Exchange Key (KEK) Update" is a mandatory security update to replace expiring 2011 UEFI CA certs. As for the update screen itself I remember seeing Working on Update screens but I honestly didn't pay much attention to their appearance except for a quick glance. Might be some unnecessary paranoia and panic over that screen you posted going on though.

KB5086672 Windows 11 Out-of-band Update build 26100.8117 (24H2) and 26200.8117 (25H2) - March 31

UPDATE 4/14: https://www.elevenforum.com/t/kb5083769-windows-11-cumulative-update-build-26100-8246-24h2-and-26200-8246-25h2-april-14.46106/ Microsoft Support: March 31, 2026 - KB5086672 (OS Builds 26200.8117 and 26100.8117) Out-of-band This out-of-band update for Windows 11, version 25H2 and...

www.elevenforum.com

idgat · Apr 8, 2026

glasskuter said:
However, personally, I would immediately .... clean install windows...but that's just me. I don't take chances.

Megahertz said:
If you do have your data backed up, do a clean install (deleting all partitions on the drive).

Me too!!

andrew129260 · Apr 8, 2026

FrancoDT said:
Might be some unnecessary paranoia and panic over this screen going on though.

updates are legit, the screen being shown is not

Megahertz · Apr 8, 2026

The screen Working on updates you only see on shutting down or booting up, never during a working Windows.
Another strange thing is the vertical format, as the message was made for a cell phone.

FrancoDT · Apr 8, 2026

Megahertz said:
The screen Working on updates you only see on shutting down or booting up, never during a working Windows.
Another strange thing is the vertical format, as the message was made for a cell phone.

I thought that's what he was doing was booting up?

Bardiferously · Apr 11, 2026

I appreciate all the attention to this. I want to share one more detail - the computer in question now has an app called ScreenConnect and I cannot seem to uninstall it or stop it completely.

What's so odd about it is that it appears under the Program Files (x86) folder but the folder itself isn't visible on Folder View.

My plan is to wipe the C: drive clean (as in delete the partition) and then let it reformat and reinstall Windows.

gunrunnerjohn · Apr 11, 2026

If you didn't install ScreenConnect, you will want to certainly get rid of that!

I'm with others, I'd do as you plan and start from scratch!

Is this a valid MS Updates screen??

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

We summon thee from the dead, old threads!

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Wish to be flying

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Wish to be flying

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers