# A CAPTCHA told me to press Win+R. Is it a virus? > If a page claiming to be a CAPTCHA tells you to press Win+R, paste a command or open PowerShell, leave immediately. What the scam does and what to do next. Canonical: https://www.phishclean.com/blog/captcha-told-me-to-press-win-r-is-it-a-virus Last updated: 2026-11-02 March 15, 2026 By [PhishClean Research Team](https://www.phishclean.com/about) - browser security guidance based on phishing analysis, defensive research, and product work. If a page says "prove you are human" and then tells you to press `Win + R`, paste a command, or open PowerShell, that is not normal verification. It is a major red flag. In many recent complaints, this exact flow was used to trick people into running malware themselves. Real CAPTCHA pages never ask you to open Run, Terminal, Command Prompt, or PowerShell. If you see that instruction, close the page immediately. The reason this scam works is simple: it disguises a dangerous action as a familiar one. People are used to clicking checkboxes or solving picture puzzles. Attackers replace that expectation with "one more step" that actually launches a command on your own computer. ## What the scam is trying to do When you press `Win + R`, you open the Windows Run box. If you paste a command from a malicious site, you are no longer just visiting a page. You are giving the attacker a chance to download or execute something on your machine. ### Fake verification step The page wraps a malicious instruction inside a familiar "prove you are human" flow. ### User runs the payload The trick is effective because it gets the victim to launch the malicious step manually. ### Page closes, damage stays Even if you leave the site afterward, the command may already have done the important part. ## If you already ran the command 1. Disconnect from the internet if you saw a terminal window flash or a download start. 2. Run a trusted security scan from Windows Security or your antivirus tool. 3. Check Downloads and recent files for anything you did not intentionally install. 4. Change important passwords from a separate trusted device if you suspect account exposure. 5. If this was a work machine, tell IT immediately instead of waiting for obvious damage. Opened a file from a fake "update your browser" page instead? The same steps apply: it is the same kind of malware, delivered as a download. ## How PhishClean catches it Starting with [PhishClean 1.8.0](https://www.phishclean.com/blog/whats-new-phishclean-1-8-0), now live on Chrome and Firefox, PhishClean warns you before you paste. It notices when a page copies a command to your clipboard and pairs it with a robot check or a Windows + R instruction, including the Win + X, Mac Terminal and File Explorer variants. The warning is free for everyone, with or without a paid plan, because these pages often run on hacked sites with real addresses that no blocklist would flag. ## Why people fall for this Most victims are not careless. They are rushing, already stressed, or trying to get through some annoying gate before reading an article, a PDF, or a video. The page is designed to make the unusual step feel like a temporary browser issue rather than an attack. If a website asks you to leave the browser and run a system command just to view content or prove you are human, stop there. That request is the whole scam. - [Why browser warnings often come too lateWhy dangerous pages can still look normal at first.](https://www.phishclean.com/blog/why-browser-warnings-often-come-too-late) - [I clicked a phishing link. What now?Immediate next steps after a suspicious click.](https://www.phishclean.com/help/clicked-a-phishing-link) - [How to check if a website is safeA practical checklist before you trust a page.](https://www.phishclean.com/blog/how-to-check-if-website-is-safe) - [How phishing attacks workCommon patterns attackers reuse to get clicks and credentials.](https://www.phishclean.com/threats/phishing-attacks) ## Frequently asked questions Can a website normally ask me to press Win+R? No. Legitimate sites may ask you to enable cookies, solve a challenge, or sign in. They do not need system-level tools to prove you are human. What if the page said it was Cloudflare or Google CAPTCHA? That branding is easy to fake. Judge the behavior, not the logo. Real services do not ask you to paste commands into Run or PowerShell. Do I need to reinstall Windows if I ran the command? Not always. Start with a trusted scan and review what executed. But if the machine holds sensitive work or banking data, treat it seriously and escalate quickly instead of assuming it is harmless. ## Catch suspicious pages before they turn into worse mistakes PhishClean watches for deceptive page behavior locally in your browser, so you get a warning before a fake page pushes you into risky actions. [Install PhishClean free](https://www.phishclean.com/#install) Last updated: 2 November 2026 ## Share this guide If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean. Share on X Share on LinkedIn Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.