Fake Virus Alert: Remove Pop-Ups and Browser Notifications

A fake virus alert is a scareware pop-up or browser notification that pretends your computer, phone, browser, or antivirus found a critical infection. Close it from the browser or operating-system controls, block the notification sender, remove suspicious extensions or apps, and run a malware scan if the alert returns after cleanup. Do not click buttons inside the warning, call the displayed number, install a “cleanup” tool from the pop-up, or give anyone remote access.

These alerts often imitate trusted names. If the warning is specifically a fake McAfee pop-up, a TotalAV pop-up, a Microsoft Security Warning scam, or a “Your iPhone has been hacked” pop-up, use the dedicated guide for that wording. If the fake alert opened Terminal, PowerShell, Command Prompt, Windows Run, or asked you to paste commands, treat it as more serious and use the fake Chrome update terminal guide. When a named website keeps sending fake security notifications, an exact-domain cleanup guide such as Recheck.co.in ads removal is faster than a broad article.

To reduce the chance of landing on scareware pages in the first place, review our practical secure browsing checklist for suspicious links, fake updates, browser notifications, and risky downloads.

What is a fake virus alert?

A fake virus alert is not a real antivirus result. It is a web page, browser notification, advertisement, or unwanted app message designed to make you panic. The FTC describes tech support scam tactics that use pop-ups, calls, or messages claiming there is a computer problem and pushing the victim to contact fake support [1]. Google also warns Chrome users to be suspicious of virus or infected-device warnings when they have not recently used a scanner [2].

The alert may claim to be “Internet Security,” “Windows Defender,” “Apple Security,” “Google Security,” “McAfee,” “Norton,” or another familiar brand. The name is part of the pressure tactic. A legitimate security product does not need a browser page with a random phone number to remove malware.

Where do you see the alert?

Fake virus alert examples to recognize

Real victims usually do not search for the word “scareware.” They search the phrase they saw on the screen. These are the patterns to treat as fake until proven otherwise:

• “Your device is infected” or “Your computer is infected” inside a browser page.
• “Internet Security warning”, “Virus found”, or “Malicious threats found” with a countdown, loud sound, or flashing alert.
• “Call support now”, especially when the number appears in a browser pop-up or full-screen page.
• “Remove threats now”, “Scan now”, or “Renew protection” buttons that open from an ad or unknown site.
• Fake brand warnings that mention Microsoft, Apple, Google, McAfee, Norton, or Windows Defender but are displayed by a random website.
• “Unusual Sign-in Attempt” Windows Security pop-up with a fake IP address, country, browser, progress bar, or system-scan result. This is still a web scareware page, not a real account alert. Close it from the browser controls, block the notification sender, and check the related domain if one is visible. A current example uses redirectott.com, which Gridinsoft’s Website Reputation Checker currently classifies as Browser Notification Spam with a 1/100 trust score.

The screenshot below is useful because it shows two things at once: the browser-level warning and the kind of fake full-screen alert shown inside the blocked page preview.

Why fake alerts keep coming back

The most common cause is an allowed browser notification. A shady site asks you to click “Allow” to watch a video, prove you are not a robot, download a file, or continue to a page. After that, it can send fake antivirus alerts even when the original site is closed.

Some fake alerts also mix brands in the same flow: a page may imitate Microsoft Defender or Windows Security first, then send the user through an affiliate or notification-spam domain toward a McAfee-branded offer. Treat the brand switch as another warning sign, not as proof that either company found a real infection.

Other causes include adware, a malicious extension, a compromised ad on a legitimate site, or a recently installed “free” app that changes browser settings. Adult-video redirects often use the same scareware pattern with fake player updates and virus warnings; if that was the trigger, see our guide to porn site malware risks and safe cleanup steps.

How to stop fake virus pop-ups

1. Close the page safely. Use the browser window controls or Task Manager. Avoid clicking anything inside the warning itself.
2. Reopen the browser without restoring the previous session. If it offers to restore tabs, decline it.
3. Remove notification permissions. In Chrome or Edge, open Settings, go to Site settings or Cookies and site permissions, then Notifications. Remove unknown or recently allowed sites.
4. Block pop-ups and redirects. In Chrome or Edge, review Pop-ups and redirects and remove unknown allowed sites.
5. Remove unknown extensions. Disable anything you did not install deliberately, especially coupon tools, search helpers, PDF converters, download managers, and fake security extensions.
6. Clear site data for the suspicious domain. This prevents the browser from reloading the same scam page or saved permission state.
7. Check installed apps. Uninstall recently added “cleaners,” “drivers,” “updates,” “security tools,” and apps installed around the time the alerts started.
8. Run a full scan. Scan all drives if redirects continue, downloads started, a remote tool was installed, or the alert appears outside the browser.

Remove fake alert notifications by browser

• Chrome on Windows or macOS: Settings → Privacy and security → Site settings → Notifications. Remove unfamiliar sites from the allowed list, then check Pop-ups and redirects.
• Microsoft Edge: Settings → Cookies and site permissions → Notifications. Block unknown senders, then review Pop-ups and redirects.
• Firefox: Settings → Privacy & Security → Permissions → Notifications → Settings. Remove suspicious websites and save changes.
• Safari on Mac: Safari Settings → Websites → Notifications. Deny unknown sites and remove any scareware sender you do not recognize.
• Android Chrome: Long-press the fake notification or open Chrome Settings → Site settings → Notifications. Block the suspicious site and clear its site data.
• iPhone or iPad: Close the Safari tab, clear website data for the suspicious site, and remove unknown calendar subscriptions or profiles if fake alerts appear there.

Scan if fake alerts return after cleanup

If the warnings come back after you block notifications, or if a pop-up caused a download, extension, remote-access tool, or unknown app install, treat it as more than a browser annoyance. A leftover extension, startup item, scheduled task, or bundled adware module can recreate the alerts after reboot.

Gridinsoft Anti-Malware can check for detections, hidden files, suspicious startup entries, scheduled tasks, unwanted apps, browser changes, and persistence that a manual browser cleanup can miss. Run a full scan, remove detections, reboot, and scan again if the fake alerts return.

What if you clicked, downloaded, or called?

• If you only saw the pop-up: close the page, revoke notifications, and watch whether it returns.
• If you clicked a button: check downloads, extensions, browser permissions, and installed apps. Run a scan before entering passwords or payment details. If the download was a fake Paint.NET installer or a lookalike editor download, use the Paint.NET fake download cleanup guide to verify the source and check lock-screen/startup leftovers.
• If you installed a program: disconnect from the internet if behavior looks suspicious, uninstall the app, scan the system, and review startup items.
• If you allowed remote access: disconnect the device, uninstall the remote tool, scan from a trusted account, and change important passwords from another device.
• If you paid or entered card details: contact your bank or card issuer quickly and dispute unauthorized charges.

Could it ever be a real infection?

The alert itself is usually fake when it appears as a browser page, notification, or full-screen warning with a support number. But the device can still have adware or malware if the alert keeps returning, changes your homepage/search engine, installs extensions, opens new tabs by itself, downloads files, or appears after installing a suspicious app. Treat the pop-up as a scam, then investigate the system behavior separately.

FAQ

References

1. Federal Trade Commission. “How To Spot, Avoid, and Report Tech Support Scams.” FTC Consumer Advice, accessed June 7, 2026. https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
2. Google Chrome Help. “Remove unwanted ads, pop-ups and malware.” Google Help, accessed June 7, 2026. https://support.google.com/chrome/answer/2765944?co=GENIE.Platform%3DDesktop&hl=en
3. Microsoft Support. “Prevent online scams with the scareware blocker in Microsoft Edge.” Microsoft Support, accessed June 7, 2026. https://support.microsoft.com/en-us/topic/prevent-online-scams-with-the-scareware-blocker-in-microsoft-edge-b02c7895-f9b7-4d9f-8e12-3668f00915be