Fake Virus Alert: How to Stop Pop-Ups and Check the Warning

A fake virus alert is a scam message that claims your device is infected so you will click, call, pay, or install something. Close the suspicious tab using the browser controls. If warnings keep appearing as notifications, block the website sending them in your browser settings. Seeing a warning alone does not establish that your device has malware; what you clicked, installed, or allowed determines the next step.

Do not call a number in the warning, use its “Scan” or “Remove threats” buttons, or disable your antivirus. If you already installed software or granted remote access, go straight to the recovery steps.

Find the source of the alert first

• A warning fills a browser tab, with a siren, countdown, or phone number: close the tab. If it traps you, force-close the browser and reopen without restoring the page.
• A notification appears in the corner of Windows or on your phone: look at the browser/app name and website address shown by the notification system, without opening the message. Then block that sender. Closing its original tab is not enough.
• New tabs, extensions, or unwanted programs keep returning: use the Windows adware cleanup path after revoking notification permission.
• Your actual security app or browser blocks a dangerous page or file: verify the warning independently. Do not dismiss a real protection warning as a scam.

How to close a fake virus pop-up safely

Use the browser’s tab or window controls, not an X drawn inside the webpage. If the page takes over the screen, press Esc to leave full screen. On Windows, press Ctrl + Shift + Esc, select the affected browser in Task Manager, and choose End task. On a Mac, press Option + Command + Esc, select the browser, and choose Force Quit. Unsaved work in that browser can be lost.

Reopen the browser and decline any offer to restore the previous session. On a phone, close the affected tab from the browser’s tab view; if necessary, close the browser through the app switcher first. Do not return to the scam page to unsubscribe or find a support number.

If that ends a one-time redirect and you did not download, install, or disclose anything, move on to checking permissions. A full-screen “scan” animation does not tell you which files are on your device.

Stop fake virus notifications in your browser

A website notification and a pop-up tab are different things. Blocking pop-up windows does not revoke a website’s permission to send notifications. Choose Block or Deny for the unwanted sender; merely dismissing a notification does not stop the next one. Identify the sender from the notification’s website address, rather than the antivirus logo inside its message.

Google Chrome on Windows or Mac

1. Open Chrome yourself. Go to Settings → Privacy and security → Site settings → Notifications.
2. Under Allowed to send notifications, find the unwanted domain. Use its menu to block it. If needed, add the address under Not allowed to send notifications. You do not need to visit the site. [2]
3. If the problem opens new windows or tabs too, return to Site settings and review Pop-ups and redirects. Remove any exception you granted to that site.

Check the Chrome profile you were using when the alert appeared. Changing permission in another profile or in Edge will not change the original Chrome sender’s permission.

Microsoft Edge on Windows

1. Open Edge’s Settings → Privacy, search, and services → Site permissions → All sites.
2. Select the domain sending the warnings, find Notifications, and set it to Block. Older Edge versions may group these controls under Cookies and site permissions; search Settings for “notifications” if the labels differ.
3. Dismiss the old messages in Windows Notification Center. Watch for new messages from the same sender after restarting Edge.

Microsoft documents that allowed website notifications can appear even when Edge is closed. That behavior alone does not prove an installed virus. Disabling all Windows notifications would hide legitimate alerts as well; blocking the offending site addresses the source. [6]

Firefox and Safari on Mac

Firefox: open Settings and find the Permissions section under privacy/permissions settings. Next to Notifications, select Settings, block the unwanted website, and save the change. You can also block new notification requests if you do not use them. [8]

Safari on Mac: open Safari → Settings → Websites → Notifications and set the unwanted site’s permission to Deny. You can also turn off that website under System Settings → Notifications. For a page that keeps reopening, quit Safari and hold Shift while opening it again. Review the Websites → Pop-up Windows settings separately. [7]

Android, iPhone, and iPad

Android Chrome: long-press the notification to identify the app sending it. For a Chrome website sender, open Chrome → Settings → Site settings → Notifications, select the site and block its notifications. If a different browser or app is named, change that app’s permissions instead.

If you installed an APK or an unfamiliar app after the warning, stop using it and review installed apps. Use Gridinsoft Trojan Scanner for Android to scan the device, review findings, and follow the removal steps. A Windows installer will not clean an Android phone.

iPhone or iPad: close the Safari tab. In Settings → Apps → Safari, keep Block Pop-ups and Fraudulent Website Warning on. If a message appears outside Safari, identify whether it comes from an app notification or a subscribed calendar; closing Safari will not fix those sources. Use the iPhone fake-warning guide for the matching recovery path. Do not remove a work or school management profile just because a webpage tells you to.

Check the result: restart the browser normally without reopening the suspicious site. New notifications from the same address should stop after its permission is blocked. If they continue, compare the new sender and browser/profile with the one you changed. Clear that site’s stored data if it keeps reloading, but do not treat clearing cookies or cache as a substitute for checking notification permission.

How to tell a fake virus alert from a real warning

Open Windows Security from Start, or open your installed security app yourself, and check its protection history or detection log. Do not use the pop-up’s link to get there. On a managed device, ask IT about an unfamiliar protection product instead of disabling it.

A webpage claiming it has scanned your entire computer and found a precise number of viruses is a scareware pattern. A phone number, payment demand, countdown, or request to install a “support” tool makes the scam clearer. Familiar Microsoft, Apple, McAfee, Norton, or Google branding does not authenticate the sender. The FTC describes these pressure tactics in tech support scams. [1]

Browsers also show genuine protection warnings. Chrome Safe Browsing, Microsoft Defender SmartScreen, and Edge’s scareware blocker can warn about a site or download. Those warnings concern the resource you are opening; they are not proof that a webpage scanned your disk. Leave the unsafe page and keep protection enabled.

In the Microsoft example below, “This site looks suspicious” is the real Edge warning. The smaller image beneath it is a preview of the scam page that Edge blocked. Do not confuse the two layers or continue to the dangerous site. [3]

If alerts return: check for adware or installed software

An allowed site notification needs a permission change. A browser that keeps installing extensions, changing its search engine, opening unrelated tabs, or recreating warnings after you block the sender needs a broader check. A suspicious installer can leave an extension, startup entry, scheduled task, or bundled application that restores the behavior.

For this Windows cleanup branch, download and install Gridinsoft Anti-Malware from its official site, update the database, and run a Full Scan. Review detections, apply cleanup, then restart Windows and recheck the browser. If the scanner cannot start, use the adware symptoms and removal guide for further troubleshooting.

Also review installed apps and browser extensions added around the time the problem began. Remove the scam-directed app or extension you can identify; do not uninstall everything unfamiliar. If an extension or policy returns after removal, record its name and get help investigating what recreates it. A scan can check for unwanted software and persistence, but cannot reverse a payment or secure an exposed account.

What to do if you clicked, downloaded, called, or paid

• You clicked but did not install anything: close the destination, check the browser’s downloads and notification permissions, and look for an unexpected extension. A click alone does not establish infection.
• You downloaded a file but did not open it: do not run it. Remove the unsolicited download or keep it quarantined if your security software detected it.
• You ran an installer or pasted a command: stop sensitive activity on that device and run the Windows cleanup above. If the alert led you into Run, PowerShell, or Terminal, use the fake-update command-execution guide.
• You called the number: hang up. If you shared details or followed instructions, take the corresponding steps below; a phone call by itself does not grant remote control.
• You granted remote access: disconnect the device from the network to interrupt access, then remove the scam-directed remote tool and revoke unattended access. Follow the remote-access scam cleanup guide. Microsoft recommends considering a reset when scammers have accessed the computer. [5]
• You entered a password or payment details: from a trusted device, change the exposed password, review active sessions, and contact your bank or payment provider through its official channel. Preserve receipts and messages; do not pay a recovery caller promising to get the money back. [1]

Common fake virus alert messages

“Virus found,” “Internet Security warning,” “Firewall virus warning,” and “Your device is infected” can all be used as scareware text. Treat a browser-based demand to call support or purchase an urgent repair as a scam. An Outlook certificate warning or an actual security application’s detection is a different issue: check where the message came from rather than diagnosing it by those words alone.

For exact branding or wording, see the guides to McAfee pop-ups, TotalAV pop-ups, Windows Defender Security Center scams, and “Your computer is infected” warnings. These explain the named variations; the sender and action checks above still apply.

Microsoft SysScan: fake security scan and refund calls

In an August 24 analysis, Malwarebytes documented eleven Microsoft-branded SysScan sites that combined real browser-visible details with invented security findings. Their score was capped at 13–30 out of 100. The flow demanded antivirus removal, collected contact, financial and remote-session details, sent submitted data through Telegram, and promised a refund-manager call. [4]

• A familiar device profile is not a malware finding. Browser data can identify screen size or operating-system details; it does not establish antivirus health, firmware problems, memory vulnerabilities or exact Windows patch status.
• A low score is not a diagnosis. This campaign’s predetermined failing range cannot establish what needs repair.
• Removing antivirus is not a refund step. Windows still supports compatible third-party protection. Do not follow a webpage’s demand to uninstall it.

This concerns an unsolicited webpage claiming to inspect the whole PC. A service that analyzes a file you deliberately upload, or a scanner you knowingly install from a verified vendor, has a different scope.

What to do after the SysScan page

Start with the furthest action you took. Several branches can apply; closing the page does not undo data already sent or access already granted.

1. You only viewed it: close the tab without its buttons. Check for an unexpected download or notification permission. The displayed score alone is not evidence that the device was infected; use the browser notification steps if warnings recur.
2. You submitted contact or refund details: expect follow-up calls. Save the time, claimed company and information disclosed, then block the caller. Verify any real refund through the original merchant’s independently opened account or support channel; do not follow a new caller’s instructions.
3. You uninstalled antivirus: open Windows Security directly and check the protection provider. Restore the legitimate product from its official vendor, or confirm Microsoft Defender is active; update it and run a full scan. If protection will not turn on, stop sensitive work on that PC. On a managed work device, contact IT before changing security software.
4. You installed a remote tool or shared its session ID/password: disconnect the PC, end the session and revoke unattended access. Remove the scam-directed tool using the remote-access scam cleanup guide. A legitimate tool’s name does not make the caller legitimate. If control occurred, investigate other changes and run the full system check before resuming sensitive work. Microsoft advises considering a reset after scammer access. [5]
5. You disclosed passwords, banking or crypto details: use another trusted device to change exposed passwords and review sessions and transactions. Contact the bank, payment provider or exchange through its official channel; explain exactly what was shared. A scan cannot revoke an account session or reverse a transfer.
6. You paid or saw unauthorized activity: contact the payment provider promptly to dispute or secure the payment method. Preserve receipts and transaction identifiers. Do not pay a caller who promises to recover the loss; follow the FTC’s reporting guidance. [1]

Report Microsoft impersonation through the reporting route in Microsoft’s guidance. [5] Keep a short incident record: when the call occurred, which app was installed, whether control was granted, which accounts were open and which protection setting changed. This helps your bank or IT team distinguish financial exposure from a device cleanup task.

FAQ

References

1. Federal Trade Commission. “How To Spot, Avoid, and Report Tech Support Scams.” FTC Consumer Advice, accessed October 25, 2026. https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
2. Google Chrome Help. “Use notifications to get alerts.” Google Help, accessed October 25, 2026. https://support.google.com/chrome/answer/3220216?hl=en
3. Microsoft Support. “Prevent online scams with the scareware blocker in Microsoft Edge.” Microsoft Support, accessed October 25, 2026. https://support.microsoft.com/en-us/edge/prevent-online-scams-with-the-scareware-blocker-in-microsoft-edge
4. Stefan Dasic. “Fake Microsoft security scans trick victims into uninstalling their antivirus.” Malwarebytes Threat Intel, August 24, 2026, accessed October 25, 2026. SysScan campaign analysis.
5. Microsoft. “Tech support scams.” Microsoft Learn, updated April 24, 2024, accessed October 25, 2026. Recovery and reporting guidance.
6. Microsoft Support. “Manage website notifications in Microsoft Edge.” Accessed October 25, 2026. Website notification controls.
7. Apple Support. “Block pop-up ads and windows in Safari.” Accessed October 25, 2026. Safari pop-up guidance.
8. Mozilla Support. “Web Push notifications in Firefox.” Accessed October 25, 2026. Firefox notification permissions.