How to identify and remove a fake virus pop-up

You’re browsing online when a warning suddenly appears: “Virus detected. Your device is at risk.” It may look convincing, but most virus pop-ups are fake alerts from deceptive websites or browser notifications — not genuine security software. Don’t click anything inside the warning, even if it uses a familiar antivirus brand. Instead, close it — but do so safely. Below, we’ll explain how to spot a fake virus alert, how to remove pop-ups from different browsers and devices, and what to do if you’ve already clicked or downloaded something, shared information, or paid money.

Ugnė Zieniūtė

September 11, 2026

15 min read

What is a virus pop-up?

A virus pop-up is an on-screen warning that claims your device has a virus, malware, or another security problem. Some security alerts are legitimate, but fake virus pop-ups are designed to scare you into taking quick action, such as clicking a link, downloading software, calling a phone number, or paying for a supposed fix.

Where do virus pop-ups come from?

Fake virus pop-ups can appear for several reasons:

Browser notifications. You may have clicked “Allow” on a website that later started sending misleading security alerts.
Malvertising. Some online ads redirect users to pages that imitate antivirus warnings or claim a scan has detected multiple threats.
Adware or potentially unwanted programs (PUPs). Unwanted software installed on your device can generate repeated ads, redirects, or fake warnings.
Compromised or deceptive websites. Scam sites may be built specifically to display fake virus scans and pressure visitors into downloading software or calling a fake support number.

If the alerts keep appearing even after you leave the original website, check your browser notification permissions, installed extensions, and recently added apps. You can narrow down which websites are sending you virus alerts and fix permissions from there.

Real alerts vs. fake virus pop-ups

A genuine security alert usually appears inside the antivirus app itself or through your device’s system notifications. A fake virus pop-up typically appears in a browser and tries to rush you into calling a number, downloading software, or paying for an immediate fix.

The easiest way to check the legitimacy of the alert is to ignore the pop-up ads and open your security app directly. If there’s a real problem, you should see the same warning there.

What a genuine notification looks like

A legitimate alert should match the security software already installed on your device. It may tell you that a threat was detected, quarantined, or blocked, but it should direct you to manage the issue inside the app rather than through an unfamiliar website.

A real notification:

Appears inside the security app or your operating system’s notification area.
Uses the correct brand name, logo, spelling, and design.
Lets you review scan results or security details inside the app.
Doesn’t pressure you to call a phone number.
Doesn’t demand immediate payment through a pop-up.

Red flags of a fake pop-up alert

A fake virus pop-up often relies on panic rather than useful information. Common warning signs include:

Alarmist claims like “Your computer is infected with 5 viruses!”
Countdown timers or warnings that something bad will happen within minutes.
A phone number you’re told to call immediately.
Prompts to download a “cleaner,” “fixer,” or unfamiliar antivirus tool.
Misspelled words or inconsistent capitalization.
Distorted or poorly rendered logos.
Suspicious, misspelled, or lookalike URLs.
References to an antivirus brand you don’t use.

Signal	Real notification	Scam virus pop-up
Where it appears	Inside the app or system notifications	Inside a browser page
Phone number to call	Doesn’t ask you to call	Often tells you to call
Countdown timer	No	Common
Spelling and logo	Consistent and professional	May have spelling mistakes or distorted branding
Website URL	Official company domain	Random or lookalike URL
Payment request	Handled through the official app or an account	Demands immediate payment
Tone	Informative and matter-of-fact	Urgent and often threatening

PRO TIP

Open the security app directly instead of trusting anything shown inside a browser pop-up. A genuine alert should also appear in the app itself.

Most common examples of virus pop-ups

Fake virus warnings come in many forms, but most use familiar security brands, alarming language, and an urgent next step. The company shown in the pop-up usually has nothing to do with the scam, so it helps to know the most common versions of these fake alerts.

McAfee virus pop-up

A fake McAfee virus pop-up may claim that your subscription has expired, several viruses were detected, or your device is at immediate risk. It may then send you to unrelated or malicious websites, ask you to buy software, or provide a phone number for fake support. If you use McAfee, open the real app directly to check your security status rather than clicking pop-up messages.

Microsoft or Windows virus alert

These scams imitate Windows Security or Microsoft and may claim that your computer has been locked or hacked. A major giveaway is a phone number — Microsoft states that genuine error and warning messages never include a number to call.¹

Critical virus alert pop-up

A critical virus alert pop-up may take over the browser, play warning sounds, display a countdown, or claim that several threats have already been found. These scare tactics are designed to make you act before checking whether the warning is genuine. Microsoft describes this type of full-screen fake warning as scareware.²

Get notified and act immediately.

Protect yourself with dark web monitoring

Get Coveron⁠‌

30-day money-back guarantee

What to do when a virus pop-up appears

If a suspicious warning suddenly appears, don’t follow the instructions inside it. Your first step should be to get out of the page without interacting with the scam.

Don’t click anything inside the pop-up

Avoid clicking buttons such as “Scan,” “Remove virus,” “OK,” or “Download.” Even a fake close button inside the page may redirect you somewhere else or start a download. Instead, close the browser tab or window using your browser or operating system controls.

Close the browser safely

If the tab closes normally, leave the website and don’t return to it. If the page has gone full screen or refuses to close, you can force quit it:

Windows: Press “Ctrl” + “Alt” + “Delete,” open “Task manager,” select your browser, and choose “End task.”
Mac: Press “Command” + “Option” + “Esc,” select the browser, and choose “Force quit.”

Some scam pages deliberately make the browser appear frozen or locked to pressure you into calling the provided number for help.

Never call the number or download the “fixer”

A phone number in a virus warning is a strong sign of a tech support scam. The scammer may pretend to run a diagnostic test, ask you to install remote-access software, and then invent problems that supposedly require paid repairs.

The FTC warns that these scammers may seek remote access, financial information, or payment for services you don’t need.³ If a pop-up gives you a number, don’t call it. You can also learn how to recognize suspicious scam phone numbers.

How to remove a virus pop-up from your browser

Recurring fake alerts usually come from unwanted website notifications, suspicious extensions, or browser settings rather than an actual virus. Start by removing notification permissions and unfamiliar browser extensions. If the alerts continue, reset or refresh the affected browser. The exact steps vary slightly depending on the browser you use.

Remove the pop-up in Chrome

To get rid of a Google Chrome fake virus pop-up:

Block suspicious notifications: Open “Settings” > “Privacy and security” > “Site settings” > “Notifications.” Select “Don’t allow sites to send notifications” or block and remove websites you don’t recognize from the allowed list. Chrome also lets you block notifications directly from a site’s permission controls.
Check the browser’s extensions: Open “Extensions” > “Manage extensions” and remove anything you don’t remember installing or no longer trust.
Reset Chrome if needed: Go to “Settings” > “Reset settings” > “Restore settings to their original defaults.” This will not remove saved bookmarks and passwords.

If the virus pop-up in your Chrome browser keeps returning along with redirects, new tabs, or unwanted extensions, Google notes that unwanted software may also be installed on the computer.⁴

Remove the pop-up in Microsoft Edge

To remove unwanted virus alerts in the Edge browser:

Block website notifications: Open “Settings” > “Privacy, search, and services” > “Site permissions” > “All sites.” Choose the suspicious site, and set “Notifications” to “Block.”
Review the browser’s extensions: Open “Extensions” > “Manage extensions” and remove add-ons you don’t recognize.
Reset Edge: If the problem continues, open Edge’s “Reset settings” page and restore the browser settings to their defaults.

Remove the pop-up in Firefox

For Firefox:

Remove notification access: Go to “Settings” > “Privacy and security” > “Permissions and data” > “Notifications” > “Settings - Notifications Permissions.” Remove or block suspicious websites. You can also block sites from asking for notification permission in the future.
Check the browser’s extensions: Open “Add-ons manager” and remove unfamiliar extensions.
Refresh Firefox: If the pop-ups continue, use “Refresh Firefox” to restore default browser settings while keeping important data such as bookmarks and passwords.

Remove the pop-up in Safari

In Safari on Mac:

Remove website notification permissions: Open Safari > “Settings” > “Websites” > “Notifications” and remove suspicious sites from the list.
Stop future notification requests: In the same menu, uncheck the box next to “Allow websites to ask for permission to send notifications” if you don’t want websites asking for permission at all.
Review the browser’s extensions: Open Safari > “Settings” > “Extensions” and uninstall anything unfamiliar.
Clear suspicious website data: Open Safari > “Settings” > “Privacy” > “Manage website data” and remove data associated with suspicious sites.

How to remove a virus pop-up on a computer

Removing the browser notification is often enough. If alerts continue after you’ve cleaned up the browser, check the computer itself for unfamiliar software or settings.

Remove virus pop-ups on Mac

For a recurring critical virus alert pop-up on Mac, close the browser first, remove its notification permissions, then check for anything unfamiliar that may have been installed.

Review configuration profiles: On current macOS versions, open “System settings” > “General” > “Device management.” If you see an unfamiliar profile, review it carefully and remove it if you know it doesn’t belong there. If you don’t see “Device management,” your device likely doesn’t have a management profile.
Check login items: Open “System settings” > “General” > “Login items & Extensions” and review the apps that launch automatically.
Inspect installed apps: Look through your “Applications” folder and uninstall programs you don’t recognize or remember installing.
Check the browser again: Remove suspicious extensions, notification permissions, and stored website data.

Be careful with configuration profiles if your Mac was provided by a school or employer — legitimate organizations use profiles to manage devices. Check with your IT administrator before changing anything so you don’t break your organization’s security rules.

Remove virus pop-ups on Windows

If fake warnings continue on a Windows PC:

Remove unwanted notifications and extensions from the browser displaying the alerts.
Check installed apps: Open “Settings” > “Apps.” Check the list of installed apps and uninstall suspicious or recently added programs you don’t recognize.
Review startup apps: Open “Settings” > “Apps” > “Startup” and disable unfamiliar software that starts automatically.
Run a full security scan: Open Windows Security and run a full Microsoft Defender Antivirus scan.
Restart the computer and check whether the alerts have stopped.

A persistent pop-up doesn’t automatically prove the computer is infected. But if alerts keep appearing outside the original website or browser session, check for unwanted programs and run a trusted security scan.

How to stop a virus pop-up on mobile

On a phone or tablet, fake virus pop-ups usually come from a browser, website notification, or unwanted app. Block the source rather than interacting with the warning itself.

Stop pop-ups on Android devices

If the alerts are appearing through Google Chrome:

Go to Google Chrome > “Settings” > “Site settings” > “Pop-ups and redirects” and select “Don’t allow sites to send pop-ups and user redirects.”
Go back to “Site settings” > “Notifications” and review the allowed list to block sites you don’t recognize or trust.
Review your recently installed apps and their permissions. Remove anything unfamiliar, especially apps installed around the time the pop-ups started.
If the warnings continue, run your device’s built-in security checks or a trusted malware scan.

Stop pop-ups on an iPhone or iPad

For Safari:

Go to “Settings” > “Apps” > “Safari” and turn on “Block pop-ups.”
Return to “Settings” > “Notifications” and turn off alerts from apps you don’t recognize.
Under "Settings” > “General” > “VPN & Device Management” and look for unfamiliar configuration profiles. If you don’t recognize a profile, review it carefully before removing it.

What to do if you already clicked a fake pop-up or paid money

If you’ve already interacted with the pop-up, what you do next depends on what information or access you gave away. Acting quickly can reduce the chance of further loss.

If you downloaded a file or gave remote access

Disconnect the device from the internet. Then:

Delete suspicious downloads and uninstall remote-access software, such as TeamViewer or AnyDesk, if you didn’t install or use it yourself.
Run a full scan using trusted antivirus or security software.
Change your passwords on another device if you think someone may have accessed your accounts.
Get help from a trusted computer technician if you’re still unsure whether the device is safe.

Tech support scammers commonly ask for remote access so they can pretend to find problems, steal information, or charge for unnecessary fixes.

If you paid or shared card details

Contact your bank or card issuer immediately. Tell them the payment is connected to a scam and ask whether the transaction can be disputed or stopped.

You should also:

Request a replacement card if its details were exposed.
Review recent transactions for anything you don’t recognize.
Keep monitoring your account for new charges.
Change passwords for any accounts that share the same login details.

See these tips for protecting your personal information after a scam.

If you shared personal information

If you gave away information such as your Social Security number, passwords, address, or account details, there’s a risk it could be used for identity theft.

Change exposed passwords immediately, enable multi-factor authentication where available, and monitor your financial and credit accounts. If you notice signs of misuse, see our guides on what to do if your identity is stolen and how to report identity theft.

Coveron’s identity theft recovery support can guide you through the process and reimburse eligible expenses. Online fraud insurance may provide coverage for qualifying scam-related losses, subject to the policy terms.

How to prevent scam pop-ups in the future

You can’t prevent every malicious ad or scam page from reaching you, but a few browser and security habits can lower your risk.

Be careful with “Allow” notification prompts

Many recurring fake virus alerts start because a website was given permission to send browser notifications. Don’t click “Allow” just because a page claims you need it to continue, to verify you’re human, or to play a video. If you aren’t sure why a website needs notification access, decline the request.

Use an ad blocker and keep software updated

A reputable ad blocker can reduce your exposure to malicious ads. Keeping your browser and operating system up to date fixes known security weaknesses.

Keep your security software updated, remove extensions you no longer use, and avoid installing programs from unfamiliar websites. These steps reduce the risk, but they can’t guarantee that you’ll never encounter a scam pop-up.

Recognize the wider scam ecosystem

Fake antivirus warnings are often the opening step in a larger scam. Pop-up scams might lead to a fake support line, a fraudulent software download, a payment request, or a phishing or spoofing attack. For more information, see our guide on what is spoofing.

Learning the patterns behind common online scams and how to spot a phishing email makes those follow-up tactics easier to recognize. Similar impersonation tactics also appear in schemes such as the Geek Squad scam email.

If a scam pop-up exposes your personal or financial information, Coveron can add another layer of support. Dark web monitoring and credit alerts can detect suspicious activity early. Identity theft recovery support helps you respond if your data is misused.

One bad link can expose your payment data.

Get dark web alerts plus up to $10K in eligible online-fraud coverage.