How to Remove Fake Virus Pop-Ups on Windows 11 (Chrome & Edge)

A fake virus pop-up on Windows 11 can look frighteningly real. It may use a Microsoft Defender, McAfee, Norton, Chrome, or Edge logo; claim that several viruses were found; play an alarm; or tell you to call a toll-free number immediately. The warning may even appear in the Windows notification area after you close the browser.

Fake virus pop-ups blocked on a Windows 11 computer

In many cases, the PC is not infected. The alert is a deceptive webpage or a website notification that was allowed—often after a page asked the visitor to click Allow to prove they were human, watch a video, or download a file. In other cases, persistent redirects, unknown extensions, or recently installed software can indicate adware or malware that deserves a proper scan.

This guide explains how to tell the difference and remove the source safely in Google Chrome and Microsoft Edge. It also covers what U.S. users should do if they called the number, paid the scammer, shared personal information, or allowed remote access. Instructions and official sources were checked on August 15, 2026.

Is the Virus Warning Real or Fake?

A real security alert should be verifiable inside the security product that generated it. For Microsoft Defender, open Start → Windows Security → Virus & threat protection → Protection history. If the alarming browser message has no matching event there, that is evidence that the webpage or notification—not Windows Security—created the warning.

Fake alerts rely on urgency. They may claim your files, subscription, banking information, or IP address is at risk. Some place the browser in full-screen mode, repeat dialog boxes, or play speech that tells you not to turn off the computer. These effects can make a webpage resemble a system screen, but a website cannot diagnose every file on your PC simply because you opened a page.

Step 1: Close a Fake Virus Pop-Up Safely

Start with the least disruptive option. Avoid clicking anywhere inside the suspicious page because even a button labeled “Cancel” or an X can be part of the scam.

When the browser opens again, decline any prompt to restore the previous session if it would reopen the suspicious page. If the bad tab returns automatically, disconnect the internet temporarily, open the browser settings, and continue with the permission and reset steps below.

Step 2: Remove Fake Virus Notifications From Google Chrome

Chrome website notifications can appear through the Windows notification system, which makes them look like operating-system alerts. Removing the site's permission stops the source instead of merely muting Chrome in Windows.

1. Open Chrome and select the three-dot menu.
2. Open Settings → Privacy and security → Site Settings → Notifications.
3. Review the sites under the list allowed to send notifications.
4. For every domain you do not recognize or trust, open its menu and select Block or Remove.
5. Consider enabling Chrome's quieter notification prompts so unfamiliar sites cannot interrupt you with aggressive requests.
6. Restart Chrome and watch whether the false warnings return.

You can also manage a site's permission from the address bar while visiting a trusted page: select the site-information icon, find Notifications, and choose Block. Do not revisit a known scam page merely to change this setting; use the full settings list instead.

Step 3: Remove Fake Virus Notifications From Microsoft Edge

Microsoft explains that website notifications can continue to appear in the lower-right corner and Notification Center even when Edge is closed. Use Edge's site permissions to revoke access.

1. Open Microsoft Edge and select Settings and more (the three-dot menu).
2. Choose Settings → Privacy, search, and services → Site permissions → All sites.
3. Select an unfamiliar site that has been sending warnings.
4. Find Notifications and change the permission to Block.
5. Repeat the process for every suspicious domain.
6. Close and reopen Edge.

If you are already on a site you trust, the site-information icon to the left of the address bar also provides a notification permission. Again, do not reopen a scam site just to access that shortcut.

Step 4: Block Browser Pop-Ups and Redirects

After removing notification permissions, verify that pop-up and redirect protection is active.

In Google Chrome

1. Open Settings → Privacy and security → Site Settings.
2. Select Pop-ups and redirects.
3. Use the option that does not allow sites to send pop-ups or use redirects.
4. Remove unfamiliar domains from any allowed list.

In Microsoft Edge

1. Open Settings → Cookies and site permissions or the current Site permissions section.
2. Select Pop-ups and redirects.
3. Make sure blocking is enabled.
4. Remove suspicious sites from the Allow list.

Pop-up blocking reduces interruptions but is not an antivirus scan. If the browser continues to redirect on many unrelated websites, inspect extensions, applications, and Windows Security next.

Step 5: Remove Suspicious Browser Extensions

An unwanted extension can inject ads, change search results, replace the homepage, read browsing activity, or restore permissions after you remove them.

Chrome

1. Select the three-dot menu → Extensions → Manage extensions.
2. Review every extension, especially anything installed near the time the problem began.
3. Remove extensions you did not intentionally install or no longer need.
4. Disable uncertain extensions one at a time and test the browser.

Microsoft Edge

1. Select the three-dot menu → Extensions → Manage extensions.
2. Turn off or remove unknown add-ons.
3. Restart Edge and check whether redirects or warnings continue.

Step 6: Check Recently Installed Windows Apps

Browser notification spam does not normally install an app by itself. However, if you downloaded a “cleaner,” “driver updater,” browser helper, remote-support tool, or security program after seeing the warning, review installed software.

1. Open Settings → Apps → Installed apps.
2. Sort by installation date if that option is available.
3. Look for software installed when the warnings began.
4. Research the exact publisher and product name using the developer's official website.
5. Uninstall software you know came from the scam or that the scammer asked you to install.
6. Restart Windows.

Do not remove an unfamiliar Microsoft, Intel, AMD, NVIDIA, Realtek, Dell, HP, Lenovo, or other hardware component merely because its name is technical. If you are unsure, leave it in place until you verify what it does.

Step 7: Run Windows Security Scans

Even when the original alert was fake, a scan is sensible if you clicked a download, installed a program, enabled an extension, or allowed remote access. Windows 11 includes Microsoft Defender Antivirus through the Windows Security app.

1. Open Start → Windows Security → Virus & threat protection.
2. Under protection updates, check for the latest security intelligence.
3. Run a Quick scan first.
4. Open Scan options and select Full scan if you downloaded or installed anything suspicious.
5. Review Protection history after the scan and follow Windows Security's recommended actions.

A full scan can take a long time and use considerable disk and processor resources. Let it finish. Do not install several real-time antivirus products at once, because they can conflict and reduce performance.

When to use Microsoft Defender Offline

Use the offline scan when malware keeps returning, Windows Security recommends it, or you have strong reason to suspect a persistent infection. Save open work first because the computer will restart.

1. Open Windows Security → Virus & threat protection → Scan options.
2. Select Microsoft Defender Antivirus (offline scan).
3. Choose Scan now.
4. Allow the PC to restart and complete the scan in the recovery environment.
5. After Windows starts again, open Protection history to review the result.

Step 8: Reset Chrome or Edge if the Problem Continues

A browser reset is useful when the homepage, search engine, startup tabs, content permissions, or extensions keep changing. It should come after you record any settings you need.

Reset Chrome

1. Open Chrome Settings → Reset settings.
2. Select Restore settings to their original defaults.
3. Confirm Reset settings.

Google says this does not delete saved bookmarks or passwords. It resets items such as the default search engine, startup behavior, content settings, cookies, themes, and extensions. You may need to sign in to websites again and re-enable only the extensions you trust.

Reset Microsoft Edge

1. Open Edge Settings → Reset settings.
2. Select Restore settings to their default values.
3. Read the confirmation carefully and select Reset.

If the browser is managed by an employer or school, contact the administrator before resetting it. If resets do not hold and unknown settings return after every restart, run the offline scan and seek trusted technical help.

What to Do if You Called the Number or Allowed Remote Access

Do not feel embarrassed. Tech-support scams are designed to create fear and rush reasonable people into acting. Focus on limiting access and protecting accounts.

Check email forwarding rules, recent sign-ins, recovery addresses, and bank transactions. If the scammer saw sensitive documents or obtained a Social Security number, visit IdentityTheft.gov for a personalized U.S. recovery plan.

What to Do if You Paid the Scammer

Act quickly. Recovery is not guaranteed, but the U.S. Federal Trade Commission says it is always worth asking the company used to send the money whether the transaction can be reversed.

• Credit or debit card: call the issuer using the number on the back of the card, report a fraudulent charge, and ask about reversal and card replacement.
• Bank transfer: contact the bank's fraud department and report an unauthorized or fraudulent transfer.
• Payment app: report the transaction to the app and to the linked bank or card issuer.
• Gift card: contact the issuer immediately, keep the card and receipt, and ask whether funds can be frozen or refunded.
• Wire transfer: contact the wire service or bank immediately and request a reversal.
• Cryptocurrency: transactions are usually difficult or impossible to reverse, but notify the exchange or service used and report the fraud.

Report the incident at ReportFraud.ftc.gov. If the scam involved identity information, also use IdentityTheft.gov. Keep screenshots, receipts, phone numbers, email messages, transaction IDs, and the names of remote-access applications, but do not continue communicating with the scammer to collect more evidence.

How to Prevent Fake Virus Alerts

• Never click Allow because a site says it is required to prove you are human, remove a virus, start a download, or watch a video.
• Never call a phone number displayed in a virus pop-up.
• Download browsers, updates, and security tools from their official websites—not from sponsored ads or pop-up pages.
• Keep Chrome, Edge, Windows, and security intelligence updated.
• Review website notification permissions and browser extensions periodically.
• Use unique passwords and enable two-factor authentication on email and financial accounts.
• Keep an offline or protected backup of important personal files.
• Teach family members that legitimate companies do not demand gift cards, cryptocurrency, secrecy, or unexpected remote access.

Keeping Windows current also closes security weaknesses used by real malware. If updates fail or remain frozen, follow our safety-first guide to fix a Windows 11 update stuck at 0%, 99%, or 100% using built-in Microsoft tools.

What Not to Do

• Do not call the number in the warning.
• Do not grant remote access to an unsolicited caller.
• Do not pay with gift cards, cryptocurrency, or a bank transfer to “unlock” the PC.
• Do not install a cleaner, driver updater, browser extension, or antivirus promoted by the pop-up.
• Do not disable Windows Security because a webpage tells you to.
• Do not edit the Registry or run random PowerShell, BAT, or cleanup scripts from forums.
• Do not assume a clean scan alone makes exposed passwords or financial details safe; secure the accounts separately.

When to Get Professional Help

Contact the PC manufacturer, a trusted local technician, or your organization's IT department if the browser remains hijacked after a reset, Windows Security cannot complete a scan, security settings turn themselves off, unknown administrator accounts appear, files become encrypted, or the same malware returns after an offline scan.

For a work or school PC, report the incident before uninstalling managed tools or resetting Windows. If you decide that Windows must be reset after confirmed remote compromise, back up personal documents carefully and use Microsoft's built-in Recovery options. Do not preserve suspicious installers, scripts, or executable files in that backup.

Explore more tested troubleshooting articles in the ACSNETWORLD Windows guides.

Frequently Asked Questions