Fake Virus Alerts and Scareware Pop-Ups in Chrome or Edge
Fake Virus Alerts and Scareware Pop-Ups in Chrome or Edge
A browser alert may claim that your computer has viruses, your McAfee or Norton subscription expired, your files are at risk, or you must call support immediately. It may use a familiar logo, show a countdown, play an alarm, cover the screen, or appear as a notification near the Windows clock. These messages are often scareware. Their goal is to make you click, install software, call a scammer, pay for an unnecessary product, or allow remote access.
A logo does not prove that the message came from that company. A website can display the name and image of almost any security vendor. Legitimate security software should be opened from its installed application, the Windows Security app, or an approved company portal, not through a random browser message.
If the warning is still on screen
Do not click Scan, Renew, Remove Virus, Allow, Cancel, or the close button inside the advertisement. The page controls those buttons and may make every option perform the same unsafe action.
Do not call the phone number, start a chat, scan a QR code, or install the offered application. Do not provide payment information, passwords, MFA codes, or remote access.
Try to close the browser tab using the normal tab X. If the tab will not close, close the entire browser using the normal window X.
If the browser is frozen on Windows, press Ctrl + Shift + Esc, open Task Manager, select Chrome or Edge, and choose End task. This may close other unsaved browser tabs. On a Mac, press Option + Command + Esc, select the browser, and choose Force Quit.
Reopen the browser carefully. If it offers to restore every tab, decline the restore when that would reopen the scareware page. Do not revisit the page to test whether the warning returns.
If alerts keep appearing near the clock
You may have allowed a website to send browser notifications. These alerts can appear even when you are not viewing the site. Do not click the notification itself. Open the browser settings from its normal menu.
In Chrome, open Settings, select Privacy and security, select Site settings, then Notifications. Review the Allowed list and remove or block the suspicious site.
In Edge, open Settings, select Cookies and site permissions, then Notifications. Review the Allow list and remove or block the suspicious site.
Remove only sites you recognize as unwanted. Do not reset the entire managed browser, delete the work profile, or clear all settings unless Zerolimit Consulting instructs you to. Company applications may depend on approved browser settings.
Check for downloads and extensions
Open the browser download list without opening any downloaded file. Record the filename and time, then contact Zerolimit if the warning caused a download. Review the extensions page only to identify unfamiliar items. Do not install a cleanup extension or randomly remove a company extension. Zerolimit can determine whether an extension or application needs to be removed.
Do not uninstall the organization's approved antivirus or endpoint protection because a pop-up says that another product is required. Do not purchase a second security product through the warning.
If you clicked, paid, called, or granted access
Contact Zerolimit immediately from another trusted device. Explain exactly what happened, including which buttons you clicked, whether a file ran, whether someone controlled the computer, and what information you entered.
If another person still has remote control and Zerolimit cannot be reached immediately, disconnect the affected computer from Wi-Fi or Ethernet, leave it powered on, and stop using it. Do not uninstall the remote tool, run a cleaner, delete files, or attempt to erase evidence.
If you entered a password, identify the affected account without placing the password in the ticket. If you approved MFA, provided a verification code, or entered payment information, say so clearly. Contact the card issuer using the number printed on the card when payment details were exposed.
What to include in a support ticket
Include the affected user and device, browser name, time the alert appeared, website you were visiting, wording shown, phone number displayed, and every action taken. Attach a screenshot only if you can capture it without clicking the warning and without exposing confidential information.
Use the Security Incident or Suspicious Activity category if software was installed, credentials or payment information were entered, remote access was granted, or the alert keeps returning.
Official references
Google explains how to review and block Chrome website notifications: https://support.google.com/chrome/answer/3220216?hl=en
Microsoft explains how to manage website notifications in Edge: https://support.microsoft.com/en-us/edge/manage-website-notifications-in-microsoft-edge
Microsoft explains how to recognize and respond to technology support scams: https://support.microsoft.com/en-us/office/protect-yourself-from-tech-support-scams