No Ticket Needed

Appearance

7 min fix 10 min read Recently reviewedBeginner

By , IT support technician

Quick Answer

These alerts come from a website you allowed to send notifications, not from Windows. Close the pop-up with Task Manager, then open your browser's Notifications settings and remove the site. A real Microsoft alert never asks you to call a phone number.

How to Stop Fake Virus Pop-ups and Spam Notifications from Your Browser ​

Applies to: Microsoft Edge, Google Chrome; Windows 11, Windows 10
Article Type: Troubleshooting
Last Updated: 2026-07-29

Summary ​

Alerts claiming your PC is infected keep appearing in the corner of your screen, even with the browser closed. Your computer is almost certainly fine. At some point a website asked to send you notifications, the Allow button was clicked, and that site now pushes scam alerts through a permission you granted. This article removes that permission in Edge and Chrome and closes the pop-up safely along the way.

Symptoms ​

  • Alerts reading Your PC is infected!, Windows Defender — 5 viruses found, or Your McAfee subscription has expired appear in the bottom-right corner of the screen.
  • The alerts keep arriving after you close the browser, and sometimes right after you log in to Windows.
  • Each alert shows a website address in small text, or the word Chrome or Edge, somewhere along its edge.
  • Clicking one opens a full-screen page with a countdown, a siren sound, or a phone number to call.
  • A page appears that looks like a Windows settings screen or a blue error screen but sits inside a browser window.
  • Your antivirus scans come back clean, which makes the alerts seem more alarming rather than less.

Prerequisites ​

  • Microsoft Edge or Google Chrome on Windows 11 or Windows 10.
  • No admin rights required. Every step here changes settings inside your own browser profile.

Instructions ​

1. Confirm These Are Browser Notifications, Not a Windows Alert ​

Knowing which one you are looking at tells you where the fix lives. Three tells separate them, and any single one is enough.

  • The name on the alert. A browser notification carries the site's web address, or the words Microsoft Edge or Google Chrome, in small grey text near the top or bottom of the banner. A genuine Windows Security alert carries the words Windows Security and a blue shield icon.
  • The phone number. Genuine Microsoft and Windows Security messages never contain a support phone number, and Microsoft never calls you first about an infection. A number on screen means a tech support scam with certainty.
  • The demand. Real security software quarantines a threat and tells you afterwards. It does not ask you to call, pay, download a "cleaner", or grant remote access to your screen.

Note: These alerts often copy the Windows Defender shield and the exact wording of real alerts. Judge by where the message came from, not by how convincing it looks.

2. Close the Pop-up Without Clicking Inside It ​

If a full-screen scam page is on your screen right now, close it from outside. Everything inside that window was drawn by the attacker, including the X in the corner and any button labelled Close or Cancel.

  1. Press Alt + F4. This closes the active window from Windows itself and ignores anything the page has drawn.
  2. If the window will not close, press Ctrl + Shift + Esc to open Task Manager.
  3. In the Processes tab, click Microsoft Edge or Google Chrome in the list.
  4. Click End task in the top-right corner. Every browser window closes at once.
  5. Reopen the browser. If a bar appears across the top offering to Restore pages, click the X on that bar to dismiss it. Restoring reopens the scam page.

Tip: If the page has taken over the whole screen and hidden the taskbar, press F11 first to leave full-screen mode, then Alt + F4.

3. Revoke Notification Permission in Microsoft Edge ​

This is the fix. Removing the site from the Allow list stops the alerts at source.

  1. Open Microsoft Edge.
  2. Click the three dots (...) in the top-right corner and select Settings.
  3. Click Cookies and site permissions in the left sidebar.
  4. Scroll down to the All permissions section and click Notifications.
  5. Look at the Allow list. Any address you do not recognise as a site you deliberately signed up to is the culprit — news sites, casino domains, and long strings of random letters are typical.
  6. Click the three dots (...) to the right of that address and select Remove. The entry disappears from the list.
  7. Repeat for every unfamiliar address. Removing all of them is safe — sites you genuinely want alerts from will ask again.
  8. Turn on Ask before sending (recommended) at the top of the page if it is off, and turn on Quiet notification requests below it so future prompts appear as a small bell icon in the address bar instead of a dialog.

Verification: The Allow list is now empty, or contains only sites you recognise. The alerts stop immediately — there is no need to restart Windows.

4. Revoke Notification Permission in Google Chrome ​

Chrome keeps the same setting in a different place. Do this as well if you use both browsers, because each holds its own separate permission list.

  1. Open Google Chrome.
  2. Click the three dots (⋮) in the top-right corner and select Settings.
  3. Click Privacy and security in the left sidebar, then click Site settings.
  4. Under Permissions, click Notifications.
  5. Look at the Allowed to send notifications section and find any address you do not recognise.
  6. Click the three dots (⋮) to the right of that address and select Remove. The entry disappears from the list.
  7. Repeat for every unfamiliar address.
  8. Select Don't allow sites to send notifications at the top of the page if you want no site to be able to ask again. Choosing Use quieter messaging instead keeps prompts available but reduces them to an icon in the address bar.

Note: If you are signed in to Chrome with a work or personal Google account, these permissions sync across your devices. Removing the site here removes it on your other signed-in machines too.

5. Check for a Rogue Extension ​

If the alerts return after Step 3 or Step 4, an extension is putting the permission back. Browser extensions installed alongside free software are a common source.

  1. In Edge, type edge://extensions in the address bar and press Enter. In Chrome, type chrome://extensions and press Enter.
  2. Read through the list. You are looking for anything you do not remember installing, particularly items named after coupons, video downloaders, PDF converters, or search tools.
  3. For anything suspicious, switch its toggle Off first and use the browser for a few minutes. The alerts stopping confirms you found it.
  4. Click Remove on that extension and confirm in the dialog. The tile disappears from the page.
  5. If the toggle is greyed out and a note reads that the extension is installed by your organisation, that one is deployed by IT and is not the cause. Tell IT: "An extension I did not install is locked on my browser profile and I need to know whether it is a company deployment."

Note: If the same extension also changed your search engine or homepage, work through How to Fix a Hijacked Browser Search Engine as well — those settings stay changed after the notification permission is removed, and they need resetting separately.

6. Reset Your Browser Settings If the Alerts Come Back ​

A reset clears every site permission, disables extensions, and restores the default start page. It keeps your favourites, browsing history, and saved passwords.

  1. In Edge, go to Settings and click Reset settings in the left sidebar, then Restore settings to their default values, then Reset in the dialog.
  2. In Chrome, go to Settings and click Reset settings in the left sidebar, then Restore settings to their original defaults, then Reset settings in the dialog.
  3. Close and reopen the browser. Extensions now appear switched off on the extensions page, and the notification Allow list is empty.
  4. Switch back on only the extensions you use and recognise.

Verification: Return to the notifications page from Step 3 or Step 4. The Allow list contains nothing. Work normally for a day — no alerts confirms the permission is gone for good.

7. Rule Out Focus Assist and Do Not Disturb ​

Windows has a setting that silences notifications, and reaching for it here is a natural instinct. It hides the symptom and leaves the cause untouched, which is worth understanding before you rely on it.

  • In Windows 11, the setting is Do not disturb, at Settings > System > Notifications. In Windows 10 it is called Focus assist and sits at Settings > System > Focus assist.
  • Turning either on stops the banners from appearing on screen. The site keeps its permission, the alerts keep arriving, and they stack up silently in Notification Centre for you to find later.
  • It also silences everything else — Teams calls, calendar reminders, and genuine Windows Security warnings.
  • Use it as a five-minute reprieve while you work through Steps 3 and 4 if the alerts are making that difficult. Turn it back off once the permission is removed.

Tip: To confirm which site sent an alert you already dismissed, press Windows + N to open Notification Centre. Each banner shows its source address, which tells you exactly what to remove in Step 3.

Troubleshooting ​

WARNING

If you called the number on one of these alerts and allowed anyone to connect to your computer, treat this as a live compromise. Disconnect from Wi-Fi, change your work password from a different device, and phone your helpdesk to say: "I gave a caller remote access to my machine and need my account reviewed and the device rebuilt." Do not pay, and do not let them reconnect.

Symptom / ErrorPotential CauseSolution
Alerts continue after removing every siteA rogue extension is re-adding the permissionWork through Step 5, then reset the browser as in Step 6.
The Allow list is already empty but alerts persistThe alerts come from the other browserEach browser stores permissions separately. Complete both Step 3 and Step 4, even if you rarely open the second browser.
The alert reappears the moment you sign in to WindowsThe browser is set to launch at startupOpen Task Manager, click Startup apps in the left sidebar, select the browser, and click Disable. Then remove the site permission in Step 3.
Remove is greyed out next to a siteThe permission is set by company policyNote the exact address shown and tell IT: "A site is force-allowed for notifications on my browser profile and I need it removed from policy."
A full-screen page will not close and blocks the taskbarScam page is holding full-screen modePress F11 to leave full-screen, then Alt + F4. If that fails, use Ctrl + Shift + Esc and End task as in Step 2.
You clicked a button inside the pop-up before reading thisThe page may have offered a downloadOpen your Downloads folder, delete anything that arrived at that time without opening it, then run a full scan in Windows Security > Virus & threat protection.