Fake Virus Warnings That Won't Go Away
Both of the first two people who ever paid me had the same problem, a few weeks apart. Warnings about viruses that wouldn't stop. Neither of them had a virus.
That's not a coincidence — it's the most common computer problem there is right now, and almost nobody knows what it actually is. So here's the whole thing, plainly.
Does any of this sound like what's happening?
A box says your computer is infected, or names a number of viruses it found
Warnings keep popping up and won't go away, no matter how many times you close them
It says your McAfee or Norton subscription expired — and you're not sure whether it really did
The pop-ups still appear even when your browser is closed
There's a phone number in the warning telling you to call for support
You paid to renew something and nothing ever installed
You're just trying to work out whether the warning is real
If you recognize two or three of those, keep reading. It's very likely none of it is a virus.
What's usually happening
Somewhere along the way, a website asked "Allow notifications?" and someone clicked Allow. Maybe to get past it. Maybe by accident. Maybe a year ago on a page nobody remembers visiting.
That permission lets the site send you alerts. Forever. And a scam site uses it to send warnings that look like they came from your computer — Windows-style boxes, an antivirus logo, a red shield, a count of infections that keeps going up.
It isn't a virus. It's a website you gave permission to. The industry name for this is scareware, which is exactly what it sounds like.
Two things make it convincing. They can appear when your browser is closed — Microsoft's own documentation confirms Edge notifications still show up after you shut the browser, which is exactly why people assume it must be something installed on the machine. And they name real products, because "McAfee" scares people more than a made-up name would.
The goal is never the virus. It's getting you to click, call a number, or pay to "renew" something.
Three things this could be — and they're not equally hard
One: browser notification spam. Most cases. It's a permission setting, and you can clear it yourself in about two minutes. Instructions below.
Two: actual adware. Something really did get installed — a browser extension, a bundled program from a free download. Symptoms overlap with the first one, but you'll usually also see a search engine you didn't choose, a homepage that keeps coming back, or a machine that's suddenly slow. This one needs tools and some judgment about what's safe to remove.
Three: a payment already went through. That's not a computer problem anymore. That's fraud, and it's the urgent one.
You might have more than one. Work through them in order.
Fixing the common one yourself
First, the quick test: do the warnings stop if you close the browser and wait a few minutes? If yes, it's notification spam. (If they still show up with everything closed, that doesn't automatically mean malware either — Edge in particular can deliver them after it's shut — but it makes the next section more likely.)
Chrome. Click the three dots at the top right → Settings → Privacy and security → Site settings → Notifications. Under "Allowed to send notifications," look for anything you don't recognize. Click the three dots beside it and choose Remove.
Edge. Click the three dots at the top right → Settings → Cookies and site permissions → Notifications. Under "Allow," find the site, click the three dots beside it, and choose Remove.
Firefox. Click the three lines at the top right → Settings → Privacy & Security → scroll to Permissions → click Settings… next to Notifications. Select the site, click Remove Website, then Save Changes.
You're looking for domains that mean nothing to you — strings of words that sound technical, random letters, anything ending in an unusual suffix. Legitimate sites you actually use can stay.
Then stop it happening again. In the same screen, turn off the option that lets sites ask — Chrome calls it "Don't allow sites to send notifications," Edge calls it "Ask before sending," Firefox calls it "Block new requests asking to allow notifications." You'll never see the prompt again, which is no loss for most people.
If the warnings are gone, you're done. That's genuinely the whole fix, and it's free.
"My McAfee expired and now I can't get rid of the warnings"
This one deserves its own paragraph because it's the most common version I get called about, and it's cleverer than it looks.
It usually starts with something true. A real subscription really did expire, or a trial that came with the computer ran out. So when a warning appears saying you're unprotected, it matches something you already half-knew — and that's what makes it land.
The warning isn't from McAfee. It's a website using the name. The "renew" button goes to a scam page, and the reason nothing installs afterward is that there was never anything to install. You paid a stranger.
Two things to check. Is McAfee actually still on the computer? Look in Settings → Apps. If it's there and expired, uninstalling it is fine — Windows Defender is already built in and takes over automatically once nothing else is claiming the job.
And check your card, because that charge needs disputing.
If that didn't do it
Then you're likely in the second category, and I'll be straight with you about where the do-it-yourself line is.
Signs it's actually installed: your search engine or homepage changed and won't stay changed; browser extensions you didn't add; new programs in your list with names you don't recognize; the machine got noticeably slower around the same time the warnings started.
What's safe to do yourself: look through your browser's extensions and remove anything you didn't deliberately install. Look at Settings → Apps in Windows, sorted by install date, and see what arrived the week this started.
What I'd be careful about: removing things you're not sure of. Some of what looks suspicious is normal, some of what looks normal isn't, and deleting the wrong thing makes an afternoon into a weekend. And if a scam program is designed to reinstall itself, uninstalling it once won't hold.
That's the point where a person who does this every day is worth the money — not because the steps are secret, but because knowing which is which takes having seen a few hundred of them.
Should I call the number in the warning?
No. Never.
Real companies don't put a support number inside a pop-up warning. That number is the whole point of the warning — it goes to someone who will ask to remote into your computer, "find" problems, and charge you to fix them. Sometimes they'll take a payment and leave something behind.
Same for anyone who calls you claiming to be from Microsoft, Apple, or your internet provider. Microsoft does not call people about viruses. Nobody does.
If money already changed hands
Deal with this first, before the computer.
Check the charge and find the merchant name. If it isn't clearly the company you thought you were paying, call the number on the back of your card and dispute it. Do that before it settles if you can.
Expect them to come back. There's almost always a second act — a call or email saying they need to "finish activating your protection," or that they're processing a refund and need your account details. That's the same crew, and the refund half is often the more expensive one.
If anyone remoted into your computer, treat that seriously. Disconnect it from the internet, stop using it for banking, and get someone to look at it. Somebody who had control of the machine could have left something behind or seen anything you had open.
And if you entered a password on the fake page, change it — and change it anywhere else you used the same one. If it was your email password, start there, because your email is the reset button for everything else you own.
One more thing worth doing while you're thinking about it
This one turned out to be nothing. A permission setting, a scary-looking box, a couple of minutes to clear.
But it made you think about that computer — probably for the first time in a while. So while it's on your mind: if that machine died tonight, what would you lose?
Most people have never actually checked. The backup light is green, or there's a cloud folder that seems to be syncing, and that feels like enough right up until the day it isn't. Here's how to test whether your backup actually works — five minutes, and you'll know instead of assuming.
And if the answer turns out to be "there isn't one," my backup software is free to try for 14 days, no card. It images the whole machine and checks that the image can actually be restored. The backups it makes are in Windows' own format, so they keep working whether you ever pay me or not.
The next thing might not be a fake warning.
If you'd rather someone just handled it
If you're in Hardin County or around central Kentucky and you'd rather not work through any of this, call me. This is the exact problem I get called about most, and in person it's usually a short visit.
If it's a business computer, that's what I do for small businesses across central Kentucky — and the free Data Safety Check is a good place to start.
If you're not local, everything above is what I'd do anyway. It's yours.
David Martin
Information Security Kentucky LLC
Protect. Prevent. Prepare.
Hardin County, Kentucky