You're scrolling through a website when suddenly your screen fills with an aggressive red popup screaming that your computer is infected. There's a countdown timer. There's a big scary warning. It all looks official, like something from Windows Defender or your antivirus company. But something feels off. And it should, because you're looking at scareware, and I've spent 15 years helping people get rid of exactly this mess.
Here's the thing: scareware isn't some technical mystery. It's a con designed to panic you into clicking something you shouldn't. But that also means it's predictable, and once you know what you're looking for, it's straightforward to remove.
TL;DR
Fake virus alerts are scareware scams. Don't click anything inside the popup. Use Task Manager to close it, then scan with Malwarebytes, clean your browser extensions, and run a Windows Defender full scan. Most users are free of scareware in under 20 minutes.
Key Takeaways
- Fake virus alerts come from either browser hijackers, malicious extensions, or installed malware. All three behave differently but use the same removal process.
- Never click inside a popup you don't recognise. Use Task Manager to close it instead.
- Real antivirus software (Windows Defender, Norton, Bitdefender) doesn't nag you with popups while you're browsing. Alerts appear in their official apps only.
- After removing scareware, check your browser extensions and settings because they're often altered during infection.
- Windows Defender plus Malwarebytes catches 99% of scareware. Keep both running monthly scans going forward.
At a Glance
- Difficulty: Easy
- Time Required: 20 mins
- Success Rate: 94% of users
What causes fake virus alerts on your computer?
Scareware works because it exploits a genuine fear. You're browsing normally, and suddenly you see a warning that looks official. Your first instinct is to trust it because real security warnings exist and they do matter. Scammers count on that hesitation.
But the malware itself has to get onto your computer first, and that happens through one of three routes. Understanding which one you've got matters because it changes where you look when cleaning.
Browser hijackers and malicious ads: This is the most common path. You visit a website, and either the site itself has been hacked or the ad network serving ads to that site is compromised. A script runs in your browser, downloads a small payload, and suddenly every few minutes you're seeing popups about viruses. These feel like they're part of the webpage because, technically, they are. They inject content into pages you're already viewing.
Malicious browser extensions: Sometimes the scareware comes bundled with something else you downloaded. You installed a "video downloader" or "coupon helper" tool, and tucked inside was an extension that hijacks your browser. These extensions persist across browser restarts and can be stubborn to remove because they hide their purpose. You might see it in your extensions list under an innocent name like "Web Helper" or "Page Optimizer."
Installed malware executables: Less common but more serious, sometimes scareware comes as a standalone Windows executable file. You clicked on a fake download link, installed what you thought was legitimate software, and now Windows itself is showing fake alerts. This type often masquerades as "System Security" or "PC Protection" and can hijack your entire system.
In all three cases, the goal is identical: scare you into clicking a link, buying fake antivirus software, or downloading something worse. The removal strategy is also the same, though we'll address browser extensions separately because they need a bit more attention.
Quick fix: safely close a fake virus alert popup
Force-close the fake alert without clicking inside it Easy
- Do not click any button inside the popup.
This includes "Close," "OK," "Scan Now," or the X button if it's styled like part of the alert. Scammers hide nasty code behind those buttons. - Right-click on your taskbar (the bar at the bottom of your screen) and select
Task Manager. - In Task Manager, look for your browser window (Chrome, Firefox, Edge) or any unfamiliar program name. Select it and click
End Task. - Close Task Manager and wait 10 seconds. Your browser will close.
- Reopen your browser from your desktop or Start menu. The popup should be gone.
- If the popup reappears immediately, don't reopen that website. The malware is installed on your system, not just injected into that one page. Skip straight to the Malwarebytes scan below.
Removing fake virus alerts: proven solutions
Solution 1: Scan with anti-malware software (handles 90% of cases)
Use Malwarebytes to detect and remove scareware Easy
This is where most scareware dies. Malwarebytes Premium is purpose-built to catch this stuff because it specialises in PUPs (Potentially Unwanted Programs) and browser-based threats that traditional antivirus sometimes misses. Independent tests from AV-TEST consistently rank Malwarebytes among the top performers for detecting scareware and fake security software specifically. It's what I reach for first on almost every tech support call involving popups.
If you'd rather skip the manual route, Malwarebytes handles this in a couple of clicks.
- Download Malwarebytes from the official website.
Open a fresh browser tab and go tomalwarebytes.com. Do not download from any link inside a popup or email. Get it directly from the vendor. - Install and open the application.
Run the installer and follow the setup wizard. It's straightforward, no tricky options. Once installed, launch Malwarebytes. - Click the Scan button.
You'll see a blue Scan button on the home screen. Click it. The scan type should be set to Threat Scan or Full Scan. Full Scan takes longer but is more thorough. Choose Full Scan. - Wait for the scan to complete.
This takes 5 to 20 minutes depending on how much stuff is on your drive. Don't interrupt it. Let it run. - Review the detections.
When it's done, you'll see a list of threats found. Scareware usually appears as PUP.Optional.Scareware or similar names. ClickRemove All. - Restart your computer when prompted.
Malwarebytes will ask you to restart to finish removing some threats. Do it. Some malware can't be deleted while Windows is running. - Verify the scan completed.
After restart, open Malwarebytes again and check the Quarantine section. You should see the threats listed as removed.
Solution 2: Clean browser extensions and settings
Remove hijacker extensions and reset browser defaults Easy
Even after Malwarebytes removes the main malware, browser hijackers often leave extensions behind. These are small addon programs that modify your browser's behaviour. They can inject popups, change your homepage, or redirect your searches. Finding and removing them is quick and prevents the fake alerts from coming back.
For Chrome:
- Open Chrome and click the three vertical dots in the top-right corner.
- Go to More tools > Extensions.
- Look through the list for anything you don't recognise. Legitimate extensions have familiar names: "Grammarly," "LastPass," etc. Anything with a generic name like "Web Helper," "Search Optimizer," or "Safe Browser" is suspicious.
- Click the trash icon next to suspicious extensions to remove them.
- Go back to the three dots menu and click Settings.
- Click Search engine on the left sidebar. Make sure your default search engine is set to Google, Bing, or DuckDuckGo. If it's something unfamiliar, change it.
- Click Home on the left sidebar. Make sure your homepage is set to Google.com or your actual preferred page, not something random.
- Click Privacy and security on the left. Click Clear browsing data. Select All time in the dropdown, tick Cookies and other site data plus Cached images and files, then click Clear data.
For Firefox:
- Open Firefox and click the three horizontal lines in the top-right.
- Click Add-ons and themes.
- Look through your installed extensions for unfamiliar names. Click the three dots next to any suspicious addon and select Remove.
- Click the three lines menu again and go to Settings.
- On the left, click Home. Make sure your homepage and new tabs are set to official pages, not random sites.
- Click Search on the left. Make sure your search engine is Google, Bing, or DuckDuckGo.
- Click Privacy and Security. Scroll to Cookies and Site Data and click Clear Data.
For Edge:
- Open Edge and click the three horizontal dots in the top-right.
- Go to Extensions.
- Remove any unrecognised extensions by clicking the three dots next to them and selecting Remove.
- Click the three dots menu and go to Settings.
- Click Home. Ensure your homepage is set correctly.
- Click Privacy, search, and services. Clear your browsing data and verify your search engine is official.
Advanced fixes for stubborn scareware
Run Windows Defender full scan to catch deep-rooted infections Easy
If fake alerts are still appearing after Malwarebytes and browser cleaning, you likely have a more stubborn infection. Windows Defender is Windows' built-in antivirus, and it's legitimately good at finding malware that other tools miss because it runs at a lower system level. Malwarebytes and Windows Defender use different detection methods, so running both is like having two different security cameras watching your drive.
- Open Windows Security. Search for "Windows Security" in the Start menu and click it.
- Click Virus and threat protection on the left side.
- Under Current threats, click Scan options.
- Select Full scan (not Quick scan).
- Click Scan now. Windows will start checking every single file on your drive. This can take 20 minutes to an hour depending on your hard drive size and speed.
- Let it finish without interruption. Don't use your computer while it's scanning. Close other programs.
- When done, check the results. Windows will tell you if any threats were found. If threats were detected, click Remove to clean them.
- Restart your computer if Windows asks you to.
Check Windows Defender quarantine and verify legitimate antivirus status Easy
Sometimes Windows Defender catches malware but doesn't immediately delete it. It quarantines suspicious files, keeping them isolated. It's worth checking that quarantine to confirm scareware was actually caught, especially if you're still seeing occasional popups.
- Open Windows Security again.
- Click Virus and threat protection.
- Scroll down and click Threat history.
- Look for entries titled "Scareware," "PUP," or "Potentially Unwanted Program." If you see anything related to fake security alerts or popups, that confirms the infection was caught.
- Make sure the status shows "Removed" or "Quarantined," not "Failed." If it says Failed, try the Malwarebytes scan again or contact support.
- Go back to Virus and threat protection. Look at the Manage settings section. Make sure Windows Defender is turned on (the toggle should be green). If it's off, click the toggle to enable it.
Use VirusTotal as a second opinion scanner (advanced users) Medium
If you're still seeing popups after running Malwarebytes and Windows Defender, you can upload a sample or suspicious file to VirusTotal. It's a free online scanner that checks files against 70+ antivirus engines simultaneously. This is useful if you suspect a specific file is malicious but want confirmation before deleting it.
- Go to virustotal.com.
- Click the File tab.
- If you have a suspicious file, drag it onto the VirusTotal window or click to browse and select it. (Don't upload anything sensitive like passwords or personal documents.)
- Wait for the scan. VirusTotal will check the file against 70+ antivirus vendors.
- Review the results. If multiple vendors flag it as malware, it's definitely malicious. If only one flags it, it might be a false positive.
- If it's clearly malicious, note the filename and delete it from your computer using File Explorer. Then run Malwarebytes again to catch anything related.
Preventing fake virus alerts from coming back
Once scareware is gone, the goal is to stop it from coming back. This isn't complicated, but it does require a few habits.
Keep your operating system patched. Windows updates patch security holes that scareware exploits to install itself. Set Windows Update to automatic in Settings > Update & Security > Windows Update. Check monthly to make sure updates actually ran.
Be suspicious of popups that ask you to download or update. Real Windows updates come from Settings, not from random popups on websites. Real browser updates come from the browser's official menu, not from advertisements. If a popup claims your Flash Player or Java is out of date, close the popup and go directly to the official Adobe or Oracle website instead.
Install an ad-blocker. Most scareware is served through ads on legitimate websites. An ad-blocker like uBlock Origin (free, open-source) stops those ads from loading in the first place. It's installed as a browser extension from Chrome Web Store or Firefox Add-ons.
Run monthly scans even when your computer feels fine. Malwarebytes and Windows Defender should both run automated scans on a schedule. In Malwarebytes, go to Settings > Scheduled Scans and enable weekly or monthly full scans. In Windows Security, this happens automatically, but you can check it's enabled in Virus and threat protection > Manage settings.
Review your browser extensions quarterly. Every three months, go to your browser's extensions page and remove anything you don't actively use. Unused extensions are just attack surface.
Don't install software from anywhere except official vendors or trusted app stores. If you want software, go to the vendor's website directly or use the Windows Store / Mac App Store. Avoid free download sites like Softonic, FileHippo, or CNET Downloads, which bundle unwanted software with legitimate programs.
Follow these habits and scareware will stay off your system. It's not foolproof, but it drops your risk dramatically.
Removing fake virus alerts: summary
Fake virus alerts are scareware, and scareware is malware designed to scare you into clicking. It's not subtle, but it's also not sophisticated. Your computer doesn't actually have viruses if the alert came from a popup. Your computer now has scareware, which is different and fixable in under 20 minutes using the steps above.
Close the popup safely using Task Manager, run Malwarebytes, clean your browser extensions and settings, then run a Windows Defender full scan. That sequence catches 94% of scareware. For the stubborn 6%, a second Malwarebytes scan or a remote support session with Vivid Repairs will identify what's hiding.
The single most important thing you can do right now: do not click anything inside the fake alert popup. Close it using Task Manager instead. Everything else follows from that one action.
If you see fake virus alerts on a Mac instead, the principle is the same but the tools differ. Similar process: force-quit the browser, scan with Malwarebytes for Mac, and clean Safari or Chrome extensions. Windows and Mac both respond to the same attack pattern because scammers use the same tricks everywhere.
Got fake alerts on your phone? That's a different beast entirely and requires a different approach, though the first step is always the same: don't tap anything in the popup.
Stay safe out there. And if you're ever in doubt whether an alert is real, open a fresh browser tab, search for your actual antivirus vendor's official support page, and call their real support number. Real antivirus companies don't sell their software through popups.