# How to remove fake virus popups that keep coming back > Still getting fake virus warnings after a scan? It's usually a site allowed to send notifications. Exact steps for Chrome, Edge, Firefox, Safari, Android and iPhone. Canonical: https://www.phishclean.com/blog/how-to-remove-fake-virus-popup Last updated: 2026-11-05 March 6, 2026 By [PhishClean Research Team](https://www.phishclean.com/about) - browser security guidance based on phishing analysis, defensive research, and product work. You closed the warning. You ran a virus scan and it found nothing. The "your PC is infected" popup came back anyway. That pattern has one usual cause, and it isn't a virus: some website has your permission to send notifications. Here is how to find it and turn it off, browser by browser. **Short answer:** a fake virus popup that survives a scan is almost always a **browser notification**. Antivirus software scans files and programs; a notification permission is a browser setting, so the scan never touches it. Remove the site from your browser's notification list (steps below) and the popups stop. ## First, work out which kind you have "Fake virus popup" covers three different things, and each one is removed differently. Look at where the warning appears: ### It slides in from the corner of the screen That is a notification, sent through Windows, macOS or Android by your browser. Look at the small print on it: it names the browser (Google Chrome, Microsoft Edge, Firefox) and a website address, often something meaningless like `news-xyz123.cc`. That address is the site to remove. These keep arriving even when no scam page is open, and sometimes when the browser itself is closed. [Go to the notification steps](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup#turn-off-notifications). ### It fills a browser tab, with a phone number That is a scam web page, usually reached through a bad ad or a redirect. It may go fullscreen, play a voice, show a fake Windows Defender or Apple screen and refuse to close. It can't scan anything: the "5 viruses found" text is the same on every visitor's screen. [Close it this way](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup#close-the-page), and don't call the number. ### New tabs open on their own, or your search engine changed That points to a browser extension that is redirecting you. [Check your extensions](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup#extensions). On an iPhone or iPad the usual culprit is different again: [calendar spam](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup#iphone). ## Close a scam page that won't let go Don't click anything inside the page, including its "Close", "Cancel" or "X" buttons, which are part of the page and can start a download. - **Fullscreen:** press **Esc**. If Chrome or Edge shows "Press and hold Esc to exit full screen", hold it for two seconds. - **Close the tab:** **Ctrl+W** on Windows, **Cmd+W** on a Mac. - **Close the browser:** **Alt+F4** on Windows, **Cmd+Q** on a Mac. - **If the browser won't close:** open Task Manager with **Ctrl+Shift+Esc**, select the browser and choose *End task*. On a Mac, press **Cmd+Option+Esc** and force-quit it. When you reopen the browser and it offers to restore your tabs, say no, or the page comes straight back. Then clear the last hour of browsing history and cached files (**Ctrl+Shift+Delete**) so the address doesn't autocomplete when you type. No real company puts a support number in a browser warning. Microsoft's, Apple's and your antivirus vendor's real alerts appear in the operating system, not in a web page, and never ask you to call. The number on the page connects to a call centre that will try to get remote access to your computer and then charge you to "fix" it. ## Turn off the notifications, browser by browser This is the step that stops a popup coming back. You are looking for a list of sites that are *allowed* to send notifications. Remove every site you don't recognise. If you're not sure, remove them all: a site you actually want will ask again. ### Google Chrome (Windows, Mac, Chromebook) Type `chrome://settings/content/notifications` into the address bar and press Enter. (The long way: Settings → Privacy and security → Site settings → Notifications.) Under *Allowed to send notifications*, click the three dots next to each unwanted site and choose *Remove*. ### Microsoft Edge Type `edge://settings/content/notifications` into the address bar. Under *Allow*, click the three dots next to each unwanted site and choose *Remove*. ### Firefox Type `about:preferences#privacy` into the address bar, scroll to *Permissions* and click *Settings…* next to *Notifications*. Select the site, click *Remove Website*, then *Save Changes*. ### Safari on a Mac Open Safari, then Safari → Settings (Preferences on older macOS) → *Websites* → *Notifications*. Select each unwanted site and click *Remove*, or set it to *Deny*. ### Chrome on Android Open Chrome, tap the three dots → Settings → Site settings → Notifications, tap the site and turn its notifications off. Quicker: press and hold the notification itself when it next appears and use the settings it offers to switch that site off. On Windows, the three-dot menu on a notification also offers to turn off all notifications from that browser. It works as a stopgap, but it silences sites you want too, and the permission is still there; remove the site as well. ## On an iPhone or iPad: check for calendar spam Safari on an iPhone doesn't let ordinary websites send notifications, so "your iPhone is infected" alerts there usually arrive another way: as calendar events. Tapping "OK" on a scam page at some point subscribed you to a calendar that fills your days with fake warnings and links. Go to Settings → Calendar → Accounts (on iOS 18: Settings → Apps → Calendar → Calendar Accounts) → *Subscribed Calendars*. Tap the one you don't recognise and choose *Delete Account*. The events disappear with it. ## Check for an extension that is redirecting you If new tabs open by themselves, or your homepage or search engine changed without you doing it, look at your extensions: `chrome://extensions` in Chrome, `edge://extensions` in Edge, `about:addons` in Firefox. Remove anything you don't remember installing, especially recent additions with generic names ("PDF Converter", "Video Downloader", "Safe Search"). Extensions bundled with free downloads are the usual way in. If the redirects survive that, reset the browser. In Chrome and Edge it is under Settings → *Reset settings*; in Firefox, Help → More troubleshooting information → *Refresh Firefox*. Bookmarks and saved passwords are kept; extensions and site permissions are cleared. ## Why the virus scan didn't find anything Because there was nothing on the computer to find. A notification permission is one line in your browser's settings saying "this site may show messages". Nothing is installed, so Windows Security, Malwarebytes or any other scanner reports the machine as clean, correctly. The scan is only the right tool if you downloaded and ran something the scam page offered; in that case run a full scan as well. ## Stop the next one before it starts **Switch notification prompts off by default.** Almost nobody needs a random website's notifications, and turning off the prompt removes the whole trick. - **Chrome:** on the same `chrome://settings/content/notifications` page, choose *Don't allow sites to send notifications*. - **Edge:** on `edge://settings/content/notifications`, turn off *Ask before sending*. - **Firefox:** in the notification settings window, tick *Block new requests asking to allow notifications*. **Treat "click Allow to continue" as a red flag.** Pages that say "Click Allow to prove you're not a robot" or "to watch the video" are asking for notification permission, not checking anything. [Here is how that trick works](https://www.phishclean.com/blog/why-sites-ask-you-to-click-allow-notifications). **Block malicious ads.** Most people reach a fake virus page through an ad on an ordinary site. A content blocker such as [uBlock Origin](https://www.phishclean.com/compare/phishclean-vs-ublock-origin) (uBlock Origin Lite on Chrome) removes most of that route. **What PhishClean does here, honestly.** PhishClean is built mainly for login and payment pages, and it does not block notification prompts; the browser setting above does that best. Version 1.5.0 (October 2026) added two checks that help with this kind of scam: a warning when a page poses as a virus alert and tells you to call a support number, and a block on sites from a list of about 380,000 reported phishing hosts. Both run on your device; the pages you visit are not sent to us. ## Already called the number or let someone in? If you only saw the page and closed it, nothing happened. If you went further, work through what applies, starting now: - **You let them connect to your computer.** Disconnect from the internet (unplug the cable or turn off Wi-Fi). Uninstall the remote-access program they had you install; AnyDesk, TeamViewer, UltraViewer and ScreenConnect are the usual ones. Then run a full scan with your antivirus. - **You paid by card or bank transfer.** Call your bank using the number on your card, say it was a tech support scam, and ask them to stop or reverse the payment. - **You paid with gift cards.** Contact the company that issued the cards straight away, with the card numbers and receipts. Funds can sometimes be frozen if they haven't been spent yet. - **You typed passwords while they were connected.** Change them from a different device, starting with email and banking, and turn on two-step verification. - **Report it.** In the US at [reportfraud.ftc.gov](https://reportfraud.ftc.gov/), in the UK to [Action Fraud](https://www.actionfraud.police.uk/), in India at [cybercrime.gov.in](https://cybercrime.gov.in/) or the 1930 helpline. Expect a follow-up: scammers often call back weeks later offering a "refund" for the bogus repair, which is a second scam. For a fuller checklist, see [what to do after clicking a phishing link](https://www.phishclean.com/help/clicked-a-phishing-link). ## Related reading - [Tech support scam popups How the scam call centres work and what they ask for](https://www.phishclean.com/threats/tech-support-scam-popups) - [Why sites ask you to click Allow The notification trick behind most repeat popups](https://www.phishclean.com/blog/why-sites-ask-you-to-click-allow-notifications) - [A CAPTCHA told me to press Win+R The fake-verification trick that installs real malware](https://www.phishclean.com/blog/captcha-told-me-to-press-win-r-is-it-a-virus) - [What to do if you clicked a phishing link Immediate steps to limit the damage](https://www.phishclean.com/help/clicked-a-phishing-link) ## Frequently asked questions Why do I keep getting fake virus popups after a virus scan? Because the popups come from a website you once allowed to send notifications, not from anything installed on your computer. Antivirus scans look at files and programs, so they find nothing. Open your browser's notification settings (chrome://settings/content/notifications in Chrome, edge://settings/content/notifications in Edge) and remove the sites you don't recognise. Can a fake virus popup infect my computer? The page on its own can't. It becomes dangerous when you act on it: downloading the "cleaner" it offers, calling the number, or letting someone connect to your computer. Close it without clicking anything inside it. Is a Windows Defender warning in my browser real? No. Windows Security shows its alerts in the Windows notification area and its own app, never inside a browser tab, and it never asks you to call a phone number. A Defender-branded warning in a web page is a scam page. How do I tell which site is sending the popups? Read the small print on the notification itself: it names the browser and the website address that sent it. That is the site to remove from the browser's notification list. My iPhone says it has a virus. What do I do? On an iPhone these alerts are usually events from a spam calendar you were tricked into subscribing to. Go to Settings, Calendar, Accounts (on iOS 18, Settings, Apps, Calendar, Calendar Accounts), open Subscribed Calendars and delete the one you don't recognise. ## A second pair of eyes on scam pages PhishClean warns before you type a password or card number into a fake page. All checks run on your device, free for 7 days with no account. [Install PhishClean](https://www.phishclean.com/#install) Last updated: 5 November 2026 ## Share this guide If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean. Share on X Share on LinkedIn Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.