Too many pop-ups, or a fake virus warning? Scam page or real infection

A full-screen warning with an alarm sound, a Microsoft or Apple logo, and a phone number to call. Pop-ups in the corner about viruses, prizes, or a package you did not order. A browser that will not close. These feel like an infection, and some of them are, but most are something simpler and more cynical: a web page built to scare you into calling. Knowing which is which decides what you do next.

The scam page

It arrives after a mistyped address, a link in an email, or an ad on a free streaming or download site. It looks like this:

• It fills the screen, often hides the close button, and may play a voice or an alarm.
• It uses a real company’s logo and a made-up error code.
• It tells you to call a number, or not to turn the computer off, or that your bank details are being stolen right now.
• The giveaway: it is inside your web browser. Real security software does not ask you to call anyone, ever.

What not to do

• Do not call the number. The person who answers will ask to connect to your computer, and that is the actual attack. The page did nothing; the person on the phone does.
• Do not click anything on the page, including its own “close”, “scan now” or “remove” buttons.
• Do not type a password or card number anywhere it asks.
• If you already called, or let someone connect, stop reading this and go to our scammer guide for the first-hour steps. Then come back.

How to close it

• Windows: press Ctrl, Shift and Esc together to open Task Manager, select your browser in the list, and click End task. Or press Alt and F4 with the browser in front.
• Mac: press Command, Option and Esc, choose the browser, and Force Quit.
• If neither works, hold the power button until the computer turns off, then start it again. Nothing on a web page can survive that.
• When you reopen the browser, if it offers to restore your tabs, say no. Restoring brings the page straight back.
• If the page is back the moment you open the browser anyway, something has changed your homepage or added an extension. That is the next section.

The pop-ups that keep coming: browser notifications

The most common source of ongoing “virus detected” and “your antivirus has expired” messages in the corner of the screen is not a virus at all. At some point a website asked “Allow notifications?” and you, or someone, clicked Allow. That site now sends you fake warnings whenever it likes, and they look like they come from Windows. The fix is to take the permission away: in Chrome or Edge, open Settings, search for “notifications”, and remove every site listed under Allowed that you do not recognize. Most people are surprised how many are there.

When it really is an infection

Some signs mean something is on the computer, not just in a web page:

• Pop-ups appear when no browser is open.
• The browser’s home page, search engine or new tab changed and changes back when you fix it.
• Toolbars, extensions or programs you never installed, especially “cleaners”, “optimizers” or a second antivirus.
• Your real antivirus is turned off and will not stay on.
• The computer is suddenly much slower, the fan runs constantly, or the mouse moves on its own.
• Friends get emails or messages from you that you did not send.

The clean-up

For the flat $60 we find out what actually happened: a scam page and a pile of notification permissions, a hijacked browser, a real infection, or someone who was given remote access and left a way back in. We remove what is there, reset the browser properly, confirm your real antivirus is working and that there is only one, check for remote-access tools, and show you in plain words what it was. If someone had control of the machine, you hear exactly what to change, starting with passwords, from another device. No scare tactics, and no selling you a “protection suite” on the way out. Our virus and malware removal page covers the rest. If the computer is still usable, a remote session, $120 flat ($90 for members), can often do the clean-up while you watch.

When to bring it in

When the warnings come back after you close the browser, when any of the real-infection signs are there, or when you are just not sure and would rather someone looked. Walk in Monday through Thursday, 9:00 to 5:30, or Friday by appointment, at 746 S Arnold St Suite 3, the black door with our logo on it, straight ahead when you pull in, up the steps. Or book a drop-off online. Every price we charge is on our prices page.