Your Computer Is Infected
Your computer is almost certainly not infected. The scary popups are scareware — fake virus warnings built to trigger fear and push you to call a number. The real fix took 30 minutes: remove a hijacked browser notification permission. Never call the number on the popup; that's the actual scam.
By George Featherstone·AI-assisted draft, reviewed and edited by George Featherstone.
The popups were never the real danger. The phone number written across them was. One calm, step-by-step cleanup — and a refusal to call the number — was the whole ballgame.
🚨 The symptom
This scareware case started, like most of these stories do, with a text message that made my stomach drop a little: “Hey, can you help? Someone I work with is freaking out, her screen is covered in virus warnings and she doesn’t know what to do.”
The message was from my wife. The “someone” was a coworker of hers — a genuinely non-technical, very sweet, very scared woman staring at a computer screen that was actively trying to convince her the world was ending.
I run ScamBomb, a tool built specifically to protect people from scams like the one unfolding on her screen in real time. So naturally, I said “put me on FaceTime with her.”
Fake Microsoft Defender
One popup claimed to be from Microsoft Defender. The rest were all flavors of “McAfee has detected a critical infection.”
Relentless reappearing
The popups kept reappearing almost as fast as she could close them — like popping bubble wrap that somehow refills itself.
No taskbar notification
No flashing shield icon from the real Windows Security. That small detail told me almost everything I needed to know.
🔬 The diagnosis
Troubleshooting over FaceTime means flying half-blind. I couldn’t grab the mouse or right-click anything myself. I had to be her eyes, her hands, and her calm, steady voice, all at once, through a slightly shaky phone camera.
But I noticed something important almost immediately: there was no flashing icon in her taskbar. Real system alerts come from a real place on your screen, consistently, in the same visual style every time. This was something else. This had the fingerprint of a scam.
Scareware is fake security warnings designed to trigger fear, force rushed decisions, and push users into paid subscriptions, redirects, or secondary malicious installs. Scareware does not scan your computer. It does not detect real infections. It monetizes panic.
The actual fix wasn’t the popups at all — it was a hijacked browser notification permission. Somewhere, weeks or months earlier, one accidental “Allow” click had quietly given a site permission to send these popups anytime it wanted, even with the browser closed. We found it. We removed it. That, more than anything else, was the fix.
🧹 Working through it
Step by step, out loud, over FaceTime, while she narrated back what she was seeing.
Alt + F4closed the loud one, but a second was still lurking in a tab.- She closed that specific tab — until the browser itself needed a hard reset through Task Manager.
Ctrl + Shift + Esc, find the browser, end the task. On reopen, decline “restore previous tabs” so the ghost didn’t come back.- Then the part that mattered most: digging into browser notification settings and removing the site that had quietly earned “Allow.”
From there we ran Windows Security’s built-in quick scan, which came back clean — but I wasn’t fully satisfied. Junk toolbars, adware, and browser hijackers live in the “potentially unwanted program” gray zone that Defender sometimes waves through. So I had her download Malwarebytes’ free version and run a full scan.
Not sixty popups — sixty actual detected issues sitting on her machine. That number told the real story: something had actually taken up residence. We quarantined everything, rebooted, and ran it again. This time: clean.
⚠️ The part people skip
The popup itself was never the real danger. The real danger is the phone number written across it, urging you to call for “immediate support.” That number doesn’t connect you to Microsoft or McAfee. It connects you to a scammer, trained to sound calm and official, who will walk you through installing remote access software like AnyDesk or TeamViewer — software that, once installed, hands a stranger the keys to your entire computer.
The woman never called the number — and refusing to call was the whole ballgame. Everything else — the popups, the fake alerts, the scary red screens — is just noise designed to rattle you into making that one call. No call, no scam. That’s it.
- Don’t click anything inside the popup. Not the X, not “Remove Virus,” nothing. Close the window with
Alt + F4instead, or right-click the browser in the taskbar. - Check your open tabs. If one looks like the scary warning page, close just that tab.
- Force-quit the browser if it won’t close normally.
Ctrl + Shift + Esc→ find the browser → End Task. - Reopen the browser and decline “restore tabs.” Start fresh.
- Remove the fake notification permission. This is almost always the real cause. Browser site settings → Notifications → remove anything unfamiliar.
- Run the built-in Windows Security scan. Search “Windows Security” in the Start menu, then Virus & Threat Protection → Quick Scan.
- Run a free Malwarebytes scan too. It catches the adware and junk-program category that Defender sometimes misses. Quarantine anything it finds, reboot, and scan once more.
- Never call the number on the popup. That’s the actual scam. Everything else is just the setup.
Final takeaway
If you ever find yourself mid-crisis with a screen full of scary red warnings — take a breath. It’s almost never as bad as it looks, and it’s almost always fixable.
That’s kind of the whole point of what we’re building over here at ScamBomb: less panic, more plan.
Sources
- Federal Trade Commission — ReportFraud.ftc.gov (report tech-support scams and find guidance).
- Microsoft Support — Manage website notifications in Microsoft Edge (remove the fake notification permission).
Check suspicious messages before you click
Paste suspicious texts, emails, or screenshots into ScamBomb and get plain-English risk analysis in seconds.