Remove Fake Microsoft Defender Virus Pop-Up Scam

Quick answer for advanced users

Close the browser completely, clear browser cache and site data, reset browser notifications, then run a quick scan with Malwarebytes or Windows Defender. No need to pay for any “support” number.

Why this happens

You’re not infected with a virus. That fake Microsoft Defender pop-up is a browser-based scam—a malicious ad or script that uses your browser’s notification API to display a full-screen alert that mimics Windows Defender. It’s designed to scare you into calling a fake tech support number or downloading a real malware payload. I’ve seen this on dozens of client machines—usually after someone accidentally clicked “Allow” on a website’s notification prompt or visited a streaming site that served aggressive ads. The scam works because the alert looks legit, with the official Windows shield icon and “Windows Defender — Virus Found” text. But it’s 100% fake.

The real fix is simple: don’t interact with the pop-up. Don’t click any button, don’t call the number, and don’t download anything. Close the browser entirely. Here’s how to clean it up.

Step-by-step fix

1. Close the browser completely. Press Ctrl+Shift+Esc to open Task Manager. Under “Processes,” find your browser (Chrome, Edge, Firefox). Right-click it and select “End task.” This kills the scam script immediately.
2. Clear browser cache and site data. Open the browser again (it should start clean). Go to Settings > Privacy and security > Clear browsing data. Select “All time” and check “Cookies and other site data” and “Cached images and files.” Hit Clear data. This removes the stored scripts that trigger the pop-up.
3. Reset browser notifications. In Chrome, go to Settings > Privacy and security > Site Settings > Notifications. Click “Reset permissions” or manually remove any suspicious sites (often with names like “security-alert.xyz”). In Edge, go to Settings > Cookies and site permissions > Notifications. Remove any sites you don’t trust. This stops future fake alerts from appearing.
4. Run a malware scan. Open Windows Security (search for it in Start) and run a “Quick scan.” Or download Malwarebytes Free and run a scan. I prefer Malwarebytes because it catches browser hijackers and adware that Defender sometimes misses. Had a client last month whose browser kept reopening the pop-up because of a hidden extension—Malwarebytes found it in 2 minutes.
5. Check browser extensions. In Chrome, go to Settings > Extensions. Remove anything you don’t remember installing. Scammers love hiding extensions that inject these pop-ups. In Edge, go to Settings > Extensions. Same deal.

Alternative fixes if the main steps fail

If the pop-up keeps coming back after clearing cache and resetting notifications, try these:

• Reset browser settings to default. In Chrome, go to Settings > Advanced > Reset and clean up > Restore settings to their original defaults. This nukes all customizations but kills any stubborn malware. In Edge, go to Settings > Reset settings > Restore settings to their default values.
• Use an ad blocker. Install uBlock Origin from the official Chrome Web Store or Edge Add-ons. It blocks the ad networks that serve these fake pop-ups. I’ve seen client machines where the pop-up only appeared on specific sites—uBlock stopped it cold.
• Run an offline Defender scan. In Windows Security, go to “Virus & threat protection” > “Scan options” > “Microsoft Defender Offline scan.” This boots into a pre-Windows environment and scans the system drive. It catches rootkits and persistent malware that might be injecting the pop-up from outside the browser.
• Delete browser profile completely. If nothing works, close the browser, go to %localappdata%\Google\Chrome\User Data, and delete the “Default” folder. This starts Chrome fresh with no stored data. Make sure to back up bookmarks first (export them from Settings > Bookmarks > Bookmark manager).

Prevention tip

Don’t click “Allow” on notification prompts from unfamiliar sites. Ever. That’s how most of these scams start. If a site needs to send notifications, it’ll ask you politely—not with a fake virus alert. Also, keep your browser and ad blocker updated. I tell clients to use uBlock Origin and disable JavaScript on sketchy sites (there’s a button for it in the extension). That alone blocks 99% of scam pop-ups before they load.

Real talk: last year I had a small business client whose entire office was hit by this scam. One person clicked “Allow” on a fake news site, and that pop-up spread to every workstation because they all used the same browser sync account. Reset the browser sync, cleared data, and it was gone. But it cost them a day of lost work. Prevention is easier than cleanup.