Remove Fake Microsoft Defender Virus Pop-Up Scam

EP
Erropedia Team
📅 May 28, 2026 📅 Updated Sep 11, 2026 👁 30 views Cybersecurity & Malware Beginner
Fake Microsoft Defender pop-ups are a browser scam, not a real virus. Here's how to kill them and clean up fast.

Quick answer for advanced users

Close the browser completely, clear browser cache and site data, reset browser notifications, then run a quick scan with Malwarebytes or Windows Defender. No need to pay for any “support” number.

Why this happens

You’re not infected with a virus. That fake Microsoft Defender pop-up is a browser-based scam—a malicious ad or script that uses your browser’s notification API to display a full-screen alert that mimics Windows Defender. It’s designed to scare you into calling a fake tech support number or downloading a real malware payload. I’ve seen this on dozens of client machines—usually after someone accidentally clicked “Allow” on a website’s notification prompt or visited a streaming site that served aggressive ads. The scam works because the alert looks legit, with the official Windows shield icon and “Windows Defender — Virus Found” text. But it’s 100% fake.

The real fix is simple: don’t interact with the pop-up. Don’t click any button, don’t call the number, and don’t download anything. Close the browser entirely. Here’s how to clean it up.

Step-by-step fix

  1. Close the browser completely. Press Ctrl+Shift+Esc to open Task Manager. Under “Processes,” find your browser (Chrome, Edge, Firefox). Right-click it and select “End task.” This kills the scam script immediately.
  2. Clear browser cache and site data. Open the browser again (it should start clean). Go to Settings > Privacy and security > Clear browsing data. Select “All time” and check “Cookies and other site data” and “Cached images and files.” Hit Clear data. This removes the stored scripts that trigger the pop-up.
  3. Reset browser notifications. In Chrome, go to Settings > Privacy and security > Site Settings > Notifications. Click “Reset permissions” or manually remove any suspicious sites (often with names like “security-alert.xyz”). In Edge, go to Settings > Cookies and site permissions > Notifications. Remove any sites you don’t trust. This stops future fake alerts from appearing.
  4. Run a malware scan. Open Windows Security (search for it in Start) and run a “Quick scan.” Or download Malwarebytes Free and run a scan. I prefer Malwarebytes because it catches browser hijackers and adware that Defender sometimes misses. Had a client last month whose browser kept reopening the pop-up because of a hidden extension—Malwarebytes found it in 2 minutes.
  5. Check browser extensions. In Chrome, go to Settings > Extensions. Remove anything you don’t remember installing. Scammers love hiding extensions that inject these pop-ups. In Edge, go to Settings > Extensions. Same deal.

Alternative fixes if the main steps fail

If the pop-up keeps coming back after clearing cache and resetting notifications, try these:

  • Reset browser settings to default. In Chrome, go to Settings > Advanced > Reset and clean up > Restore settings to their original defaults. This nukes all customizations but kills any stubborn malware. In Edge, go to Settings > Reset settings > Restore settings to their default values.
  • Use an ad blocker. Install uBlock Origin from the official Chrome Web Store or Edge Add-ons. It blocks the ad networks that serve these fake pop-ups. I’ve seen client machines where the pop-up only appeared on specific sites—uBlock stopped it cold.
  • Run an offline Defender scan. In Windows Security, go to “Virus & threat protection” > “Scan options” > “Microsoft Defender Offline scan.” This boots into a pre-Windows environment and scans the system drive. It catches rootkits and persistent malware that might be injecting the pop-up from outside the browser.
  • Delete browser profile completely. If nothing works, close the browser, go to %localappdata%\Google\Chrome\User Data, and delete the “Default” folder. This starts Chrome fresh with no stored data. Make sure to back up bookmarks first (export them from Settings > Bookmarks > Bookmark manager).

Prevention tip

Don’t click “Allow” on notification prompts from unfamiliar sites. Ever. That’s how most of these scams start. If a site needs to send notifications, it’ll ask you politely—not with a fake virus alert. Also, keep your browser and ad blocker updated. I tell clients to use uBlock Origin and disable JavaScript on sketchy sites (there’s a button for it in the extension). That alone blocks 99% of scam pop-ups before they load.

Real talk: last year I had a small business client whose entire office was hit by this scam. One person clicked “Allow” on a fake news site, and that pop-up spread to every workstation because they all used the same browser sync account. Reset the browser sync, cleared data, and it was gone. But it cost them a day of lost work. Prevention is easier than cleanup.

Related Errors in Cybersecurity & Malware
0X80092027 Fix CRYPT_E_NO_VERIFY_USAGE_DLL (0x80092027) Error Suspicious IP showing up in logs? Here's what to do 0X0000361F ERROR_IPSEC_IKE_SRVACQFAIL (0x361F): IPSec Auth Fails to Get Credentials 0XC0000199 Fix 0xC0000199: Computer Account Trust Failure
fake Microsoft Defender pop-up remove virus pop-up scam browser notification scam fix stop fake system alert clear browser cache pop-up fake antivirus pop-up removal Windows 10 fake defender Windows 11 fake warning remove browser malware pop-up disable notification spam reset browser settings pop-up fake virus alert removal Malwarebytes fix pop-up how to stop fake Microsoft alert

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.