You know the drill. Client calls, voice shaking, because their computer just flashed a red alert: "CRITICAL VIRUS DETECTED — CALL MICROSOFT NOW!" They're panicking. You're rolling your eyes. Because nine times out of ten, it's not a virus. It's a browser tab that won't close and a scammer on the other end of that 1-800 number.
I've seen this on Windows 7, Windows 10, and Macs. Last month, a client almost gave her credit card to a guy who sounded "very official" until she called me first. Good thing she did. The fix is usually simpler than you think, and it doesn't require a full system wipe.
Here's the blunt truth: those pop-ups are social engineering, not actual malware. But they can lead to real damage if someone falls for the scam. Let's break down the three most common causes and how to kill each one.
1. Malicious Browser Tab That Won't Close (The Most Common)
You're browsing, you click a random link, and suddenly a full-screen page claims your computer is locked. It repeats a fake phone number and warns you not to turn off the machine. The tab might even block your cursor. This isn't a virus — it's a webpage using JavaScript tricks to trap you.
The fix: close the tab, don't call the number. But if the tab won't close normally, force it.
On Windows: press Ctrl + Shift + Esc to open Task Manager. Find your browser (Chrome, Edge, Firefox) under "Processes". Right-click it and hit "End task". That kills the whole browser. When you reopen it, use "Restore session" carefully — if the bad tab reloads, close it immediately. Better yet, reopen just your main page.
On a Mac: hit Cmd + Option + Esc, select the browser, and click "Force Quit". Same effect.
If the pop-up stays even after restarting the browser, you might have a hijacker extension. Go to your browser's extensions list and remove anything you didn't install. I once found a "PDF Converter" extension that was nothing but a scam launcher.
Also, clear your browser cache and data. That often removes the stored scripts that keep reloading the alert.
2. Browser Notification Scam (The Sneaky One)
This one's getting popular. You visit a sketchy site, it asks "Allow notifications?" and you click "Allow" without thinking. Now you get fake virus warnings as desktop notifications even when the browser is closed. They look like system alerts, with a fake Windows or Apple logo.
The fix: revoke notification permissions.
In Chrome: go to Settings > Privacy and Security > Site Settings > Notifications. Look for the offending site in the "Allow" list. Click the three dots next to it and hit "Remove". Or set notifications to "Don't allow sites to send notifications" entirely. Your clients won't miss them.
In Firefox: go to Settings > Privacy & Security > Permissions > Notifications > Settings. Find the site and click "Remove Site".
In Edge: Settings > Cookies and site permissions > Notifications. Same idea.
If the notifications still appear, check for a suspicious app installed. Some scam sites push a small program that generates alerts. Go to Control Panel (Windows) or Applications (Mac) and uninstall anything you don't recognize. I had a client whose "Weather App" was actually a scareware launcher.
3. Fake Antivirus Installed (Less Common, but Messy)
Sometimes the scam goes deeper. Your client actually downloaded and ran a "free antivirus" that's actually a fake. It shows red alerts, scans, and finds "viruses" everywhere — all fake. It may even wallpaper their desktop with a warning.
This one's more work, but doable.
First, disconnect from the internet. Unplug Ethernet or turn off Wi-Fi. This stops the fake AV from phoning home.
Second, boot into Safe Mode. On Windows 10/11, hold Shift while clicking "Restart", then go to Troubleshoot > Advanced options > Startup Settings > Restart. Choose Safe Mode with Networking (but we'll skip networking for now). In Safe Mode, the fake AV often can't run.
Third, uninstall it. Go to Control Panel > Programs and Features. Look for anything with a weird name like "PC Protector" or "Ultimate Virus Shield". Uninstall it. If it fights back, use a real removal tool like Malwarebytes — run it from a USB stick if needed.
Fourth, reset your browser settings. Chrome and Edge have a "Reset settings" option in Settings > Advanced > Reset. This kills any hijacked homepage and search engine.
Finally, run a real malware scan. Windows Defender is actually decent. Malwarebytes is my go-to for this stuff. Just don't install ten different "security tools" — that makes things worse.
A client once had a fake AV that kept reappearing after uninstall. Turned out it had a scheduled task that reinstalled it. Check Task Scheduler and delete tasks tied to the fake AV name. Took me 30 minutes, but it was permanent.
Quick-Reference Summary
| Cause | Signs | Immediate Fix |
|---|---|---|
| Malicious tab | Full-screen pop-up in browser, cursor trapped, fake phone number | Kill browser via Task Manager / Force Quit, clear cache, remove suspicious extensions |
| Notification scam | Desktop notifications with fake system warnings, appear after browser closed | Revoke site notification permissions in browser settings, uninstall suspicious apps |
| Fake antivirus | Random scans, constant red alerts, desktop wallpaper changed, weird program in Control Panel | Disconnect internet, boot Safe Mode, uninstall fake AV, reset browser, run Malwarebytes |
That's the whole playbook. If your client's machine is clean after these steps, you're done. If not, you might be dealing with actual ransomware or a rootkit — then you pull the drive and run a deep scan on a known-good machine. But 90% of the time, it's just a pop-up scam. Don't pay the scammers, don't call the number, and don't let the client buy a "protection plan" over the phone.
Now go save someone from their own panic.