The fake "virus" pop-up

What it is

It is a web page. Not a part of Windows, not a message from Microsoft, and not a finding from your computer's protection. A website — reached through a bad advertisement, a mistyped address, or a compromised page — has drawn a picture of a warning and put it in front of you, often full-screen so it feels like the whole computer. Some versions play a siren or a recorded voice. The page's one job is to make you call the phone number on it — and the person who answers is the actual problem.

Why it looks frightening

Because it borrows everything real warnings use: official-looking logos, red and flashing colours, an error code, a countdown, and a voice telling you not to turn off your computer. Fear is the product. Microsoft states the tell plainly: real Microsoft error and warning messages never include a phone number, and Microsoft does not make unsolicited calls offering to fix your computer. If there is a number to call, it is not them.

What a paid service would do

An honest paid service would close the page, check that nothing real was installed, run your protection's own scan, and remove the website permission that let the page shout at you. That work is real but small — minutes, not hours — and it is also listed, in the US, as a US$149.99 service when it is sold as "virus removal". The service is worth most when it also explains the trick. Ask, using question 1 on this page.

What Geek Doctor does

Geek Doctor examines what the page actually was, checks your protection and your browser's notification permissions, and removes the permission that let the site imitate a warning — then writes down, in the notebook, what it was and how to recognise the next one. Recognising it is the fix that lasts.

What you can do yourself

1. Do not call the number. Do not click anything in the warning.
2. Close the browser. If the mouse won't do it, hold Alt and press F4. If that fails, restart the computer — despite what the page says, restarting harms nothing.
3. When the browser offers to restore the page that was open, say no.
4. Open Windows Security and run a quick scan, for peace of mind.
5. Report it if you can: Microsoft collects these at microsoft.com/reportascam.

← All explanations