PC Website Pop-Ups Pretending to Be Virus Alerts: Notification Spam
If a warning keeps popping up in the corner of your screen saying your PC is infected, your PC is usually not infected at all. More often, a scam site was once allowed to send notifications, and it is now using that permission to send fake virus alerts again and again.
This is not a virus and it is not a result from Microsoft Defender. It is a browser permission, most often in Microsoft Edge, and you can take it away. Removing that one site from the allowed list stops its alerts without reinstalling Windows or paying for help.
Below, you will first check an alert for the name of the site sending it, so you remove the right one. Then you will remove that permission step by step in Edge, with the same steps for Chrome and Firefox if you use one of those browsers instead.
Part of the Is This Microsoft Message Real? Fake Warnings, Real Defender Alerts and What To Do series, the pillar guide for this cluster.
Why a website can keep sending you fake virus alerts
When you visit a website, your browser can ask whether that site may send you notifications. They are meant for useful updates, such as news headlines or email alerts from sites you trust. If you click Allow, the browser saves that choice for that site.
The permission stays in place after you close the tab. It also stays after you restart the computer, so the site can send another alert later even though its page is not open. The site doesn't need to put a virus on your computer to keep sending them.
Scam sites work hard to get that one click, often while you are trying to reach something else. A fake captcha may tell you to click Allow to prove you are not a robot. A video may stop and say Allow is needed to play it, or a file download may claim you must click Allow to continue.
Once that permission is saved, the wording still comes from the website. The site writes the warning about a virus, a payment, or an expiring account, the browser delivers it, and Windows shows it in the corner of your screen. It is not a scan result from Windows or Microsoft Defender, even if it uses their names or logos.
Check the alert first: is this notification spam?
Wait for the next alert to appear, or open a recent one from the notification center at the right end of the taskbar. Do not click the alert itself. Look at the small text at the top or bottom, which names the browser, such as Microsoft Edge, and the website that sent it.
Write that website name or address down exactly as it appears, letter for letter, including any extra words or numbers in front of it. You will search for that exact address in the next steps, so a close guess may not find it.
Notification spam usually matches all three signs. The alerts appear in the corner of the screen, the same virus wording comes back again and again, and the sender named on the alert is a website address, not Windows Security.
Stop here if the warning fills the whole screen, plays a loud voice, or shows a phone number to call. That is a different problem, so use the Real or Fake Warning Checker. If Windows Security shows this warning in Protection History, see the Defender threat pages instead.
Stop the alerts in Microsoft Edge, step by step
Start in Edge itself, and use the exact website address you wrote down from the alert. Do not click the main part of an alert to dismiss it. That click can open the scam site in a new tab, and the site may then ask you to click, call, or download something else.
- Open Microsoft Edge and select the three dots in the top right corner, then select Settings.
- On the Settings page, select Privacy, search, and services in the left-hand menu.
- Select Cookies and site permissions.
- Scroll down and select Notifications.
- Under Allow, find the website address from the alert. The site may sit below other sites you know, so work through the list slowly instead of changing the first unfamiliar name you see.
Check the line carefully before you change it. The name must match the address on the alert, letter for letter. Other sites on the list may be ones you use and trust, such as a news or email site. Leave those lines alone and change only the line for the scam site.
Next to the scam site, select the three dots, then select Block. Block is the better choice here. It takes away the permission and stops the site from asking to send notifications again. Remove does less. It only takes away the current permission, so the site could ask again if you visit it later.
Close Edge completely, then open it again. Use the browser as normal for a short while and watch the corner of the screen. The alerts from the blocked site should stop. If an alert shows a different website name, that is a separate permission, and that name needs to be blocked in the same list.
If you need help with Edge for another reason, see our general Edge help. For this problem, stay with the Notifications page and the Allow list. Changing other Edge settings will not stop alerts from a site that still has permission to send them.
Stop the same alerts in Chrome or Firefox
If the alert named Chrome or Firefox instead of Edge, use the same website address you wrote down in the check above. The fix is in that browser's settings, not in Edge, and it takes the same allowed site off the list. You do not need to open the scam site or click the alert itself to do this.
For Chrome: 1. Open Chrome and select the three dots in the top right, then Settings. 2. Select Privacy and security, then Site settings, then Notifications. 3. Under Allowed to send notifications, find the address, select its three dots, and select Block or Remove. You can also type Notifications in the search box at the top of Settings to find it faster. Leave other allowed sites as they are.
For Firefox: 1. Open Firefox and select the menu button in the top right, then Settings. 2. Select Privacy and Security, then scroll to Permissions. 3. Next to Notifications, select Settings. 4. Find the address, then select Remove Website, or open its menu and set it to Block. Select Save Changes before you close the window, or the change will not stick.
If you use more than one browser, check each one you use. A site allowed in Chrome is not blocked in Firefox or Edge by that change, because each browser saved its own permission. Start with the browser named on the alert. Close and reopen the browser after the change, and watch for that address to stop appearing.
Block new notification requests so it does not happen again
In Edge, open Settings, then Privacy, search, and services, then Cookies and site permissions, then Notifications. Turn off the switch labeled Ask before sending (recommended). With that switch off, Edge blocks new notification requests instead of showing you an Allow or Block prompt to click.
Chrome has the same idea under Settings, Privacy and security, Site settings, and Notifications: select Don't allow sites to send notifications. In Firefox, open Settings, Privacy and Security, and Permissions, then select Settings next to Notifications and check Block new requests asking to allow notifications.
This stops the prompts, but it stops them for every site. News, email, and sports sites you actually want updates from will not be able to ask either. If you prefer, leave the switch on and treat each new request as a reason to pause.
Use one rule next time a site pushes you to click Allow. A real video, download, or captcha check never needs notification permission to work. If a page stops until you click Allow, close the tab instead.
If the alerts continue or you clicked one
If alerts keep coming after you block the site, go back to the Allow list. Look for a second entry for the same address, or a look-alike address with a small spelling difference, and block that one too.
Next, check every browser installed on the computer, even one you rarely open. The same site may be allowed in Edge and in Chrome. When each browser is clean, close it fully and open it again.
This page no longer applies if alerts appear when no browser is open, or if you find a matching entry in Windows Security, under Protection History. In either case, stop and use the linked Defender threat pages instead.
If you clicked an alert and then installed a program, called a phone number, or let someone connect to your computer, do not follow extra steps here. Use the first hour checklist and the guide to calling Microsoft support for the safe next steps.
Frequently asked questions
Do I need to reinstall my browser to stop the alerts?
No. Blocking the site in notification settings removes its permission to send alerts. Reinstalling the browser is not part of this fix, and it is not needed when the alerts stop after the site is blocked.
Should I call the number shown on a fake virus alert?
No. The number comes from the same website that sent the alert, not from Microsoft. Close the alert without calling, then block the website in your browser settings.
Conclusion
Once that one site is blocked, the corner alerts from it should stop, and there is nothing left to clean up in Windows. You did not need a new antivirus program, a cleaner, or a paid support call to fix a permission you can remove yourself in the browser that saved it.
What matters from now on is the source, not the wording on the alert. Words can claim anything in seconds. The browser name and site address show you who was actually allowed to speak, and that is the part you can control.