Fake Virus Warning Pop-Up? How to Close It Safely

Windows security and backups, in plain English · Updated October 3, 2026

A page suddenly says your computer is infected. It may play an alarm, display a phone number, or insist that you must not close the window. The pressure is part of the trick.

Do not let the message choose your next action. Start by leaving its instructions alone.

Why the alert can look so convincing

A website can imitate an operating-system window. A familiar logo, loud sound, or moving “scan” counter does not make it a real antivirus result.

Microsoft says its error and warning messages do not include phone numbers. An alert pushing you to call a supposed support hotline is a serious warning sign. Read Microsoft’s support scam guidance for the official explanation.

Close it using controls you trust

1. Do not click buttons inside the suspicious page, including a large “Close” graphic that might be part of it.
2. Use the browser tab’s own close button. If full-screen mode hides the controls, try Esc.
3. If the browser will not respond, use Ctrl + Shift + Esc on Windows to open Task Manager and end that browser task. This can lose unsaved work in its other tabs.
4. Reopen the browser without restoring the suspicious page or session.

If it returns through a saved tab, remove that tab from the restored session. Do not keep interacting with the alert to see whether it is real.

Why the warning may appear even when the browser is closed

Some websites ask permission to send notifications. If you allowed one, its alerts can appear on your desktop or phone even after you leave the site. These are website messages, not proof that your computer has a virus. Open your browser’s notification or site-permission settings and block the unfamiliar website. Do not click the notification to investigate it.

If the messages keep appearing

Check whether they are website notifications. A site you once allowed to send notifications can keep producing messages that look like security warnings.

Open the browser’s settings and look for site permissions or notifications. Remove or block permission for the suspicious site. The exact menu depends on your browser. Do not disable all Windows notifications to hide the symptom.

Also review recently added extensions. If you cannot identify one, check its origin before deciding what to remove.

Check the computer independently

Open Windows Security from Start and review its status. You can run a scan there, using our Windows scan guide.

Simply seeing a fake page is different from installing a program, typing a password, or letting a stranger control the computer. Write down which of those actually happened so you can take the right next step.

If you already followed the instructions

• Shared a password: Use another trusted device to change it through the real service. Change it anywhere you reused it and review account security.
• Shared card or bank details or paid: Contact the financial institution promptly using a known number or its official app.
• Installed software or allowed remote control: Disconnect the affected computer from the network and get trusted help. Removing one visible app may not resolve everything that changed.
• It is a work computer: Contact its IT team and follow its incident process.

Keep receipts, phone numbers, and messages for reporting. Do not reconnect with the caller to ask them to undo the problem.

A useful rule for next time

When an alert demands an urgent purchase or phone call, step away from its route. Open the actual app or contact the company through a known address.

That same habit works for suspicious email. You do not have to prove the message is fake before choosing a safer way to check.