How to Remove Fake McAfee Pop-Ups and Browser Notifications

What to do in the first minute

Stop interacting with the warning. Don't press Scan now, Renew, Remove virus, Allow, or a phone number shown inside it. If the warning is drawn inside a browser page, even its X can be a link. Close the tab from the real browser tab strip, press Alt+F4 on Windows, or use Command+Q on a Mac. Microsoft gives the same keyboard-first advice when a frightening page tries to hold the browser open.

Take one photo with a phone before closing it if you can do so without clicking. Capture the alert's source line, the browser name, and the address bar—not a phone number for later use. That small record often answers the whole problem: via Microsoft Edge points to Edge website notifications, while an unfamiliar domain inside the toast identifies the site permission that needs to be removed.

After the warning is closed, open the genuine security app from the Start menu, Applications folder, or a known bookmark. Don't reopen it through the alert. A fake webpage can't perform a full local antivirus scan merely by animating a progress bar, and the current McAfee fake-antivirus guidance specifically advises checking the trusted app directly.

The fastest diagnosis: where does the warning live?

“Pop-up” is how people describe several technically different things. The distinction matters because each has a different off switch. A website notification is delivered by a browser permission and often sits in a screen corner. A web pop-up is a tab, window, overlay, or full-screen page. An app notification is sent by installed software. A warning that survives all three checks may come from an extension, another browser profile, startup software, or adware.

Wait for one alert if the source is uncertain. Hover without clicking where the operating system allows it, expand the notification details, or inspect Notification Center. The goal isn't to read the frightening claim; it's to find the sender. Community threads repeatedly become solvable when a reader notices “via Edge” or another browser name, but those reports are directional evidence, not proof that every case has the same cause.

What a website notification actually is

A website notification is a message a site can send after the browser grants permission. The site supplies the headline, image, destination, and timing, so a dishonest publisher can paste a familiar shield, the word McAfee, or a fake infection count into the notification. The browser or operating system draws the outer notification container; that system-looking frame doesn't validate the claim inside it.

Permission is often obtained through a fake CAPTCHA or video prompt that says “Click Allow to prove you are not a robot,” “Allow to continue,” or “Enable notifications to watch.” In a June 2026 r/computerviruses case, the user remembered clicking Allow on a purported human-verification prompt before McAfee, Norton, and Defender warnings began. That's one current example of the mechanism, not an infection-rate estimate.

The permission doesn't install McAfee, and removing McAfee doesn't revoke it. It also doesn't give a site permission to scan every local file. Its practical power is persuasion: repeated alerts can send the user to a download, affiliate offer, fake renewal, phishing page, or supposed technician. McAfee's broader pop-up troubleshooting guide also separates browser notifications from ordinary pop-up windows; the danger grows when the next instruction is followed.

Chrome's official notification guide says websites, apps, and extensions can send notifications and that Chrome may automatically block intrusive or misleading senders. Automatic filtering helps, but an older permission or a newly abusive site can still require manual removal.

Why the warning appears when the browser looks closed

A corner notification can arrive when no browser window is visible. That's expected behavior for permitted website notifications, not evidence that an antivirus scan happened in the background. Microsoft's Edge documentation explicitly says website notifications can appear even when Edge is closed. Apple's current Safari guide says website notifications can also arrive when Safari is closed.

Browsers maintain background components so calendar, mail, chat, and news sites can deliver legitimate alerts. A deceptive site uses that ordinary channel. Therefore, killing the current browser window or hiding all notifications in Windows can stop the immediate interruption without removing the site's permission. The messages may return when notification display is re-enabled.

The source label is more useful than the visible app state. If the alert says it came via Edge, inspect Edge even if Chrome is the browser you normally use. New PCs, search links, PDF readers, widgets, and other apps can open a secondary browser once; one accidental permission in that browser is enough.

Firefox differs slightly: Mozilla says website notifications display while Firefox is open, and its current guide calls Web Push opt-in. The practical rule remains the same—inspect the browser named by the alert, not the browser you assume was responsible.

Real McAfee alert, legitimate promotion or impersonation?

A genuine threat alert should correspond to the installed McAfee product and appear in its own event or notification history when the app is opened directly. It should identify a concrete file, site, or action and let the user manage it inside the product. Our McAfee review explains the current suite; this guide is about the delivery channel, not whether every McAfee recommendation is worth accepting.

A legitimate promotion can still be annoying. McAfee or a computer manufacturer may advertise a trial, renewal, or additional feature. Marketing language shouldn't be mistaken for a malware detection, but the right response is to change the sending app's notification or offer settings—not to trust a payment page simply because the product name is real. Verify subscription status by signing in through the official account route covered in our McAfee plans and renewal guide.

An impersonation borrows the brand without originating from McAfee. Common tells include an unfamiliar site name, “via Edge” or “via Chrome,” a countdown, a claim that a webpage instantly found several viruses, an unknown phone number, a forced download, or payment pressure. The most decisive clue is source, not polish. A sophisticated fake can have perfect spelling, and a genuine promotion can be clumsy.

McAfee WebAdvisor adds another layer: a verified browser extension can warn about a destination or download. Its warning isn't the same as a random website notification. Our audited WebAdvisor and Secure Search review shows how to verify the publisher, decide whether to keep it, and separate the extension from browser notification permissions.

A current exception: the July 2026 LG Monitor App Installer promotion

Not every unexpected McAfee offer in Windows is a browser scam. In July 2026, users reported that the LG Monitor App Installer, delivered after connecting some LG monitors, displayed a McAfee promotion. Windows Central reported that Windows chief Pavan Davuluri said Microsoft contacted LG and LG agreed to disable the McAfee pop-up in its app.

That dated incident matters because a rule such as “unexpected McAfee equals browser malware” would diagnose it incorrectly. If a promotion appears at startup after connecting an LG monitor, check Installed apps and Startup apps for the LG Monitor App Installer. Updating or removing the utility is a different task from revoking a website permission, and the promotion itself isn't proof of an infection.

Don't generalize beyond the facts that were reported. The coverage didn't establish every affected model, region, rollout date, or installation path. By July 24, LG had reportedly agreed to disable the promotion, but a staged update can take time and an older app version may remain installed.

The broader lesson is durable: identify the process or browser that owns the window. A recognizable security brand can be promoted by a legitimate third-party app, impersonated by a website, or displayed by the genuine product. The artwork alone can't distinguish them.

Warning signs that make an alert unsafe

Treat any unexpected security warning as unsafe when it asks you to call a displayed number. Microsoft's tech-support scam guidance describes full-screen messages, repeating dialogs, audio alarms, and phone numbers designed to make a web page feel like a locked computer. The FTC is even more direct: real security pop-up warnings don't ask the reader to call a phone number.

Remote access is another bright line. A stranger who initiated contact shouldn't need you to install a screen-control tool, read codes, turn off security, or reveal normal Windows logs as evidence of hacking. Microsoft notes that scammers can use remote access to misrepresent ordinary system messages and may install unwanted software while pretending to fix the device.

Payment method exposes the story. The FTC's current tech-support scam page warns about gift cards, wire or bank transfers, cryptocurrency, and payment apps. A “refund” process that requires access to online banking, moving money, or repaying an alleged over-refund isn't technical support.

Other strong signals include a fake CAPTCHA that asks you to paste a command, a demand to disable the antivirus, a browser page claiming it scanned local files, mismatched operating-system details, a support download hosted outside the vendor domain, and urgency that prevents you from checking the real account. No single typo is required; professionally designed pages can still be fraudulent.

Choose the recovery by what you already did

The alert's appearance tells you where to stop the messages. Your actions after seeing it tell you how far recovery should go. This prevents two bad extremes: telling a person who only saw a notification to wipe the PC, or telling someone who installed a remote-access tool and opened online banking that blocking one site is enough.

Write down the highest completed action honestly. “I clicked X” can mean dismissing an operating-system toast or clicking a fake close button inside a webpage. “I ran a scan” can mean an animation on a website or launching a downloaded executable. Those details change the branch.

Remove fake McAfee notifications from Chrome

Open Chrome yourself and go to Settings → Privacy and security → Site settings → Notifications. The current Google instructions use that route. Review the list allowed to send notifications and block or remove unfamiliar entries, especially the domain captured from the warning. Don't visit the suspicious site again just to change its permission.

Block is preferable when Chrome offers it because the site remains explicitly denied. Remove clears the prior decision but may let the site ask again. Menu labels vary slightly by Chrome version, managed profile, and operating system, so use the Settings search box for “notifications” if the path looks different.

Then open chrome://downloads and check whether the alert initiated a download. Delete an unrequested file without opening it. Open chrome://extensions and remove extensions you didn't deliberately install, but don't remove every extension blindly; note names first so a synchronized profile doesn't restore the mystery later.

Pop-ups and redirects are a separate setting under Site settings. If the problem was a tab or new window rather than a corner notification, confirm that pop-ups and redirects remain blocked and remove unfamiliar exceptions. Clearing all cookies isn't the first-line fix for a notification permission because the permission has its own control.

Remove fake McAfee notifications from Microsoft Edge

Open Edge and follow Settings and more → Settings → Privacy, search, and services → Site permissions → All sites. Select the suspicious site, find Notifications, and choose Block. That's the route in Microsoft's current website-notification documentation. You can also use the site-information control beside the address bar when safely visiting a trusted site's settings, but don't reopen a scam page for convenience.

Microsoft explicitly distinguishes website notifications from pop-ups. A website notification appears in the screen corner and Notification Center and may arrive while Edge is closed. A pop-up opens in the current window, a new window, or another tab. If both occurred, revoke Notifications and check Pop-ups and redirects; fixing one setting doesn't automatically fix the other.

Open edge://downloads to review files and edge://extensions to inspect extensions. If the alert used a full-screen lock, Edge also has a scareware blocker. Keep Edge and Microsoft Defender SmartScreen current rather than installing a cleanup tool offered by the same warning.

Windows may show the sender as Microsoft Edge in Notification Center even after the visible Edge window closes. Turning off Edge in Windows System → Notifications hides all Edge notifications, including useful ones, but leaves individual site permissions untouched. Use that global switch only as a temporary silence control while you remove the specific sender.

Remove fake McAfee notifications from Firefox

Open Firefox → Settings → Privacy & Security, scroll to Permissions, and select Settings beside Notifications. Mozilla's Firefox Web Push guide, updated June 15, 2026, says to select the site and choose Block if you want to revoke permission and prevent another request. Removing the website revokes the current permission but allows it to ask again.

Firefox describes Web Push as opt-in: a site needs permission before it can send these alerts. That doesn't mean the user intentionally wanted antivirus warnings. A deceptive prompt may have disguised the request as a CAPTCHA, download gate, or video control. Review every allowed site whose purpose you can't explain.

You can also stop new notification requests from interrupting you. This is useful for a family computer that doesn't need website push alerts, but it may disable legitimate calendar, mail, or chat prompts. A targeted block is less disruptive when only one sender is abusive.

Use about:addons to check extensions and Firefox's Downloads panel to inspect recent files. If the pop-up appears only on one site and no operating-system notification arrives, the problem may be page content or an advertisement rather than Web Push.

Remove fake McAfee notifications from Safari on Mac

On a Mac, open Safari → Settings → Websites → Notifications and deny or remove unfamiliar sites. Apple's current Safari User Guide also lets you deselect “Allow websites to ask for permission to send notifications” when website push isn't needed.

macOS has a second display layer: Apple menu → System Settings → Notifications. Under Application Notifications, a permitted website may appear as its own entry. Turning off Allow Notifications there stops its display, while denying the website inside Safari removes the underlying site permission. Use both controls deliberately rather than assuming they're duplicates.

For a warning trapped inside a page, press Command+Q to quit Safari rather than clicking page controls. Reopen Safari without restoring the suspicious tab. Review Downloads and Safari → Settings → Extensions for anything installed during the incident.

A fake antivirus page on a Mac may still use Windows language and McAfee branding. That mismatch is a warning sign, not a complete diagnosis. If a downloaded package was opened, a profile was installed, a command was pasted into Terminal, or Accessibility/Screen Recording permission was granted, use the stronger recovery steps below.

Close a browser tab, redirect loop or full-screen scare page

A full-screen scare page can hide the address bar, play an alarm, repeat dialogs, or imitate a Windows lock screen. Its goal is to make the browser feel like the operating system. Microsoft documents these exact techniques in its tech-support scam guidance. The message is still page content unless another program has been executed.

Try the real browser or operating-system controls: Ctrl+W for the current tab, Alt+F4 for the Windows browser window, or Command+Q on a Mac. If the browser won't close, use Task Manager or Force Quit. Restart it without restoring the suspicious session; if it offers to reopen tabs, decline.

After closing, confirm that the browser's default pop-up and redirect blocking is enabled. Check recent downloads and history to identify the entry point, but don't revisit the page. A legitimate website may have served a malicious advertisement, so the referring site isn't always the operator of the scam.

Don't grant notification permission as part of leaving. Some pages use a fake “Close” instruction that opens the browser's real permission prompt. The safe response to an unexpected notification request is Block; the page doesn't need push access to prove you're human.

Windows app notification versus browser notification

Open Windows Notification Center and expand the alert. The sender may be Microsoft Edge, Google Chrome, an unfamiliar app, McAfee, or an OEM utility. A browser name directs you to site permissions. An app name directs you to that app's own settings and Installed apps. A site name paired with a browser is still a website notification, not a Windows antivirus result.

Windows Settings → System → Notifications can mute a sending app. That's useful to stop a flood while you work, but it isn't always the root-cause fix. Muting Edge suppresses all Edge notifications and leaves the site's permission ready to send again later. Remove the site in Edge, then decide whether Edge notifications should remain enabled globally.

If the alert opens the genuine McAfee application, compare it with the app's Notifications or Protection history. Marketing can usually be reduced within product settings. If you deliberately want to remove the suite, follow our complete McAfee uninstall guide; uninstalling shouldn't be used as a substitute for diagnosing a browser sender.

Check Installed apps and Startup apps when a promotion appears at sign-in, after a hardware connection, or without a browser label. Sort by installation date and publisher. Don't delete an unknown executable from Program Files by hand; identify the app, use its uninstaller, restart, and verify.

Check suspicious extensions and adware without deleting everything

If the notifications continue after the named site's permission is blocked, inspect browser extensions. Look for an extension installed near the first incident, a publisher you can't verify, or access that doesn't match its purpose. Disable one suspect at a time, restart the browser, and test. Record the name before removal because browser sync or a companion application may restore it.

An extension can inject advertisements, change search results, redirect tabs, or request broad access. A normal website notification permission doesn't need an extension, so finding none isn't a failure. Conversely, removing an unrelated extension won't revoke the site permission that produced the original toast.

Review recently installed desktop applications, especially download helpers, PDF converters, coupon tools, video players, and “security” products obtained from the warning. McAfee's current adware guide notes that unwanted software can arrive through deceptive ads, fake updates, and malicious extensions.

Don't install five cleanup utilities from search results. Use the active security product, Windows Security, or a tool obtained from a known official vendor domain. Multiple real-time antivirus products can conflict, obscure the original symptom, and turn a simple permission cleanup into a performance problem.

If the fake McAfee warnings return after permission removal

Record the next sender instead of repeating the same cleanup. It may be a second allowed domain, another Chrome or Edge profile, a different browser, a synchronized extension, or an installed app. A July 2026 Opera GX community case was resolved by identifying the browser's notification permission; the discussion also correctly asked whether the user had downloaded a file or pasted a command. Treat that as a useful diagnostic pattern, not universal proof.

Check every browser profile used on the computer, including an old Edge profile opened by another app. Review its notification allow list, downloads, and extensions. If browser sync is active, pause extension sync during removal and inspect another signed-in device before turning it back on.

If the sender is an app, sort Installed apps by date and inspect Startup apps and scheduled vendor utilities. If a process or extension reinstalls itself without an identifiable legitimate manager, a deeper scan or qualified technician is appropriate. Persistent redirects, disabled security settings, unexplained command windows, new administrator accounts, or network activity raise the severity beyond notification spam.

Resetting the entire browser can be a final browser-only step after bookmarks and required account data are backed up. It isn't the first move because it destroys evidence, removes useful settings, and may be undone by sync. A controlled sequence—sender, permission, extension, app, scan—shows which layer caused the behavior.

Do you need an antivirus scan?

A site notification by itself doesn't mean malware was installed. If you only saw the alert, revoked its permission, and no file, extension, command, remote session, or credential entry occurred, a scan is optional reassurance rather than the mechanism that removes the notification. The permission must still be blocked in the browser.

Run one updated full scan when a file downloaded, an extension or app was installed, the warning returns from an unknown source, browser settings change themselves, or the device behaves unusually. Open the trusted security app directly. Microsoft also recommends a full Windows Security scan after a tech-support scam incident; use current updates before trusting the result.

If suspicious software actively resists removal or ordinary Windows scanning can't run, Microsoft Defender Offline or a qualified hands-on recovery path may be appropriate. A factory reset isn't a default response to a notification-only case. It becomes a considered option after code execution or remote access when system integrity can't be established.

Don't confuse “zero threats found” with “the notification was imaginary.” Antivirus scans inspect files and behavior; browser permissions are stored configuration. A clean scan and recurring browser notifications can both be true until the permission is removed.

If you clicked the alert but didn't download or enter anything

Close the destination page, inspect the browser's Downloads list, and note whether the click opened a new tab, a store listing, an affiliate checkout, or a file download. Clicking isn't identical to executing code. Modern browsers isolate ordinary page content, but a redirect can still lead to phishing, a download, or another permission request.

Remove the original site's notification permission and any new permission granted after the click. Delete an unrequested download without opening it. Review extensions only if the flow asked you to install one or the browser changed afterward. Run one current scan for reassurance, especially on a shared family computer where every click may not be remembered.

If the destination was a genuine McAfee checkout reached through a deceptive advertisement, don't assume the sales page makes the source ethical or safe. Close it and verify any purchase separately through the McAfee account. Our McAfee cancellation and refund guide explains the legitimate billing path without using a pop-up number.

Watch for follow-up email, text, or phone contact if personal details were supplied even without a password. Scammers reuse context to sound convincing. A caller who knows that you saw a McAfee warning isn't automatically McAfee.

If you downloaded a file but didn't run it

Don't open the file to see what it is. Use the browser's Downloads panel to reveal its folder, then delete it and empty the trash or recycle bin after recording the filename. If the browser blocked it, respect the block. Google's Chrome download-warning guidance says attackers may ask users to turn off or ignore protections to get around detection.

Run an updated scan and review whether the download created an extension prompt, installer window, or operating-system approval request. A file sitting unopened in Downloads is a lower-risk event than an installer that was approved, but “I did not run it” should include not opening a disk image, package, script, archive contents, or document that asked to enable macros.

Don't upload a private or work file to a random online scanner. If the filename contains personal information or came from a sensitive system, follow the organization's incident process. For a consumer device, the installed security product and operating-system protections are the first checks.

After cleanup, revisit the path that led to the download only through safe history records, not by opening the site. If a trusted site served the advertisement, report the ad or compromised page to that site through a known contact route.

If you ran a file, installed an extension or pasted a command

This is a code-execution branch, not merely a notification problem. Disconnect the device from Wi-Fi or Ethernet if unexpected processes, remote-control behavior, disabled security, or credential prompts appear. Don't power it off repeatedly if you need professional incident response; otherwise, disconnecting limits further communication while you inspect the device.

Write down the filename, extension, command, time, and any permission granted. Remove an unknown extension through the browser and uninstall an identified unwanted application through the operating system. Update the trusted security product and run a full scan. If Windows remains unstable or security tools are blocked, use Microsoft's official recovery options or get hands-on help from a technician you selected independently.

A fake CAPTCHA that asks you to press Windows+R, paste from the clipboard, open Terminal, or run PowerShell isn't verification. Pasted commands can download and execute code without a normal installer. Don't paste the command into a search engine or support chat where it might execute accidentally; preserve it as a photo if analysis is needed.

Change important passwords from a different trusted device if the executed software may have accessed the browser profile or password store. Prioritize the primary email account, password manager, financial accounts, and any reused credentials. Enable multi-factor authentication and review active sessions rather than only changing the password on the possibly affected device.

If you granted a stranger remote access

Disconnect the affected computer from the network and end the remote session. Don't negotiate with the caller or accept a second “security team.” From a different trusted device, change passwords for email, banking, the password manager, and accounts accessed during the session. Tell the bank that an unauthorized person had remote access if financial sites were open.

Record the remote-access tool, caller details, payment request, and time. Uninstall the tool, check whether it was configured for unattended access, review new users and startup entries, update the system, and run a full scan. Microsoft's guidance says a reset can be appropriate in some remote-access or persistent fake-error cases; that decision should follow the actual exposure, not panic.

If the computer belongs to an employer, school, or another organization, stop personal cleanup and contact its real IT or security team through a known channel. Remote access can expose organizational credentials and data, and deleting logs or software can interfere with their response.

Don't use a support number found in the same search session to find a rescuer. The FTC warns that scammers place their own sites and ads in search results. Navigate to a known vendor, bank, retailer, or local service independently.

If you entered a password, card number or sent money

Change the exposed password immediately from a trusted device and change it anywhere it was reused. Start with email because password resets for other accounts flow through it. Turn on multi-factor authentication, review recovery addresses and phone numbers, sign out unknown sessions, and inspect forwarding rules that could silently copy mail.

Contact the card issuer, bank, or payment provider through the number on the physical card, a known banking app, or its official website. Explain the payment method and that it followed a tech-support impersonation. Ask about stopping or reversing the transaction and replacing compromised card details. Don't send more money to unlock a refund.

The FTC describes fake McAfee and Norton renewal messages that claim a large charge and demand a call within 24 hours. Check the actual bank or card account. If the alleged transaction doesn't exist, the invoice is part of the lure; if it does exist, report the unauthorized charge to the provider rather than using the message's contact details.

Preserve screenshots, emails, transaction IDs, wallet addresses, and the remote tool name. Report the incident online to the relevant national fraud service. In the United States, the FTC directs consumers to ReportFraud.ftc.gov. This article intentionally doesn't publish helpline numbers because copied numbers go stale and are easily impersonated.

Use safe support and reporting routes

Type the vendor's domain yourself or use a bookmark created before the incident. For McAfee, start at its official site, sign in to the account, and open support from the site's navigation. Our safe McAfee installation guide applies the same origin rule to installers: vendor domain or a verified app store, never a warning's download button.

Don't trust a support page merely because it ranks, carries a familiar shield, or is hosted as a PDF on a university, nonprofit, survey, or file-upload domain. The live July 2026 result set for McAfee support-related queries contains uploaded documents with unofficial numbers. That's observable search pollution, not a reason to publish or test those numbers.

Report a malicious page through the browser's safety workflow after closing it. Edge offers Report unsafe site, Google provides a Safe Browsing report route, and the FTC accepts online scam reports. Don't revisit the page to collect perfect evidence if doing so exposes the user again.

For a family member, sit with them while securing accounts and payment methods. Avoid blame. These pages are built to create time pressure and imitate trusted brands. Our antivirus guide for seniors and scam-protection guide focus on reducing the next decision burden rather than promising that software can prevent every conversation.

How to prove the warning is gone

Restart the browser and computer once. Confirm that the suspicious domain no longer appears in the notification allow list, the default pop-up and redirect blocker is enabled, and no unexpected extension or app remains. Re-enable any global notification switch you used temporarily and wait through the time window in which alerts normally appeared.

Open Notification Center and verify the source of any remaining message. If it names a different site or browser, treat that as a new sender rather than declaring the first fix failed. Check each user profile on a shared computer; browser permissions are often profile-specific.

If a download or execution occurred, record the scan product, update time, scan type, and result. Confirm that security settings remain enabled after restart. A clean scan plus stopped notifications is stronger evidence than either alone, but only when the browser permission was actually removed.

Check the real McAfee account only if billing or subscription status was part of the lure. No surprise renewal in the account or bank statement means there's nothing to cancel. If a genuine subscription exists, cancellation, uninstall, and browser-notification removal remain three separate tasks.

Prevent another notification trap without breaking the browser

Default to Block when a website asks to send notifications unless alerts are central to a service you deliberately use. A page doesn't need notification permission to play a video, prove you're human, show a download, or close a warning. Teach that single rule to every person who shares the device.

Chrome can use quieter notification prompts, Firefox can block new notification requests, and Safari can stop websites from asking. These settings reduce interruptions but may affect legitimate web mail, calendars, or messaging. Review the allow list every few months rather than disabling the whole operating-system notification system.

Keep the browser, operating system, and one real-time antivirus current. Use the browser's built-in phishing and download protection. An additional browser-safety extension can help some users, but it should be verified and understood; our Windows 11 antivirus guide and WebAdvisor review explain the tradeoff.

Use bookmarks or typed addresses for security vendors, banks, and account recovery. Treat sponsored support results and uploaded PDFs as unverified. Share the consequence ladder with the household: seeing, clicking, downloading, running, remote access, credentials, and payment are different events, and honest detail leads to the right response.

Final recommendation: fix the sender, then match recovery to the consequence

Start with the smallest fact you can verify: where the warning appears and which browser, site, or app sent it. Revoke a website permission in that browser, close a scare page from outside the page, or change the notification setting in the identified app. Don't uninstall genuine security software merely because a website borrowed its name.

Then ask what happened after the warning appeared. If nothing was clicked, permission cleanup may be the whole fix. A download merits deletion and a scan; execution or a pasted command needs deeper device review; remote access, credentials, or payment requires account and financial response from a trusted device.

This is the standard we use throughout the site: separate vendor claims, current official instructions, independently reported events, and community symptoms. Our testing methodology explains that evidence model, and our disclosure explains commercial relationships. Fear is the scam's tool; a precise diagnosis is the way out.