Over the year, staff at clients of ours rang about virus warnings and security pop-ups on their screens. We logged nine of these tickets from eight clients, with 2.6 hours of work between them.
In the three cases where our notes record what we found, none of the warnings came from a virus on the computer. A website was sending them.
What the staff saw
The descriptions were similar. Notifications kept popping up in the corner of the screen. Some said the computer was infected. Others offered antivirus software renewals. One staff member said they were showing constantly.
It’s a reasonable thing to be worried about, and ringing us was the right move. From a staff member’s point of view, a message saying “your computer is infected” looks just like a real warning.
Where they came from
Web browsers let websites ask permission to send you notifications. It’s meant for things like news alerts or chat messages. Scam sites use it too. A pop-up on the site says something like “click Allow to continue”, and a lot of people click it without thinking.
Once allowed, that site can send notifications to your desktop whenever it likes, even when the site isn’t open. Those notifications can say anything, including that you have a virus.
That’s what we found in the three documented cases: notifications from a website coming through the browser and appearing in Windows’ notification area.
How we fixed them
The fix was the same each time, and it didn’t involve removing a virus:
- Connect to the computer and look at the notifications to find which website sent them.
- Turn off notifications from that site in Windows’ notification settings.
- Open the browser and block that site’s notifications and other permissions.
- Run a virus scan as a follow-up, to be sure nothing else was going on.
Microsoft’s guide to managing website notifications in Edge shows where the setting lives: Settings, then Privacy, search, and services, then Site permissions, then All sites. From there you can find the website and set notifications to Block.
Why staff should still ring
Not every warning is fake. Some of the nine tickets were about different pop-ups, including a Windows security warning, and a genuine alert from your security software needs acting on.
So the message for staff isn’t “ignore virus warnings”. It’s “don’t click anything in the warning, and tell us”. A real alert from your business’s security software doesn’t try to sell you a renewal or give you a phone number to ring.
Signs a warning is probably a website
- it appears as a notification in the corner of the screen, often naming a website
- it offers to sell or renew antivirus software
- it gives a phone number or a link to “fix” the problem
- it keeps coming back even when your browser is closed
Forward this to your staff with the number to ring if they see one.
If you’d like help setting that up for your team, get in touch.