# How to Spot and Remove a Fake Antivirus or Scareware

URL: https://www.mytechnician.tech/tips/remove-fake-antivirus-scareware-windows-11/
Published: 2026-05-25 | Updated: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Fix, Troubleshooting
Summary: Browser locked by a virus warning? Remove fake antivirus pop-ups and tech-support scareware on Windows 11 without calling the number on screen.
Recommended app: Ultimate PC Repair Tool — https://www.mytechnician.tech/apps/my-technician/ (Microsoft Store: https://apps.microsoft.com/detail/9PH863L9C6HC?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
A full-screen red banner says you have **847 viruses**, audio blares, and a phone number promises "Microsoft support." Your real files are usually fine—this is **scareware**: a web page or junk app designed to panic you into paying or installing worse software. It is not the same as a silent trojan, which is why it needs different steps than a standard [malware cleanup](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/).

> **Defender disabled and real unknown processes running?** Treat it as infection—[remove virus and malware](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/) and [Defender not working](https://www.mytechnician.tech/tips/fix-windows-defender-not-working/).

## How to Spot Fake AV (30-Second Test)
* Pop-up appears **inside the browser** with a toll-free number—Microsoft does not put support numbers in browser alerts.
* Claims **"Windows Defender Alert"** but bad grammar, neon colors, or countdown timers.
* Asks you to **call**, **download a "scanner,"** or pay with gift cards / crypto.
* **Real** Windows Security lives in **Settings** → **Privacy & security** → **Windows Security**—no sirens, no phone number.

## The Fix: Step-by-Step

### Step 1: Do Not Call the Number
Hang up if you already called—scammers request remote access, install real malware, or charge hundreds for nothing. Disconnect Wi-Fi if they are still on the line and you let them in.

### Step 2: Kill the Browser Trap
1. `Ctrl + Shift + Esc` → **Task Manager** → select the browser → **End task**.
2. Reopen the browser **without** restoring the last session (Chrome: often a "Restore pages?" prompt—click **Don't restore** or start with `Ctrl + N` in a new window).
3. If the tab returns instantly, a junk extension is loading it—see Step 5.

### Step 3: Clear the Hijack Page on Startup
Edge: **Settings** → **Start, home, and new tabs** → set **Home** and **New tab** to something neutral (e.g. `edge://newtab`).  
Chrome: **Settings** → **On startup** → **Open the New Tab page**—not "Continue where you left off" until clean.

### Step 4: Reset the Browser (Keeps Bookmarks in Most Flows)
**Microsoft Edge:** **Settings** → **Reset settings** → **Restore settings to their default values**.  
**Chrome:** **Settings** → **Reset settings** → **Restore settings to their original defaults**.

Then run **Extensions** → remove anything you did not install (names like "PC Protector," "Speed Booster," random letters).

### Step 5: Uninstall the Fake Program (If One Installed)
**Settings** → **Apps** → **Installed apps** → sort by **Install date** → uninstall:
* "Windows Defender" that is not from Microsoft (check publisher column).
* "Driver Updater," "PC Cleaner," "WebShield," etc.

### Step 6: Scan With the Real Defender
1. **Settings** → **Privacy & security** → **Windows Security** → **Virus & threat protection**.
2. **Scan options** → **Full scan**.
3. If you paid a scammer and they had remote access: also run **Microsoft Defender Offline scan**—steps in [malware removal guide](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/).

### Step 7: Check Notifications Permission
Scareware sites abuse browser notifications.
**Edge/Chrome:** **Settings** → **Privacy** → **Site settings** → **Notifications** → remove suspicious sites → set default to **Don't allow** or ask.

### Step 8: Startup and Scheduled Junk
`Ctrl + Shift + Esc` → **Startup apps** → disable unknown publishers.  
`Win + R` → `taskschd.msc` → delete tasks launching from `%Temp%` or `AppData` with random names.

## After Cleanup
* Change passwords if you typed them while the fake page was open—start with email and bank from a **clean** device.
* [Create a restore point](https://www.mytechnician.tech/tips/create-system-restore-point-windows-11/) before installing anything from ads again.
* Teach the household: **no number on a pop-up is real support.**

## Fake AV vs Real Malware
| Scareware | Silent malware |
|-----------|----------------|
| Loud browser page, phone number | Little or no warning |
| Often no files encrypted | May steal passwords, mine crypto |
| Fix: reset browser, uninstall junk app | Fix: offline scan, Safe Mode |

Still seeing pop-ups on every site after reset? Run the full [malware removal](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/) path—something is persisting beyond a browser trick.

If you called the number and let anyone connect, treat it as a full compromise and work through [what to do after a remote access scam](https://www.mytechnician.tech/tips/what-to-do-after-remote-access-scam-anydesk-teamviewer/). To stop the next one loading at all, [audit your browser extensions](https://www.mytechnician.tech/tips/remove-malicious-browser-extensions-windows-11/) and [turn on SmartScreen and unwanted-app blocking](https://www.mytechnician.tech/tips/enable-smart-app-control-reputation-protection-windows-11/).

---
Source: https://www.mytechnician.tech/tips/remove-fake-antivirus-scareware-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: Ultimate PC Repair Tool (Ultimate PC Repair Tool is a Windows diagnostic and repair toolkit with system analysis, automated troubleshooting, and hardware checks for Windows 10/11.) — https://www.mytechnician.tech/apps/my-technician/
More guides: https://www.mytechnician.tech/llms.txt