The Fake Virus Warning That Calls Itself Microsoft

Someone wrote to us about their mother:

"My mum kept getting those terrifying 'YOUR COMPUTER IS INFECTED' pop-ups and calling me in a panic every other week. I installed Adless on her Chrome and they just... stopped. She hasn't called me about a fake virus warning in three months."

We hear a version of this often enough that it is worth explaining what those pages actually are — because the truth is reassuring, and the reassurance is the useful part.

It is not a virus. It is a web page.

The screaming red warning is not coming from Windows, or from Microsoft, or from antivirus software. It is a web page — HTML and JavaScript, the same ingredients as any other site. It has no access to the computer, it has not scanned anything, and it does not know whether the machine is infected. It is a picture of a warning.

What makes it effective is theatre. The page often goes full-screen so the browser's own furniture disappears, plays an alarm sound, shows a fake progress bar "scanning" files, and displays a phone number in large type. Some versions trap the Back button by pushing hundreds of entries into browser history, so pressing Back appears to do nothing.

The goal is never to infect the machine. The goal is to make someone frightened enough to ring the number. On the other end is a person who will ask for remote access to the computer, then for a card.

Why the panic is the product

These pages are designed to remove the pause in which someone would normally think. The alarm, the countdown, the "do not shut down your computer" instruction — every element exists to stop a person from doing the one thing that ends the whole event: closing the tab.

That is also why age is a factor, though not for the reason people assume. It is not about capability. It is that a person who did not grow up with browsers has no instinct for the fact that a web page can pretend to be the operating system. If you have never seen a window lie about what it is, the lie works.

What actually stops them

Because these are web pages, they live at web addresses — and those addresses get reported. Adless downloads a list of known scam and malware sites to the computer and checks each address against it locally. When the address is on the list, the page is stopped before it loads. Nothing to see, nothing to panic about, no phone call.

This part is in the free version, which surprised the reader above and surprises most people. Site-level scam and malware blocking has always been free in Adless and is switched on from the moment it is installed.

Pro adds two things on top: matching against the full feed at the level of individual addresses rather than whole sites, and an on-device Scare-page Shield that recognises the shape of one of these pages — the support phone number, the fake error code, the full-screen overlay — even when the address is brand new and on no list yet. We should be straight about how that second one behaves: it reacts to the page after it has loaded and covers it with a calm, dismissible warning you can leave from. It does not block the page in advance, and we do not claim it does.

If one appears anyway

No blocker catches everything, and a domain registered this morning is on no list yet. So it is worth knowing the escape route, and worth telling someone else:

• Close the tab. That is the whole fix. The page has done nothing to the computer.
• If it is full-screen, press Esc first, then close the tab. On Windows, Ctrl+W closes a tab; Alt+F4 closes the window.
• If Back seems stuck, close the whole browser window rather than fighting it.
• Never ring the number, and never let anyone connect to the computer because a web page told you to. Microsoft does not put a phone number in a browser pop-up.

The single most useful thing you can do for someone who is vulnerable to these is not technical. It is to tell them, once, calmly, before it happens: if a web page ever tells you your computer is infected and gives you a number to call, it is lying, and closing the tab ends it. Then the next one is an annoyance instead of an emergency.