That "Virus Found — Call Now" Pop-Up Isn't Apple, Microsoft, or Us
A customer sent us a stack of pop-ups that had taken over their screen: a
black box reading “Confirm Action?” with a green checkmark and a red X,
sitting on top of a second box from a site called sanetarcullingn.co.in
warning “Unauthorized download detected. Is it you?” — with Yes/No buttons.
Then another identical stack behind it. And another behind that.
This is one of the more common calls we get, in two closely related flavors.
Flavor 1: the endless notification stack
What we saw here is a malicious browser notification — not a virus, a setting. At some point, that site (or an ad on some other site) showed a “click to continue” prompt that was actually a browser permission request in disguise. One click and the site is allowed to push desktop notifications whenever it wants, even with the browser closed. Each notification is designed to look alarming and demand a click, and clicking either button usually opens more of the same or leads somewhere worse.
The fix: it’s a permissions problem, not an infection. In Chrome, Edge or Safari, going into Site Settings → Notifications and removing the unfamiliar site stops it for good. If you’re not comfortable digging through browser settings, bring it in — it’s usually a five-minute fix.
Flavor 2: the full-screen fake virus warning
The scarier cousin of this is a page that fills the whole screen with a company’s real logo (Apple, Microsoft, Norton — whichever fits your device), huge red text reading something like “Your computer has (13) infections,” and a phone number to “call Tech Support immediately.” Sometimes it locks the browser in full-screen so the address bar disappears, making it feel like a real system alert instead of a webpage.
It is a webpage. Apple and Microsoft do not scan your computer through your browser and they will never ask you to call a phone number to fix it. That number connects to the same kind of scam as the fake renewal emails — someone whose goal is remote access to your computer or your card details.
The fix: don’t call. Force-quit the browser (see the FAQ below for exact keys on Windows and Mac) rather than clicking anything on the page, and don’t let the browser reopen your previous tabs when it restarts.
How to tell it’s fake in the moment
- It came from your browser, not your operating system. A real security alert from Windows or macOS doesn’t appear as a webpage with a URL bar (or a fake one drawn to look like part of the page).
- It wants a phone call. Real antivirus software removes things automatically or shows a report — it doesn’t ask you to call anyone.
- It won’t let you leave calmly. Full-screen lock, endless pop-up stacks, a countdown timer — all designed to rush you into the phone call before you think about it.
If you’re dealing with this right now, or you already called a number and want a second opinion on whether anything was actually installed, bring the device to our Marlboro shop — we’ll check it properly. More on what a real clean-up involves is on our virus and malware removal page.
Frequently asked questions
My screen is stuck showing these pop-ups right now. What do I do?
Don't click Yes or No on the pop-up itself — both buttons can trigger the same bad outcome. Close the browser entirely (on Windows, Ctrl+Shift+Esc to open Task Manager and end the browser process; on Mac, Option+Command+Esc to Force Quit). When you reopen the browser, don't restore the previous session/tabs, since that can bring the pop-up right back.
Is my computer actually infected if I see one of these?
Usually not — most of these are just a webpage or a rogue browser notification, not malware on the system itself. But if you clicked "Yes," downloaded anything, or called a number and let someone connect to your computer, that changes things. If any of that happened, have it checked before you use it for anything sensitive again.
How did I start getting these if I didn't download anything?
Almost always because a site asked "Allow notifications?" at some point — often disguised as a "click to continue" or age-verification prompt — and got clicked by accident. Once allowed, that site can push notification pop-ups to your desktop even when the browser is closed.