This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
How do I remove a persistent fake-virus alert popup?
I've got a Surface Go 4 running Windows 11 in my family where today the user clicked "allow" on a popup message she got asking about cookies or something while browsing in Edge. Since then, the PC gets a popup in the lower right corner. She got maybe 15 different versions of the popup. It stays on-screen for 10 to 30 seconds, then goes away without clicking on anything. The next will pop up in 5 seconds to 5 or more minutes. Headings include "(McAfee logo) Virus Alert", "(Windows logo) Sytem Damaged!", "(microsoft logo) "Microsoft Windows Defender TROJAN found in /Win32!", "(shield image) Virus & threats protection - Threats found (16)."
All have some spelling or syntax errors but otherwise look convincing.
All have the same link snippet: "crot50ohubcc738pnb00.loopdeviceconne..."
We haven't clicked anywhere on or near the popup when it's on screen.
Steps I've tried:
Windows defender checked status: has been running ok, last updated last night (9/2224) around 10:20pm.
Powered off, shut off network, powered on, Windows defender quick scan: came up clean. No pop-ups while network was off.
Windows defender offline scan: behaved normally (warned of reboot, reboot, scan) came up clean. Pop-ups resumed when network was turned on.
Taskmgr doesn't show anything I recognize as bad in startup apps list or in running processes, but I'm not current enough to know what processes might be bad.
Example alert pic shown below:
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Answer accepted by question author
Hi, these are push notifications.
To remove specific Edge push notifications:
Enter edge://settings/content/notifications into the URL bar.
For any entries you don't recognize in the Allow section, click the ellipsis (3 dots) to the right of each entry and either Block or Remove it.
You should see an entry for "crot50ohubcc738pnb00.loopdeviceconne...".
You can also toggle Ask before sending to off if you wish to block all notifications.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 69%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERK%3C/text%3E%3C/svg%3E)
Deleting last 24 hours of history, cookies, etc also works.
Windows Defender is supposed to be all about that.....why doesn't it detect and remediate already.
RikkeeC,
Because those particular notification popups from specific websites imply that you previously clicked to 'Allow' them on an earlier popup, whether you meant to or not.
That means these popups aren't malware at all, they're valid notifications from any websites you allowed, exactly as the initial post in this thread mentioned someone had done.
Moral of the story? Think before you click. That's the primary difference between much more technically knowledgeable users like _AW_ or me, who've been dealing with these abusive attackers and organizations for years and the average consumer who often doesn't or thinks that every popup should be clicked away as quickly as possible.
Rob
Deleting last 24 hours of history, cookies, etc also works.
Windows Defender is supposed to be all about that.....why doesn't it detect and remediate already.
_AW_ Thanks! I found exactly that in exactly that place.
Turned off internet; started pc; opened Edge, found url in "Allowed" list; removed it from the list, restarted internet and pc, and it appears to be all fixed!
It sounds like this would have worked on the fly without any of the restart or offline stuff; I just like doing those steps to better isolate what I'm changing.
I was having the same issue with the pop-ups! thank you sooooo much for helping the other person with that! you just saved my day! I've been so frustrated all day, I followed your steps, and it worked! thank you so much
