Avira pop-ups: which alerts are real, which are fake, and how to stop them

Avira users see two very different kinds of pop-ups. Some come from Avira itself: alerts when it blocks a threat, and — in the free version — slide-up windows advertising Avira's paid products. Others only borrow Avira's name: browser pages and notifications that claim your PC is infected or your Avira subscription has expired, and push you to click, call or pay. The first kind can be annoying. The second kind is a scam.

Real Avira pop-ups

• Threat alerts from the Avira app when real-time protection blocks a file or a website. They come from the Avira program installed on your computer, not from a page in your browser.
• Upgrade offers in the free version. Avira calls them in-product messages: slide-up windows about current Avira offers and products. Avira's support page says they appear only in the free version, can't be disabled there, and disappear after upgrading.
• In Avira's paid versions, notifications can be set to a limited mode that, according to Avira, still shows alerts when threats are detected but blocks pop-up offers.

Fake "Avira" pop-ups

• They appear inside your web browser — as a page, or as a notification from a website you once allowed to send them — and can show up even if Avira isn't installed.
• They claim your PC is infected with a specific number of viruses, that a scan just found threats, or that your subscription has expired and you're unprotected.
• They push urgency: countdowns, alarms, a phone number to call, or a button to "renew now" or "scan now".
• Some take over the browser window so it's hard to close. Avira's own malware analysts have described these "support scams", most often reached through ads and redirects on dubious streaming sites.
• The FTC warns that scammers impersonate well-known companies with pop-ups and ads for "free" scans, scaring people into paying to fix computer problems that may not exist.

How to tell the difference

• Where is it? A real alert comes from the Avira app. A warning inside a browser tab, or a notification from a website, isn't your antivirus talking.
• Does it want you to call? The FTC's advice is to never click a link or call a number in a pop-up warning — honest tech companies won't contact you unexpectedly and ask you to.
• Did you run a scan? A web page can't scan your computer. A page that "found 5 viruses" is a script showing a number, not a scan result.
• Not sure your subscription is still active? Open the Avira app, or sign in by typing avira.com yourself — never through the pop-up.

How to stop each kind

• Avira's upgrade offers: in the free version they can't be switched off. Avira says they stop on the paid versions, where limited notification mode is available — that's the trade-off of a free tier, so weigh it against the paid price or a different product.
• A fake warning page: close the tab. If it won't close, quit the browser (Task Manager on Windows, Force Quit on a Mac) and don't restore the previous session when you reopen it.
• Fake notifications: remove notification permission from sites you don't recognize. In Chrome it's Settings → Privacy and security → Site settings → Notifications; other browsers have the same setting.
• Then run a full scan with security software you installed yourself, and keep your browser and system up to date.

If you clicked, called or paid

1. If you let someone connect to your computer, disconnect it from the internet, remove any software they asked you to install and run a full scan.
2. Change passwords you used on that computer — from a different device — starting with email and banking.
3. Check your bank and card accounts, and report anything you didn't authorize to your bank or card issuer.
4. Report the scam to the FTC at ReportFraud.ftc.gov.

Your antivirus talks to you from its own app. A web page that knows you're infected — and wants you to call — is selling something.