How to stop adware pop-ups when no browser is open

Unexpected advertisements can appear on a Windows PC or Mac even when Chrome, Edge, Safari or Firefox seems closed. This usually points to adware, a potentially unwanted application, a compromised browser notification permission, or a background process that launches independently of the browser.

Some pop-ups imitate security warnings, virus alerts or system messages. Avoid clicking their buttons, calling displayed phone numbers or installing recommended “cleaners”. The safest response is to disconnect briefly from the internet, record what appeared, and investigate the software responsible.

Why pop-ups appear outside the browser

Adware can install a background service, startup entry or scheduled task that continues running after the browser window has been closed. It may open small advertising windows, create fake system notifications or redirect traffic through an unwanted advertising network.

Browser push notifications are another common cause. A website may have tricked you into selecting “Allow”, after which Windows or macOS displays messages from the browser’s notification system. The browser may be minimised, running in the background or configured to keep background apps active.

Pop-ups that claim your files are encrypted or that your computer has a critical error deserve special caution. Some are designed to imitate operating-system failures; this explanation of fake blue-screen scams can help distinguish a fraudulent warning from a genuine system fault.

Signs that adware may be installed

A single advertisement does not always mean malware. Repeated pop-ups, altered search results, unfamiliar browser extensions, homepage changes and a sudden increase in CPU or network usage are stronger indicators. You may also see new applications, toolbars or security products that you do not remember installing.

Pay attention to timing. If adverts begin after installing a free PDF converter, video player, game mod or unofficial utility, that program may have included bundled software. In Australia, freeware downloaded from third-party “download” portals can be packaged differently from the publisher’s official release, particularly when users click prominent advertising buttons.

Other warning signs include sluggish performance, unexplained battery drain on a MacBook, unusual browser notifications and repeated requests to grant administrator access. A legitimate security alert will generally identify the product clearly; vague messages such as “Windows infected” or “Apple protection expired” are often social-engineering attempts.

Safe steps to take first

Do not interact with the advertisement. Close the window using the operating system’s normal controls, or force-quit the relevant process if it will not close. If the message covers the screen, disconnect Wi-Fi or unplug the Ethernet cable before investigating. This prevents additional downloads and limits communication with an adware server.

Take a screenshot if it is safe to do so, noting the date, exact wording and any domain shown. Then check whether the warning came from a browser notification, a normal application window or a full-screen process. A real browser notification often includes the browser name or a small site icon.

What you notice	More likely source	Useful first action
Ads in the lower-right corner	Browser push notifications	Remove suspicious notification permissions
Pop-ups after every restart	Startup item or scheduled task	Review startup apps and recently installed software
Fake virus scan window	Adware or scareware	Close it without downloading its “fix”
Ads alongside a free utility	Bundled PUA	Uninstall the utility and scan the device
Pop-ups with high CPU use	Background process	Check Task Manager or Activity Monitor

If the computer is used for banking, tax, business or government services, avoid signing in until the device has been checked. Australian users can report scam activity to Scamwatch, while serious cyber incidents affecting an organisation may need to be handled through the Australian Cyber Security Centre.

Cleaning a Windows computer

Start with Settings and review installed apps by installation date. Remove programs you do not recognise, especially recent browser helpers, search tools, coupon extensions and “PC optimisation” utilities. Check Task Manager’s Startup apps list and disable suspicious entries, but do not delete random system files.

Next, inspect notification permissions in each installed browser and remove unfamiliar websites. Reset the browser only after saving essential bookmarks and passwords securely. Run a full scan with reputable, updated security software, and consider a second-opinion scanner from a trusted vendor.

If advertisements return after restarting, Windows may contain a scheduled task or service that reinstalls the unwanted component. Examine Task Scheduler and Services carefully, looking for recently created entries with random names or paths inside temporary user folders. When the cause is unclear, booting into Safe Mode can make removal easier because many adware processes do not load there.

Cleaning a Mac safely

On macOS, inspect Applications, Login Items and browser extensions for unfamiliar software. Check System Settings for Profiles or Device Management entries that you did not create, since an unwanted profile can control browser settings. Review Safari website notifications and remove permissions for suspicious domains.

Do not assume that a Mac cannot be affected by adware. Fake update prompts, malicious browser extensions and bundled installers are common routes of infection. If normal removal fails, use Apple’s recovery tools and follow a careful macOS Recovery guide rather than deleting system components at random.

A persistent pop-up campaign may also be a sign of a more serious compromise. Ransomware such as Locky is different from ordinary adware, but understanding how Locky ransomware spreads helps explain why suspicious attachments and downloaded executables should be treated cautiously.

Preventing repeat infections

Regular updates close weaknesses that adware and exploit kits can use. Keep the operating system, browsers, extensions and security software current, and download applications from official publishers or reputable Australian marketplaces. Avoid cracked software and “free” versions of commercial tools offered through file-sharing sites.

Public Wi-Fi in busy areas of Sydney, Melbourne, Brisbane or Perth is useful, but it is a poor place to install software or approve unexpected security prompts. Use mobile data or a trusted network for sensitive downloads. On home connections using the NBN, secure the router with a strong administrator password and current firmware.

Use these practical habits to reduce recurring pop-ups:

• Review browser notification permissions every few months.
• Remove unused extensions, apps and startup entries.
• Scan downloaded installers before opening them.
• Keep offline or cloud backups of important files.
• Use separate standard and administrator accounts where practical.
• Treat urgent pop-ups as untrusted until verified independently.

The Australian Privacy Act 1988 also makes careful data handling important for organisations, particularly when adware may expose customer information or saved credentials. Consumers should change passwords from a clean device if they may have entered details into a fraudulent warning, and businesses should follow their internal incident-response procedures rather than treating repeated pop-ups as a minor nuisance.