“Install Antivirus Now to Remove Threats” Is a Scam: Here’s What to Do

If you’ve ever been browsing or turning on your computer and suddenly encountered a full-screen message demanding you to “Install antivirus now to remove threats and protect your PC,” you might have already come face to face with one of the most persistent tech support scams online. It looks urgent. It sounds helpful. But it’s fake.

This article dives deep into the “Install Antivirus Now To Remove Threats And Protect Your PC” scam. We’ll break down how it works, who’s behind it, and how you can protect yourself. If you’ve already fallen victim to it, we’ll also guide you through recovery steps. Let’s begin.

Scam Overview

The “Install Antivirus Now To Remove Threats And Protect Your PC” scam is a deceptive tactic used by cybercriminals and rogue affiliates. It attempts to trick users into installing software by creating a false sense of urgency and danger. At a glance, the message appears to be from a legitimate antivirus product, and it claims that your PC is at risk.

But there is no real virus scan happening. Instead, the pop-up is generated by a potentially unwanted application (PUA), often installed without clear user consent. One such known application associated with this scam is ManualFinder, which is infamous for its aggressive pop-up tactics and redirect behavior.

The Red Flags

Once the PUA is on your system, you might see an alert like this:

• “Network and device security check in progress”
• Followed by: “Install antivirus now to remove threats and protect your PC”

This transition is intentional. It mimics the flow of a legitimate system check, which makes the scam more believable. The warning screen is designed to hijack attention and direct users to click the “Install Antivirus” button.

Clicking this button typically redirects users to the official websites of real antivirus software providers such as McAfee, Norton, or TotalAV. While these products themselves are legitimate, the people behind the scam are not. They abuse affiliate marketing programs to earn commission whenever someone installs the software through their unique referral link.

Affiliate Marketing Abuse

Affiliate marketing is a legitimate strategy that allows marketers to earn commissions by referring customers. However, when scammers exploit these programs by deceiving users, it becomes fraudulent.

Here’s how it plays out:

1. The PUA is installed (often bundled with freeware or disguised as a necessary browser extension).
2. Fake system scans and pop-ups are displayed to create panic.
3. The user clicks the call-to-action button thinking it’s urgent.
4. They are redirected to real antivirus websites but with an affiliate code attached.
5. The scammer earns a commission for a deceptive referral.

Even though the final product may be legitimate, the route taken to get there involves manipulation and unauthorized software behavior.

Hidden Dangers

While some versions of this scam redirect users to genuine antivirus tools, other variants can lead to much worse outcomes. These include:

• Fake antivirus downloads that install malware instead
• Additional PUAs that bog down your system and collect data
• Adware and browser hijackers that flood your screen with spammy content
• Keyloggers and info-stealers that can compromise sensitive data
• Trojans or ransomware that can lock you out of your own files

In essence, while this scam may appear benign at first glance, its underlying infrastructure can serve as a gateway to far more serious cybersecurity issues.

How the Operation Works

Understanding how this scam unfolds step-by-step can help you recognize and avoid it before any harm is done.

Step 1: The Entry Point – PUA Installation

Most victims never willingly install PUAs. These applications usually come bundled with free software, fake installers, pirated content, or deceptive websites. ManualFinder, for instance, is often downloaded as part of another utility or browser extension.

Once installed, the PUA begins running in the background. It configures itself to launch automatically with your operating system and alters browser settings to enable future redirects.

Step 2: Fake Security Checks

Shortly after installation, you may notice unusual behavior. A typical symptom is the sudden appearance of a fullscreen message that says:

“Network and device security check in progress.”

This is not a real scan. It’s a hard-coded animation or static screen designed to look legitimate. There is no antivirus engine or malware detection process running behind the scenes.

Step 3: The Scare Tactic Message

Following the fake scan, a second fullscreen message appears. This one is more urgent:

“Install antivirus now to remove threats and protect your PC”

The screen features a large warning icon (usually a red shield with an exclamation mark) and a prominent “Install Antivirus” button. A smaller “Skip” link may be included, but it’s often barely noticeable.

This tactic exploits fear, prompting the user to act without thinking. It mimics the behavior of legitimate system alerts to build trust and urgency.

Step 4: Redirection to Real Antivirus Sites

When the user clicks the button, they are redirected to a real antivirus provider such as:

• McAfee
• Norton
• TotalAV

These redirects include the scammer’s affiliate code in the URL, which ensures they get paid if the user downloads or subscribes to the product.

This approach allows scammers to make money without delivering anything themselves, while pushing users into actions based on false premises.

Step 5: Optional Payload Delivery

In more dangerous versions of the scam, the redirection doesn’t lead to a legitimate antivirus site. Instead, it may trigger the download of malware or more PUAs. This can include:

• Fake antivirus programs
• Browser hijackers
• Cryptocurrency miners
• Ransomware loaders

Step 6: Repeat Behavior

Once the PUA is installed, it may persistently show alerts and pop-ups, disrupting normal use and increasing the chances of further exploitation. In some cases, the software can resist uninstallation or reinstall itself using hidden files.

What to Do If You Have Fallen Victim to This Scam

If you suspect you’ve interacted with the scam or installed software based on this misleading message, don’t panic. Follow these steps to clean your system and protect your data:

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Rkill to terminate suspicious programs
• STEP 4: Use Malwarebytes to remove for Trojans and Unwanted Programs
• STEP 5: Use HitmanPro to remove Rootkits and other Malware
• STEP 6: Use AdwCleaner to remove Malicious Browser Policies and Adware
• STEP 7: Perform a final check with ESET Online Scanner

STEP 1: Uninstall malicious programs from Windows

In this first step, we will manually check if any unknown or malicious programs are installed on the computer. Sometimes adware and browser hijackers can have a usable Uninstall entry that can be used to remove them.

Now that the malicious programs have been removed from your computer, we can proceed with the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Rkill to terminate suspicious programs.

In this thrid step, we will download and run Rkill to terminate suspicious programs that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 4: Use Malwarebytes to remove for Trojans and Unwanted Programs

In this next step, we will we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes stands out as one of the leading and widely-used anti-malware solutions for Windows, and for good reason. It effectively eradicates various types of malware that other programs often overlook, all at no cost to you. When it comes to disinfecting an infected device, Malwarebytes has consistently been a free and indispensable tool in the battle against malware. We highly recommend it for maintaining a clean and secure system.

1. Download Malwarebytes

   Download the latest version of Malwarebytes for Windows using the official link below. Malwarebytes will scan your computer and remove adware, browser hijackers, and other malicious software for free.

   

   MALWAREBYTES FOR WINDOWS DOWNLOAD LINK
   
   (The above link will open a new page from where you can download Malwarebytes)
2.  

   Install Malwarebytes

   After the download is complete, locate the MBSetup file, typically found in your Downloads folder. Double-click on the MBSetup file to begin the installation of Malwarebytes on your computer. If a User Account Control pop-up appears, click “Yes” to continue the Malwarebytes installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   When the Malwarebytes installation begins, the setup wizard will guide you through the process.

   • You’ll first be prompted to choose the type of computer you’re installing the program on—select either “Personal Computer” or “Work Computer” as appropriate, then click on Next.

     

   • Malwarebytes will now begin the installation process on your device.

     

   • When the Malwarebytes installation is complete, the program will automatically open to the “Welcome to Malwarebytes” screen.

     

   • On the final screen, simply click on the Open Malwarebytes option to start the program.

     

4. Enable “Rootkit scanning”.

   Malwarebytes Anti-Malware will now start, and you will see the main screen as shown below. To maximize Malwarebytes’ ability to detect malware and unwanted programs, we need to enable rootkit scanning. Click on the “Settings” gear icon located on the left of the screen to access the general settings section.

   

   In the settings menu, enable the “Scan for rootkits” option by clicking the toggle switch until it turns blue.

   

   Now that you have enabled rootkit scanning, click on the “Dashboard” button in the left pane to get back to the main screen.

5. Perform a Scan with Malwarebytes.

   To start a scan, click the Scan button. Malwarebytes will automatically update its antivirus database and begin scanning your computer for malicious programs.

   

6. Wait for the Malwarebytes scan to complete.

   Malwarebytes will now scan your computer for browser hijackers and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check the status of the scan to see when it is finished.

   

7. Quarantine detected malware

   Once the Malwarebytes scan is complete, it will display a list of detected malware, adware, and potentially unwanted programs. To effectively remove these threats, click the “Quarantine” button.

   

   Malwarebytes will now delete all of the files and registry keys and add them to the program’s quarantine.

   

8. Restart your computer.

   When removing files, Malwarebytes may require a reboot to fully eliminate some threats. If you see a message indicating that a reboot is needed, please allow it. Once your computer has restarted and you are logged back in, you can continue with the remaining steps.

   

STEP 5: Use HitmanPro to remove Rootkits and other Malware

In this fifth step, while the computer is in normal back, we will download and run a scan with HitmanPro to remove Trojans, rootkits, and other malicious programs.

HitmanPro is a second-opinion scanner that takes a unique cloud-based approach to malware scanning. HitmanPro scans the behavior of active files and also files in locations where malware normally resides for suspicious activity. If it finds a suspicious file that’s not already known, HitmanPro sends it to its clouds to be scanned by two of the best antivirus engines today, which are Bitdefender and Kaspersky.

Although HitmanPro is shareware and costs $24.95 for 1 year on 1 PC, there is no limit on scanning. The limitation only kicks in when there is a need to remove or quarantine detected malware by HitmanPro on your system and by then, you can activate the one-time 30-days trial to enable the cleanup.

1. Download HitmanPro.

   You can download HitmanPro by clicking the link below.

   HITMANPRO DOWNLOAD LINK
   (The above link will open a new web page from where you can download HitmanPro)

2. Install HitmanPro.

   When HitmanPro has finished downloading, double-click on “hitmanpro.exe” (for 32-bit versions of Windows) or “hitmanpro_x64.exe” (for 64-bit versions of Windows) to install this program on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow HitmanPro to make changes to your device. If this happens, you should click “Yes” to continue with the installation.

   

3. Follow the on-screen prompts.

   When HitmanPro starts you will be presented with the start screen as shown below. Click on the “Next” button to perform a system scan.

   

   

4. Wait for the HitmanPro scan to complete.

   HitmanPro will now begin to scan your computer for malicious programs.
   

5. Click on “Next”.

   When HitmanPro has finished the scan, it will display a list of all the malware that it has found. Click on the “Next” button to have HitmanPro remove the detected items.

   

6. Click on “Activate free license”.

   HitmanPro may now require to activate the free 30-days trial to remove the malicious files. To do this, click on the “Activate free license” button to begin the free 30 days trial and remove all the malicious files from your computer.
   

   When the malware removal process is complete, it will display a screen that shows the status of the various programs that were removed. At this screen, you should click on the Next button and then if prompted you should click on the Reboot button. If HitmanPro does not prompt you to reboot, please just click on the Close button.

STEP 6: Use AdwCleaner to remove Malicious Browser Policies and Adware

In this next step, we will use AdwCleaner to remove malicious browser policies and unwanted browser extensions from your computer.

AdwCleaner is a free popular on-demand scanner that can detect and remove malware that even the most well-known anti-virus and anti-malware applications fail to find. This on-demand scanner includes a lot of tools that can be used to fix the side effects of adware. browser hijackers and other malware.

1. Download AdwCleaner.

   You can download AdwCleaner by clicking the link below.

   

   ADWCLEANER DOWNLOAD LINK
   (The above link will open a new web page from where you can download AdwCleaner)

2. Double-click on the setup file.

   Double-click on the file named “adwcleaner_x.x.x.exe” to start AdwCleaner. In most cases, downloaded files are saved to the Downloads folder.
   

   AdwCleaner program will now open and you will be presented with the program’s license agreement. After you read it, click on the I agree button if you wish to continue. If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.

   

3. Enable “Reset Chrome policies” to remove malicious browser policies.

   When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable “Reset Chrome policies“.

   

4. Click on the “Scan” button.

   On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

   

5. Wait for the AdwCleaner scan to finish.

   AdwCleaner will now scan your computer for malware. This process can take a few minutes.

   

6. Click on “Quarantine” to remove malware.

   When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button to remove the malicious programs from your computer.

   

7. Click on “Continue” to remove the malicious programs.

   AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean. Click on the “Continue” button to finish the removal process.
   

   AdwCleaner will now delete all detected malware from your computer. When the malware removal process is complete, you may be asked to restart your computer.

STEP 7: Perform a final check with ESET Online Scanner

This final step involves installing and running a scan with ESET Online Scanner to check for any additional malicious programs that may be installed on the computer..

ESET Online Scanner is a free second-opinion scanner, designed to rescue your computer from malware (viruses, trojans, rootkits, etc.) that have infected your computer despite all the security measures you have taken (such as anti-virus software, firewalls, etc.).

1. Download ESET Online Scanner.

   You can download ESET Online Scanner by clicking the link below.

   

   ESET ONLINE SCANNER DOWNLOAD LINK
   (The above link will open a new web page from where you can download ESET Online Scanner)

2. Double-click on esetonlinescanner.exe to run the installer.

   When ESET Online Scanner has finished downloading, double-click on “esetonlinescanner.exe” to install it program on your computer. In most cases, downloaded files are saved to the Downloads folder.
   

3. Install ESET Online Scanner.

   When ESET Online Scanner starts you will be presented with the start screen as shown below. Select your desired language from the drop-down menu and click Get started.

   

   In the Terms of use screen, click Accept.
   

   Select your preference for the Customer Experience Improvement Program and the Detection feedback system and click Continue.
   

4. Start a Full Scan with ESET Online Scanner

   Click on Full Scan to perform an in-depth inspection of the entire computer.

   

   Select Enable for Detection of Potentially Unwanted Applications, then click Start scan.

   

5. Wait for the ESET Online Scanner scan to finish.

   ESET Online Scanner will now begin to scan your computer for malware. This process can take quite a while, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.

   

6. ESET Online Scanner will automatically remove the malicious files.

   At the end of the scan, the Found and resolved detections screen will be displayed. You can click View detailed results to view specific information. Detected threats are automatically cleaned and quarantined.
   

The Bottom Line

The “Install Antivirus Now To Remove Threats And Protect Your PC” scam is an elaborate, deceptive affiliate marketing scheme that uses fear and manipulation to drive clicks. While it may sometimes lead to legitimate antivirus software, the path it takes is unethical and often dangerous.

By understanding how this scam works and taking the right precautions, you can stay one step ahead of cybercriminals. If you’ve already encountered it, don’t wait. Take action now to clean your system, secure your data, and report the scam to prevent its spread.

Cybersecurity threats continue to evolve, but so can your awareness. Stay alert, stay informed, and help others do the same.

Frequently Asked Questions (FAQ)

What is the “Install Antivirus Now To Remove Threats And Protect Your PC” pop-up?

The “Install Antivirus Now To Remove Threats And Protect Your PC” pop-up is a fake security alert generated by a potentially unwanted application (PUA), such as ManualFinder. It displays a full-screen warning claiming your PC is at risk and prompts you to install antivirus software. While the software promoted may sometimes be legitimate, the method of delivery is deceptive and often linked to affiliate marketing abuse or malware distribution.

Is the “Install Antivirus Now” message real or a scam?

It is a scam. The message is not from your operating system or a legitimate antivirus program. It is created by an unwanted application installed on your computer or browser. Its goal is to trick you into clicking a button that redirects you to an antivirus site through an affiliate link, or worse, downloads malware disguised as security software.

What happens if I click the “Install Antivirus” button?

Clicking the button typically redirects you to the official websites of antivirus providers like McAfee, Norton, or TotalAV. These redirects are embedded with affiliate codes, allowing the scammer to earn illegitimate commissions. In more harmful cases, clicking the button may initiate the download of fake antivirus tools, PUAs, or even malware like trojans, ransomware, or spyware.

How did this pop-up appear on my computer?

The pop-up is usually triggered by the installation of a Potentially Unwanted Application (PUA) like ManualFinder. PUAs often come bundled with free software, fake downloads, or browser extensions. Once installed, they generate misleading alerts, change browser settings, and initiate redirects to scam pages or affiliate links.

Can this scam install a virus on my computer?

Yes. While some variants only redirect you to legitimate antivirus software, others may install fake security tools, malicious software, or open the door for more severe infections. These may include keyloggers, cryptocurrency miners, ransomware, or browser hijackers. It is essential to treat any such alert as a potential threat.

How do I remove the “Install Antivirus Now” scam from my PC?

To remove this scam from your system, follow these steps:

1. Uninstall suspicious applications from your device.
2. Reset your browser settings to remove unwanted extensions.
3. Run a full malware scan using trusted tools like Malwarebytes or Windows Defender.
4. Use specialized cleaners like AdwCleaner or HitmanPro to detect and remove stubborn PUAs.
5. Clear your cache and cookies to remove residual tracking data.
6. Reboot your device and check if the pop-up returns.

Is ManualFinder a virus?

ManualFinder is classified as a Potentially Unwanted Application (PUA). While it may not be a virus in the traditional sense, it exhibits malicious behaviors such as displaying fake alerts, altering browser settings, and redirecting users through affiliate schemes. It is strongly recommended to remove it from your system.

Why does the pop-up redirect me to McAfee or Norton? Are those sites fake?

The sites themselves are legitimate. However, the redirection is manipulated by scammers through affiliate links. They make money if you purchase antivirus software after clicking through their link, even though they used deceptive tactics to drive traffic. This practice is unethical and violates the terms of most affiliate programs.

Can I stop this scam without installing new software?

You may be able to stop the scam manually by:

• Uninstalling recently installed programs you don’t recognize
• Removing suspicious browser extensions
• Clearing your browsing data and cookies
• Resetting your browser to default settings

However, using legitimate security tools is recommended to ensure complete removal and to detect any hidden threats that manual inspection may miss.

How can I prevent this scam from appearing again?

To avoid seeing this scam in the future:

• Be cautious when downloading free software or browser extensions.
• Always use custom installation to deselect unwanted offers.
• Avoid visiting untrusted websites or clicking on unknown ads.
• Use reputable antivirus or antimalware software to monitor threats.
• Regularly update your system and software to patch vulnerabilities.
• Enable browser protections such as pop-up blockers and safe browsing modes.