Remove the scam Chrome extension completely (do not only disable it), reset hijacked Chrome settings, then turn on Enhanced Safe Browsing. This is not the same as a fake virus-warning popup. Microsoft Defender is a valid buy-nothing scan afterward.

Signs a Chrome extension is the problem

Pop-up ads and new tabs; homepage or search changes; extensions that come back; redirects; fake infected alerts. Fake on-page virus banners may just be a webpage — use the popup guide first, then open chrome://extensions if an unknown add-on is listed. Treat a surprise installer the same way you check a download before opening an .exe.

Step 1: Remove the extension

  1. Toolbar icon: right-click → Remove from Chrome.
  2. Or More → Extensions → Manage extensions (chrome://extensions) → Remove.
  3. Do not only disable it. Look-alike names are common.
  4. If Settings says an extension is controlling a setting, remove that name.

Step 2: Remove unwanted programs that reinstall the extension

  1. Windows: Settings → Apps → Installed apps, uninstall unknown same-day programs.
  2. Mac: Finder → Applications → move unknown apps to Trash.

If the add-on returns after a restart, this step is the usual reason.

Step 3: Reset Chrome settings

  1. More → Settings → Reset settings.
  2. Choose Restore settings to their original defaults, then Reset settings.
  3. Re-enable only extensions you trust.

Step 4: Turn on Enhanced Safe Browsing

  1. Settings → Privacy and security → Security.
  2. Choose Enhanced protection.
  3. Close untrusted extension warnings unless you trust the developer.

Step 5: Optional Windows Defender scan

If redirects continue, run a Microsoft Defender scan. Do not run Defender plus a second real-time product — see Malwarebytes and Defender together. If Chrome signed you out, run Google's security checkup at myaccount.google.com/security-checkup.

FAQ

How do I remove a scam Chrome extension?

Remove it via Manage extensions (chrome://extensions) or by right-clicking the toolbar icon. Do not only disable it.

Why does it come back?

A reinstalling Windows or Mac program is the usual cause. Uninstall unknown same-day apps, then reset Chrome.

Is a full-page infected alert an extension?

Often it is a webpage, not an add-on. Use 8 ways to tell a virus warning popup is fake first, then check chrome://extensions.

Do I need paid antivirus?

No. Microsoft Defender can be enough for many home PCs. Remove the extension, reset Chrome, then scan with Defender if redirects continue.

Should I install a cleaner from the pop-up ad?

No. Do not install anything from a pop-up ad.

Removing a scam Chrome extension does not require paid antivirus. Microsoft Defender is a valid buy-nothing choice for many Windows households. Habits that actually help are: remove (do not only disable), uninstall the reinstaller, reset Chrome, and turn on Enhanced Safe Browsing. If the household later wants multi-device paid protection, use only these on-site paid links: TotalAV, Norton, Bitdefender, McAfee, Avast.