When I logged into my Windows 11 PC, Norton immediately displayed an alert saying it had blocked a botnet connection. The details only mentioned a URL and TCP. A few minutes later, after I installed Malwarebytes to scan the computer, another warning appeared claiming Malwarebytes was trying to steal my information. I then saw a separate alert about a blocked DDoS attack. How can I tell whether these are genuine antivirus detections, malicious browser notifications, or signs that my computer or network is infected? What steps should I take to secure everything?
4 Answers
If the alerts are confirmed to be from Norton or another installed security product, disconnect the PC from the internet, back up only personal documents, and perform a clean Windows reinstall if you believe the system is compromised. Afterward, install all updates, change important passwords from a separate trusted device, enable multifactor authentication, and use Microsoft Defender or another reputable security product. Malwarebytes can be used as an additional on-demand scanner.
Avoid relying on repeated Norton pop-ups as proof that the machine is infected. Open the security application directly from the Start menu and review its protection history instead of clicking an alert. If Malwarebytes was downloaded from its official site, an antivirus warning about it may have been a false positive or a warning about the installer’s behavior, but downloading it from an unofficial mirror would be risky.
These may be browser push notifications rather than real antivirus alerts. Some websites trick people into allowing notifications, then display scary messages designed to make them download fake security software. Don’t click the warnings or install anything through those pop-ups. Check which app generated each alert, revoke notification permissions for unfamiliar websites, and run scans using Malwarebytes and Microsoft Defender downloaded from their official websites.
Exactly—clicking the fake warning usually leads to the actual malware download. Treat browser pop-ups as untrusted unless you can verify that the alert came from the installed security program.
There’s no need to assume the router or modem is infected just because the computer showed alarming messages. Reset the router to its factory settings only if you find suspicious configuration changes, update its firmware, set a new administrator password, use WPA2 or WPA3 Wi-Fi security, and review connected devices. Also check the browser’s notification permissions and remove anything unfamiliar.
The main priority is verifying the source of the alerts. A browser notification can claim there was a botnet or DDoS attack even when the antivirus never detected one.
A clean reinstall is the safest option when you can’t determine what happened, but make sure the Windows installer comes from Microsoft and don’t restore suspicious programs or cracked software afterward.