Unwanted software keeps appearing? Find the source before changing controls.

Check the browser’s own settings for the exact source of an unwanted notification or extension. In Edge, Microsoft documents blocking notifications for individual websites and managing extensions. Open settings from the real browser menu rather than use a button inside the alert.

Revoke an unwanted site’s notification permission or remove a confirmed unwanted extension you are authorised to change. Preserve essential password-manager, accessibility and work-managed extensions. A site notification, browser pop-up and installed desktop program are different; changing notification permission does not uninstall malware.

Google’s Chrome unwanted-software guidance explains persistent search/extension changes. Check the specific app, sync or policy source if settings return. Do not reset every browser profile, delete saved data or remove management as a first response. Use the matching browser’s current controls.

In the genuine Windows Security app, App & browser control includes supported reputation-based protection and, on eligible systems, Smart App Control. Microsoft’s current guidance explains available features. Check the actual device and organisation policy; do not assume every Windows version or third-party protection setup shows the same controls.

Potentially unwanted-app blocking, browser download warnings and malware protection have different scopes. A blocked or quarantined detection may need a supported action; it is not automatically the same as removal. Keep current updates and configured protection enabled. Do not turn off protection or create an exclusion because a wanted download is blocked; verify the exact file and warning with IT/publisher.

On Mac, retain the supported app-security controls and use genuine App Store/developer sources. Apple’s safe-opening guidance describes signature/notarisation checks; these reduce risk without promising every signed app is suitable or harmless. A background/login item can be legitimate; turning it off does not uninstall the app or establish whether it is malicious.

If a protection control is unavailable or managed, ask the responsible IT team about the supported option. Do not reset Windows merely to expose a feature or switch it off to experiment; availability and re-enabling conditions can differ.

Agree who manages the device and which software sources are approved. Use appropriate everyday account permissions while retaining a tested authorised administrator/recovery route. Microsoft recommends limiting administrators in its account guidance. Standard-user use reduces unnecessary elevation but is not a complete policy preventing every per-user app or download.

For staff devices, define needed applications, an approved request/install process, update ownership and how an unexpected block is reported. Web filtering and browser controls address parts of the download path; execution/application controls address a different layer. Do not assume filtering every risky site guarantees that no unwanted app can run.

Responsible IT can assess suitable supported controls, first inventorying required apps and testing policy impact. Microsoft’s application-control planning guidance includes audit/testing and support needs. This is not a one-click policy to apply blindly: a poorly planned rule can block legitimate work. Our web-filtering support can be part of reviewing the appropriate layers, with scope and limitations agreed.

Reopen the normal app/browser and check whether the original unwanted alert, extension change or app returns. Confirm the needed legitimate app, accessibility functions and work process still operate. Use harmless ordinary tasks, not a malware sample, cracked installer or deliberately unsafe website to test protection.

Review genuine protection history/status and any relevant IT test result within the agreed scope. Record the specific source/removal/permission/policy change and whether the behaviour recurs after a normal reopen or restart. Do not approve a new unexpected prompt to see what happens.

If the original behaviour has stopped and needed work remains available, retain the verified setup and stop changing settings. If it returns, keep the timing and exact evidence for assessment. Absence of a pop-up or one clean scan does not prove all accounts and devices are uncompromised.

Get help when apps/extensions repeatedly return, the source or management is unknown, removal is blocked, protection reports an infection or a business policy could interrupt required work. Include the exact app/site/extension, OS/browser, detection/error and changes already tried.

Our malware and unwanted-software support can help assess the observed behaviour and a suitable response. For suspected compromise, prioritise containment and legitimate account/security support rather than treat it only as an installation preference.

Use an agreed private support channel and share only necessary evidence. Do not provide passwords, MFA codes, remote-access codes from unsolicited callers or full private browsing records as a first report. No tool or filtering plan can promise to stop every unwanted program.