A family in Whitburn brought a desktop in a few weeks ago that nobody wanted to use after six in the evening. Every forty minutes or so, Microsoft Edge would open itself, flash up a tab with a flashing “Your PC is at risk — scan now” banner, and then another with a casino promo, and sometimes a third with a shopping deals page. The daughter had taken to just unplugging the PC when she went to bed because the tabs would keep piling up overnight if nobody closed them. Nothing in Task Manager looked unusual. Windows Defender showed a clean scan.
It was not a classic virus. It was a browser notification permission the previous owner of the PC had clicked “Allow” on more than a year ago, feeding Edge a steady drip of push messages that it was faithfully opening as new tabs on the user's behalf. The actual clean was ten minutes once we knew where to look. The puzzle, as always, is that this symptom covers three or four completely different causes and only one of them is “antivirus will fix it”. This is the walk-through we use on the bench, written out so a Whitburn or Armadale household can at least try the first two steps themselves before paying for a virus and malware removal job.
Why This Symptom Is Not Really “A Virus”
When a browser opens tabs by itself, the first thought is a classic infection running in the background. In 2026 that is rarely what we find. Modern Windows is harder to get a persistent executable onto than it used to be, and the real malware economy has moved on to things that live inside the browser instead — permissions, extensions, scheduled tasks, startup entries that quietly launch Edge with a URL. A standard antivirus scan sees nothing wrong because, strictly speaking, nothing is wrong with the operating system. Edge is doing exactly what it has been told to do by a setting the user accepted months ago.
That shift matters because it changes the fix. The repair is almost never “install a second antivirus” — stacking scanners is a job we actively undo at least once a month on Chrome hijacker calls in Penicuik and the surrounding villages. The repair is a careful tour of five specific places inside Windows and inside Edge, in a known order, with the browser closed between stops. Done properly it does not need to come back.
Suspect One: Browser Notifications You Clicked “Allow” On Months Ago
Comfortably the single most common cause on West Lothian callouts, including the Whitburn family above. At some point in the past, somebody browsing the PC — often a different person entirely from whoever uses it now — visited a page that popped up the browser's native “Show notifications?” prompt and clicked Allow instead of Block. The site is then entitled to push messages into Windows that Edge displays as banner notifications in the bottom-right of the screen, and clicking anywhere on one opens a tab. On an unattended PC the banner can be dismissed by Windows's own idle timeout, but the tab is opened first.
The fix is in Edge itself, not Windows. Open Edge, go to Settings, choose Cookies and site permissions, then Notifications. The list of sites that have permission is usually short and includes at least one domain nobody in the household recognises — this is the one. Remove every entry that is not a site the family actually uses, and tick the toggle at the top that stops any site from asking in future. The tab-storm stops within minutes. If several browsers are installed, this check is run inside each one separately.
Suspect Two: A Scheduled Task Launching Edge With A URL
Less common, but we see it enough on bench repairs that it is always the second place we look. Some adware installers — often bundled with free YouTube downloaders, driver-updater utilities or “system cleaners” from pop-up ads — drop a Scheduled Task that fires every hour or two and launches msedge.exe with a URL baked in as a command-line argument. Task Manager sees Edge; Edge sees a legitimate command line; Defender sees nothing worth flagging.
Opening the Task Scheduler and skimming the Task Scheduler Library will usually show a suspiciously-named entry — something like “UpdateCheckService” or a long random string — whose Actions tab shows it launching Edge, Chrome or cmd.exe with a URL. Disable it, note what it was pointing at, and then uninstall whatever program dropped it (the Author column often gives it away). We also look under HKCU\Software\Microsoft\Windows\CurrentVersion\Run for the same pattern — a Run key that silently fires Edge at a URL every time the user logs in. These are the two places a standard “run antivirus” walkthrough almost never covers.
Suspect Three: An Extension Driving The Browser From Inside
A smaller slice of calls, usually on machines that were set up by someone who likes trying new extensions. A rogue Edge extension — often one that looked like a coupon finder, a PDF converter or a wallpaper tool — can read and modify every page the user loads, open new tabs on a timer, and quietly swap the default search provider at the same time. These are the ones that persist across a browser restart but die the moment the browser is run in InPrivate mode (which disables extensions by default).
The test is quick: open an InPrivate window and leave it running for a while. If the random tabs stop appearing, the fault is an extension. Open Edge's Extensions page, remove anything the user does not recognise or did not deliberately install, and restart the browser. If there are a lot of them, the fastest clean is to disable them all, confirm the symptom has gone, then re-enable only the ones the user actually relies on. This is also a job we are happy to do inside a secure remote support session for anyone who is not confident poking around browser settings.
Suspect Four: A “Cleanup” App That Is Itself The Problem
Worth a specific mention because it keeps coming up on Whitburn and Bathgate callouts. The homeowner, worried about the random tabs, downloads a tool from one of those tab-ad landing pages promising a free PC scan. The scan reports hundreds of “critical errors”, pushes an installer, and the installer is itself the thing that from then on opens tabs and shows “expired licence” nags. We have cleaned up more of these in the last twelve months than we have classic viruses, and the fake update popup walk-through from Bruntsfield covers exactly the same economy from a different angle.
Removal is not always a clean “Uninstall” from Settings — some of these leave their scheduled task, Run key and residual service behind even when the main app is gone. A proper bench clean goes through Add or Remove Programs, Task Scheduler, the Run keys and the Services list in that order, and we also run a software troubleshooting pass afterwards to confirm nothing else is still pointing at the leftover folder.
Before You Phone Us: A Five-Minute Owner Check
Two things worth trying first, because they occasionally turn an evening of random tabs into a quiet household.
First, walk Suspect One properly: Edge, Settings, Cookies and site permissions, Notifications, remove everything you do not recognise, toggle off “Sites can ask to send notifications”. Second, check the Scheduled Tasks list for anything launching a browser (Start, type Task Scheduler, open the Library, scan down the Actions column of each enabled task). If either of those finds the culprit, the tab-storm stops and no further work is needed. If neither does, the problem has moved into extension or installer territory and that is where our walk-through of a Craigmillar PC whose pop-ups kept coming back after the browser was closed picks the trail up.
When It Needs A Proper Bench Clean
If the notification list is empty, Task Scheduler is clean, the extensions are all familiar, and Edge still opens random tabs every hour or two, the problem has moved past “settings” and into the operating system. On rare machines we find a leftover service, a hijacked default-apps association, or a Group Policy that was dropped by an installer and never cleaned up. Those need a proper tour of the registry, the Services console and Group Policy, which is a bench job we do with the PC on the bench and a plain quote in front of the owner first. Occasionally the cheapest honest answer is a careful Windows reinstall with the user's documents preserved — and we will tell you plainly if that is where we think the hour is best spent.
Bringing (Or Opening) The PC From Whitburn
If you are in Whitburn, Blackburn, East Whitburn, Fauldhouse or anywhere else in EH47 and Edge has started opening tabs on its own, you have two sensible options. For a routine notification or scheduled-task clean, we can dial in through a secure remote session and sort it the same morning without the PC leaving the house. For anything more involved — a stubborn installer, a hijacked default search provider that keeps coming back, a Windows profile that has been genuinely tampered with — the PC comes in to the workshop on Parkhead Drive and we aim to turn it around on the same day. Our local virus removal service for Whitburn has the collection details for the town and the EH47 postcode, and we also run regular callout slots across Armadale, Bathgate, Blackburn and the Livingston corridor.
Either way, you get a plain answer and a quote before any work starts. If it is ten minutes of notification cleanup, that is what we will do and tell you. If the install needs a proper bench tour or a careful Windows reinstall, we will walk you through what that looks like and how long the PC will be off the desk. The point of this one is to make the PC quiet again — and to leave it that way so it does not start up again a fortnight later.
Book a diagnostic online or get in touch and we will take a proper look.
Last updated: 14 October 2026