McAfee rouge software, re-install Windows 11?

I agree with your assessment. The warnings in the screenshot are almost certainly fake security alerts delivered through Microsoft Edge, rather than evidence that viruses or malware have been installed on the computer.

In fact, the screenshot contains several strong clues that this is a case of browser notification abuse (scareware) rather than a genuine Windows Defender warning.

I suspect that the OP inadvertently clicked Allow when a deceptive website requested permission to send notifications. The website is now exploiting that permission to display fraudulent antivirus warnings and direct the user to McAfee-related installation pages.

This could explain all the reported symptoms, including why McAfee's removal utility has accomplished nothing.

The first thing I would ask the OP to do is inspect Edge's list of websites allowed to send notifications. If removing those permissions stops the warnings, that would strongly support the browser-notification explanation and could resolve the problem in minutes, without reinstalling Windows.

What the screenshot tells us​

1. The notifications identify Microsoft Edge as their source. The notification reading "Viruses Found" includes the text "via Microsoft Edge" and displays what appears to be a randomly generated website address. This strongly suggests that a website has been granted permission to send browser notifications.

2. The warnings impersonate Windows Defender. The first notification says "Virus & threat defender," which is not the normal name of the Windows Security feature, "Virus & threat protection." The other warning uses Windows Defender branding to make the message look official.

3. The reference to Windows 10 is suspicious. As you noticed, the computer supposedly runs Windows 11, yet the warning offers to install something associated with Windows 10. That's typical of generic scareware advertising.

4. The warnings lead to a McAfee installation page. This is especially revealing. A legitimate Microsoft Defender security alert would not normally direct users to install McAfee through an advertising website.

5. Repeated notifications do not imply repeated infections. A website that has notification permission can generate numerous alarming messages without anything malicious being installed locally.

The important distinction is that a malicious or deceptive website can display frightening messages without having compromised Windows itself.

That doesn't prove the computer is clean, but nothing visible in this screenshot establishes an actual malware infection.

What I would recommend to the OP​

I would first remove the suspicious website's notification permission.

Open Microsoft Edge and enter this address:

edge://settings/content/notifications

Under Allowed, look for the suspicious website shown in the screenshot, or any other unfamiliar websites, and remove or block their notification permissions.

Microsoft explicitly confirms that website notifications can appear in the lower-right corner of Windows even when Edge is closed.

Next, check edge://extensions for unfamiliar extensions, and examine Edge's other website permissions. If necessary, reset Edge's settings.

The OP should then open the genuine Windows Security application from the Start menu, check Protection history, update its antivirus definitions, and perform a full scan. A Microsoft Defender Offline scan is also available if there is reason to suspect a persistent infection.

The fact that McAfee's MCPR removal tool didn't help is perfectly consistent with this explanation. MCPR removes McAfee software; it doesn't revoke the notification permissions granted to websites in Edge.

Click to expand...

• • Open Malwarebytes on your Windows or Mac device.
  • Click on Detection History on the main dashboard.
  • Select the Quarantined items tab.
  • Check the box next to each item you want to delete (or check the top box to select all items at once).
  • Click the Delete button to permanently remove the files from your computer.

HitmanPro and HitmanPro.Alert. Advanced Malware Scanning, Detection and Removal Tools

HitmanPro Malware Removal Cleans Viruses, Trojans, Keyloggers, Ransomware, Spyware and More. Secure from Attacks in Real Time with HitmanPro.Alert.

www.sophos.com