Kfx7-67 virus: a fake Android alert, and what to do about it
The Kfx7-67 virus is a made-up name on a red fake alert page that says your Android phone is infected and tells you to install an antivirus. Close it; only if you tapped the button, installed an app or allowed notifications do you need the steps below.
Facts checked October 6, 2026. Steps checked against Apple's and Google's current documentation and the reports we cite. We have not run the app or the link on a phone ourselves.
Do it yourself · free Remove Kfx7-67 virus fake alert yourself 2 steps, about 6 minutes, no software needed.
Start the steps
us.30928.site) and an Italian dialog headed www.limetvs.com with an OK button. The red title at the bottom was added by our editors; it is not part of the page.Kfx7-67 virus fake alert: summary
| Type | Fake virus alert (scareware web page) aimed at Android users; not a virus and not a security app |
|---|---|
| Risk | Medium: seeing the page is harmless; tapping its button, installing its app or allowing its notifications is not |
| Symptoms | A dialog saying Kfx7-67 virus was found, then a red page with a VIRUS warning, a two-step list and a countdown timer |
| How to get rid of it | Close the tab and tap nothing. If it returns, remove the site's notification permission and any app you did not choose; see the Android section |
| Our check | Source check on 6 October 2026: limetvs.com in our picture is not registered, 30928.site was created in May 2026; no live test, so what the page does today is unconfirmed |
| First seen | Our guide of 4 June 2021 |
Show 6 more facts
| Detection names | No Microsoft detection name is known: a web page is not a file, so Defender has nothing to detect unless an app was installed from it. Kfx7-67 is a name in the scam text |
|---|---|
| Distribution | Deceptive ads, redirects, allowed notifications, sometimes adware |
| Damage | An unwanted app, ads and fake alerts, possibly payment or card details handed over |
| Name | Kfx7-67 virus fake alert |
| Evidence | One write-up by a security site; details still limited |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Google's Chrome and Play Protect help pages for Android, Android's developer documentation, the FTC's tech support scam page, the registry answers for the two addresses in our pictures and our 2021 guide. Browser menu names for computers were read on 5 October 2026. We did not open a live page.
What the Kfx7-67 virus alert is
- What it is
- A web page, not a program. It shows a red "virus found" screen built to look like a phone security warning and invents a threat called Kfx7-67
- What it claims
- Your personal data are compromised, your private messages and all phone files can be violated, and the virus must be eliminated at once
- What it wants
- A tap on the "eliminate the virus" button, then an install of an app called Security Antivirus 2017 (the name in our 2021 pictures)
- Is Kfx7-67 a real virus?
- No. The name appears only in the scam text. We found no antivirus detection name or file for it, which fits a page rather than malware
- Who sees it
- Mostly Android phones and tablets (Samsung, LG, Motorola, Pixel, OnePlus, Xiaomi and others, per our old guide); a web page opens in any browser
- 1
A dialog speaks first
After a tap on an ad or a redirect, a box headed with the page's own address says a site you visited contained a virus and your phone is infected by Kfx7-67. It asks you to press OK.
- 2
OK leads to the red page
A huge "VIRUS" warning on red, two steps and a countdown timer, meant to frighten the visitor.
- 3
The button leads away
Step 1 says to install an antivirus. We did not follow it, so we cannot say what the app or the next page is today.
Our 2021 guide called the page a hoax and said not to install what it offers. That holds. The name needs no removal, but a phone that keeps showing the page may have something else opening it.
Is the Kfx7-67 virus fake alert warning real?
What we checked and what we did not
Kfx7-67 virus page · source check · 6 October 2026
- The claimA page cannot find malware on a phone. Google's Chrome help lists "alerts about a virus or an infected device" among the signs of unwanted software: a symptom to check, not a diagnosis.
- What the button asks forAn install of an antivirus app. The FTC says real security pop-up warnings never ask you to call a phone number, and that such pop-ups aim at your money or access. We did not tap the button, so what the app does is unconfirmed.
- limetvs.comThe address in the Italian dialog of our picture. The .com registry (Verisign RDAP) answered "not found" on 6 October 2026, and it has no DNS answer: not registered today.
- us.30928.siteThe address bar in our other picture. RDAP shows
30928.sitecreated on 15 May 2026, almost five years after our report, so its holder may not be who ran the 2021 page. We did not open it. - Our own site testNone: our fact file holds no live address, search volume or reader comments. One visit would not clear a site anyway; such pages change by country, device, referrer or a second visit.
- Whether it is still activeNot confirmed; silence is not proof it stopped.
A fake alert by its own wording Do not tap the button or install the app. We did not test a live copy, so what its next page does today is unconfirmed.
The page in our reports
4 June 2021
Our guide: a pop-up scam on Android
We described the red screen, the OK dialog and the countdown. The pictures show
us.30928.siteandwww.limetvs.com. We never changed the guide afterwards and ran no site test.Two versions from our 2021 report: the red page with a countdown (address bar us.30928.site) and an Italian dialog headedwww.limetvs.comwith an OK button. The red title at the bottom was added by our editors; it is not part of the page.2021
The same page in other languages
A German page in a desktop Firefox window and a Korean page in a phone browser use the same two steps and a countdown. The German window's title is the Italian words VIRUS RILEVATO.
The same page in German (a desktop Firefox window, countdown 00:55:09) and in Korean (a phone browser, countdown 00:56:17). The woman with the folder and the red title are report artwork added by our editors, not part of any page. 6 October 2026
This rewrite
No live copy opened; see the check above.
What the Kfx7-67 virus fake alert scammers want
What the page says, line by line
| What the page says | What is wrong with it |
|---|---|
| ATTENTION KFX7-67 VIRUS FOUND! | A web page cannot scan a phone: the browser keeps pages away from your apps and files. Every visitor is "found" infected, and Kfx7-67 is not a detection from any security product we could find. |
| Your personal data are compromised. Your private messages and all phone files can be violated. | The same sentence for everyone; no file, app or account is named. |
| It is advisable to immediately eliminate the virus. | Urgency. Google's Chrome help says to beware of "warnings about viruses or infected devices", especially if you have not recently used a virus scanner. |
| Step 1: Click on the button "eliminate the virus" and install the antivirus Security Antivirus 2017. | The whole page exists for this step. An antivirus offered by a web page, named after 2017 on a page we reported in 2021, is the bait. It does not say where the app comes from. |
| Step 2: Scan and remove all viruses found. TIME REMAINING 00:50:14 | The timer is a prop. The readings in our pictures differ (00:53:27, 00:55:09, 00:56:17): each counts down from about an hour, and we could verify no consequence at zero. |
| "www.website.com says:" before the message | The dialog is headed with the page's own address, www.limetvs.com in our picture. A real Android warning comes from the system or a security app you installed, never with a web address in its title. |
- Why it looks scary
- Red, a huge "VIRUS" word and a clock. Our old guide called this social engineering: the colour of danger and a timer create false urgency
- It changes language
- Our pictures show Italian, German and Korean. Our 2021 guide said it was spotted in the U.S., Germany, Russia, China, Italy, South Korea and other countries; we cannot confirm each
Other scare pages in our archive use the same recipe: a Windows Warning Alert, a "5 Billionth Search" giveaway, a pornographic-virus alert styled as Microsoft. Our old guide guessed "hundreds of thousands" of such sites; we have no count.
What tapping could cost
- High
An app you did not need
Our old guide said an app installed after such a prompt can steal passwords, logins and bank details, add other malware and cost money. We could not see the app, so this is the risk, not what we found.
- High
Money or card details
If the next page sells a subscription or asks for a card, the details go to whoever runs it. We have not seen that page. If you typed card details, call your bank.
- Medium
Permissions you give away
An app with Display over other apps can draw ads and fake alerts over whatever you are doing; Android's developer documentation lists that permission among the few that let an app start a screen from the background.
- Low
Only seeing the page
A warning on a web page changes nothing on the phone.
Why Kfx7-67 virus fake alert opens in your browser
How it reached you
| Route | What it means for you |
|---|---|
| An ad you tapped | Our 2021 guide said the alert usually follows a tap on a deceptive ad, in an app or on a random website. The ad's site is the cause. |
| An automatic redirect | Another site sends you to the page without a tap. If regular, one site, app or permission keeps sending you. |
| Adware on the device | Our old guide said frequent redirects can come from adware spread in software bundles, fake updates or bogus infection notices. Adware can show content over other apps. |
| A notification you allowed | A site you once allowed can send messages that open pages like this one. |
Addresses in the pictures of our 2021 report (defanged; checked 6 October 2026)
- us.30928[.]site (domain created 15 May 2026)
- www.limetvs[.]com (not registered)
How to spot the next one
Do
- Close the tab when a page says your phone has a virus, without tapping anything
- Install apps from Google Play, keep Play Protect on and read the permissions an app asks for first
- On a PC choose Advanced or Custom install and untick optional extras
- Read the address in a dialog's title: a warning headed with a web address is a web page
Don't
- Do not install anything offered by a warning in a browser
- Do not allow notifications from a site you do not know
- Do not install apps from third-party sources; Google Play is safer but no guarantee, so keep Play Protect on
- Do not use Quick or Recommended install on a PC without reading what it adds
If you called, paid or ran what the page said
On an Android phone: close it and check what is allowed
Steps follow Google's current Chrome and Play Protect help (read 6 October 2026); menu names differ between makers.
- 1
Close the page and tap nothing
Close the tab. If you closed it at once, nothing needs to be removed.
- 2
Remove the site's notification permission
In Chrome open the site, tap Page info at the top left, then Permissions > Notifications and turn Show notifications off. Google says that if there is no Permissions entry, the site has no notifications turned on.
- 3
Look through your apps
Settings > Apps: check the full list for what you do not remember installing; adware may use a normal-looking name. Under Special app access > Display over other apps switch off any app with no reason to draw over others.
- 4
Turn Play Protect on
Google Play Store > profile picture > Play Protect > Settings > Scan apps with Play Protect. Google says it checks apps from other sources and may deactivate or remove harmful ones.
- 5
Clear Chrome's data if the page keeps opening
Settings > Apps > Chrome > Storage & cache > Clear storage and Clear cache, as in our 2021 picture. This removes the browser's data on the phone, so you are signed out of sites.
- 6
If an app is the cause, use safe mode
Google's Chrome help: press and hold the power button, touch and hold Power off, confirm safe mode, then remove recently downloaded apps one by one, restarting normally after each to see whether the problem stops.
If you tapped the button, installed the app or typed details
- 1
Stop and close the page
Do not enter a phone number, card or password on any page it opened.
- 2
Uninstall what you installed
Settings > Apps, select the app that appeared after the alert and tap Uninstall. If the button is greyed out, the app may hold device admin rights: search Settings for Device admin apps, switch it off, then uninstall.
- 3
Run a Play Protect scan
Google Play > profile picture > Play Protect > scan. Our old guide said to scan at once after installing an unknown app from a scam site; this is the built-in route. Also search Settings for Install unknown apps and turn it off for the browser.
- 4
If you typed card details or a password
Call your bank or card issuer and ask them to block the card or dispute the charge. Change the password from another device, starting with your e-mail.
- 5
If nothing else helps
Back up photos and contacts, reset the phone to factory settings and reinstall only what you need from Google Play. It deletes everything not backed up, so it is the last step.
If you saw it on a PC, a Mac or another browser
Our old guide said it can show on Windows or Mac too and told readers to reset browsers; do that only if it keeps returning (menus read 5 October 2026).
| Browser | Remove the notification permission | Check extensions |
|---|---|---|
| Google Chrome | Settings > Privacy and security > Site Settings > Notifications. Remove the unknown site and block it under Pop-ups and redirects. | chrome://extensions: Remove any you did not add. |
| Microsoft Edge | Settings > Privacy, search, and services > Site permissions > All sites, set the site's Notifications to Block. | edge://extensions: remove any you did not add. |
| Mozilla Firefox | Click the permissions icon in the site's address bar and remove Send Notifications. | about:addons > Extensions: remove any you did not add. |
| Safari on a Mac | Apple menu > System Settings > Notifications, find the website, turn off Allow Notifications. | Safari > Settings > Extensions: uninstall the one you did not add. |
- 1
Windows 11 and 10
If something was installed after the alert: Start > Settings > Apps > Installed apps (Windows 10: Apps & features); uninstall what you did not choose.
- 2
A Mac
Finder > Applications: drag the app you did not install to the Trash. Internet Explorer is not covered (retired 2022).
How to get rid of the Kfx7-67 virus fake alert pop-up
The scan on the page is fake.
Close it, stop the notifications that open it, and dispute any payment you made.
Step 1: Close the page without touching its buttons
The warning is a web page, not Windows, so closing the browser ends it. If the page blocks the browser or goes full screen, press Esc first, then end the browser in Task Manager (Ctrl + Shift + Esc).
Start the browser again without restoring the session, and do not follow any instruction the page gave. On Windows 11 and Windows 10 the steps are identical.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 2: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Questions about Kfx7-67 virus fake alert
What is the Kfx7-67 virus?
The Kfx7-67 virus is a fake alert page, not a virus. A website shows a red screen headed "Kfx7-67 virus found", says your personal data and private messages are compromised and tells you to install an antivirus. The name is invented by the page; we found no detection name or file for it.
A web page cannot scan your phone, because the browser keeps websites away from your apps and files. Close the tab and tap nothing on it. Only if you installed something or typed details do you need the steps in this guide.
Is my phone infected if I saw the Kfx7-67 alert?
No, seeing the page does not mean your phone is infected. The page shows the same warning to every visitor, because it cannot see the phone. It usually opens after a tap on an ad or an automatic redirect, and closing it at once leaves nothing behind.
If you tapped the button, installed an app or allowed notifications, check those: the Android section lists the places to look, and a phone that keeps showing the page needs a closer look.
How do I remove Kfx7-67 from Android?
There is nothing named Kfx7-67 to remove; you remove what lets the page reach you. Close the tab, then in Chrome open the site, tap Page info, Permissions, Notifications and turn Show notifications off.
Check Settings, Apps for apps you did not install, and switch off Display over other apps for apps that do not need it. Turn on Scan apps with Play Protect in Google Play. If an app is the cause, Google says to restart in safe mode and remove recently downloaded apps one by one.
Why does the Kfx7-67 alert keep coming back?
It comes back because something keeps opening it. A site you allowed to send notifications can push links to the page, adware can redirect the browser, and one site that redirects you can do it alone. Our 2021 guide said many users reported a recurring alert.
Check the site's notification permission, the app list and Display over other apps, and clear Chrome's data if it still returns. We could not test a live copy, so we cannot say which one it is for you.
I pressed OK on the Kfx7-67 pop-up. What now?
Pressing OK only moves you to the red page; it installs nothing by itself. Close the tab and do not tap the eliminate-the-virus button. Then check Downloads and Settings, Apps for anything new.
If nothing is new, there is nothing to remove. If an app or file appeared, uninstall the app, run a Play Protect scan and do not enter any details on the pages it opens. We did not follow the page, so we cannot say what the button does today; treat it as install bait.
Can the Kfx7-67 virus show up on an iPhone, a PC or a Mac?
Yes, a web page can open in any browser. Our old guide said the alert mostly targets Android but can be seen on Windows or Mac too, and one of our pictures shows it in a desktop Firefox window.
We have no report of an iPhone version, but we did not test for one. On a computer the steps are the same in spirit:
- close the tab
- remove the site's notification permission
- any extension you did not add
The browser table lists the menu paths.
Should I clear the cache and data of Chrome?
Only if the page keeps returning. Our 2021 guide told readers to open Settings, Apps, Chrome, Storage & cache and clear both. Clear cache removes stored page files; Clear storage removes the browser's data on the phone, so you are signed out of sites.
Removing the single site's notification permission is gentler and is the step Google's Chrome help gives. If you only closed the page once, it left nothing on the phone, so there is nothing to clear.
Is the countdown timer on the Kfx7-67 page real?
No. The timer starts at about an hour in our pictures (00:53:27, 00:55:09 and 00:56:17) and exists to create false urgency, as our old guide said of the red colour and the clock.
Nothing is scanned while it runs, and we could verify no consequence at zero. A timer on any warning is a reason to close the page, not to hurry. Real security software does not give you an hour to install it from a web page.
Is Security Antivirus 2017 a real antivirus?
We found no source showing that the app named in the page is a real product, and we do not advise installing it. The text in our 2021 pictures reads "install the antivirus Security Antivirus 2017" and does not say where the app comes from.
A name with the year 2017 on a page we reported in 2021 suggests recycled text. Only a security app you chose yourself can report problems on a phone. If you installed it, uninstall it and run a Play Protect scan.
Will Fortect remove Kfx7-67 virus fake alert?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Kfx7-67 virus fake alert, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Google Chrome Help: Remove unwanted ads, pop-ups and malware (Android: safe mode, Play Protect, site notifications) (no longer online) (read October 6, 2026)
- Android Help: Use Google Play Protect to help keep your apps safe and your data private (no longer online) (read October 6, 2026)
- Android Developers: Activity security (background activity launch restrictions; SYSTEM_ALERT_WINDOW exception) (read October 6, 2026)
- FTC Consumer Advice: How To Spot, Avoid, and Report Tech Support Scams (read October 6, 2026)
- Verisign RDAP: limetvs.com (answer 404, not registered) (no longer online) (read October 6, 2026)
- RDAP via rdap.org: 30928.site (registered 15 May 2026) (read October 6, 2026)
- Our own guide: Kfx7-67 virus (4 June 2021) (read October 6, 2026)