Whenwem.online ads: what it is and how to remove it

Whenwem.online is a malicious website that attempts to make visitors allow notifications into their machines using fraud. Upon site entry, users are immediately presented with a notification that aggressively asks to press the "Allow" button.

Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.

Automatic

Get a free scan and check if your PC is infected.

Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.

If notifications from whenwem.online led you to download something, a free scan can check the PC for anything that came with it.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Do it yourself · free Remove Whenwem.online ads yourself 2 steps, about 6 minutes, no software needed.

Google ChromeMicrosoft EdgeMozilla FirefoxSafari (Mac)

Whenwem.online: whenwem online push notification virus
Whenwem.online as our 2021 report showed it.

Whenwem.online ads: summary

DistributionPush notifications are enabled soon after the permission in granted via the "Allow" button within a website prompt
NameWhenwem.online
TypePush notifications, scam, ads
IP address44.198.9.0
Symptomspop-up ads show up on the desktop frequently
DangersClicking on links that are embedded within the notification prompt, exploring the sites these links bring to, or downloading files can be dangerous – users can get infected with malware, suffer from financial losses, or disclose their private information to cybercriminals
Removal

Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.
Show 9 more facts
Detection namesNo Microsoft detection name is known
DamageNot recorded in the old report
Evidence4 write-ups by security sites; details still limited
Domainswhenwem.online
Ads shown asDesktop notifications
BrowsersChrome, Edge and Firefox
Installed on the PCNothing; a browser notification permission only
First seen23 August 2021
Facts checked6 October 2026

What the Whenwem.online ads ads look like

notification spam from a website

Click "Allow" to confirm that you are not a robot!

Is Whenwem.online ads dangerous?

From our report of Aug 2021 · not reviewed since

Whenwem.online ads will not leave you alone until you deny them via browser settings

Whenwem.online is a malicious website that attempts to make visitors allow notifications into their machines using fraud.

Upon site entry, users are immediately presented with a notification that aggressively asks to press the "Allow" button. If this action is fulfilled, users would soon start seeping intrusive pop-ups appearing directly on their screen, regardless of MS Edge, Google Chrome, Mozilla Firefox, or any other browser is used. You might also encounter the same behavior on your Android device or iPhone.

These pop-ups are nothing that can be counted as secure. While some of the links might lead to relatively safe websites which advertise various software (for example, VPN), there are plenty of pages that might be extremely dangerous. Here are a few examples of what you should never click on:

If you are here because you don't know how to stop the annoying pop-ups, you came to the right place.

  • Your computer is infected and you need to download "removal software";
  • You won an expensive gift - all you have to do is enter your personal information to receive it;
  • Get-rich-quick schemes: unrealistic job or investment offers;
  • Promotion of various dubious software (usually, potentially unwanted programs), etc.
  • Advertisements of gambling, adult-oriented, and similar high-risk sites.
Whenwem.online: whenwem online push notification virus
Whenwem.online in our 2021 report.
Whenwem.online: stop notifications on ie
Whenwem.online in our 2021 report.

From our report of Aug 2021 · not reviewed since

Why are you seeing the annoying ads?

Considering how intrusive the push notifications can be, many users might believe that their systems might be infected with a virus.

To make matters worse, many users don't know that they were tricked online. In any case, the situation can go both ways - there might or might not be a potentially unwanted program (or, in some cases, something more sinister) installed on your PC. It all depends on the situation, although you should never panic, as there is always a solution available.

In most cases, users are redirected to Whenwem.online or a similar website by accident. This typically happens when a link is clicked on another website or due to the URL redirection. Such behavior is typical to websites of dubious origin, including torrents, gambling, and similar sites. In fact, you might be redirected to several other pages before you land on this one.

Alternatively, you could have ended up on this malicious website due to adware - a type of potentially unwanted program which spreads using unfair tactics and focuses on delivering ads to users. Some more aggressive adware might also engage in browser redirects. Thus, if you see banners, deals, offers, coupons, in-text links, and similar ads frequently, you should definitely check your system for adware.

The easiest way to eliminate unwanted or malicious software from your system is by scanning it with powerful anti-virus software.

Alternatively, you can also refer to our instructions at the bottom of this article in order to delete PUPs manually. This choice is rather risky because some adware might be difficult to find and remove. Finally, you should also take care of your web browsers; cleaning them might take a while, so you could instead employ to do that for you automatically.

From our report of Aug 2021 · not reviewed since

Scam explained

Once you land on the destination page, the scam begins to take its shape.

For the scheme to work, crooks need to convince visitors that what they are clicking on is not what it actually is - and they use various tricks for that.

It is worth noting that the pop-ups themselves are not malicious; it is the contents of the notifications that frequently are. The feature is legitimate and is used by many websites around the internet. Those who are willing to receive information from the desired website can do so by allowing it to send them notifications.

However, when it comes to scam websites, everything changes, as users are not provided a fair explanation about what they actually agree to. Here is one of the examples or a message you might encounter upon accessing the Whenwem.online site:

You probably heard of captcha codes before (and struggled with those) - they are used to protect websites from being attacked by bots or from DDoS attacks. This feature is so frequently used that it is recognizable straight away. Threat actors want to make an impression that this is a simple verification process, while in reality, it is what it is - permission for the website to show notifications.

Scammers also use various other statements to trick people, including showing a fake video still, saying that the only way to close the window is by pressing the "Allow" button, etc. These tactics are particularly common and used by many similar malicious sites, including Lazyovertime.com, Eaddressor.top, Allhotfeed.com, and many others.

Whenwem.online: whenwem online virus scam
Whenwem.online in our 2021 report.

From our report of Aug 2021 · not reviewed since

How to deny Whenwem.online permission to show you ads

If you are seeing Whenwem.online ads regularly, you can remove them quite easily.

All you have to do is access the settings panel of your web browser and block the permission for the site to send you notifications.

Google Chrome (desktop):

Google Chrome (Android):

MS Edge (Chromium):

In some cases, problems might not go away even after performing these steps above. If that is the case for you, it is likely that there is an adware app installed on your system, and you knew nothing of it.

As we already mentioned, removing PUPs manually might be rather difficult, so you should instead rely on security software - it can also check whether malware is running in the background. Also, don't forget to clean your web browsers.

  • Open Google Chrome browser and go to Menu > Settings.
  • Locate Privacy and security section and pick Site Settings > Notifications.
  • Look at the Allow section and look for a suspicious URL.
  • Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
  • Open Google Chrome and tap on Settings (three vertical dots).
  • Select Notifications.
  • Locate the unwanted URL and toggle the button to the left (Off setting).
  • Open Mozilla Firefox and go to Menu > Options.
  • Click on Privacy & Security section.
  • Under Permissions, you should be able to see Notifications. Click Settings button next to it.
  • In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
  • Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
  • Click on Safari > Preferences...
  • Go to Websites tab and, under General, select Notifications.
  • Select the web address in question, click the drop-down menu and select Deny.
  • Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
  • Select Settings and then go to Advanced.
  • Under Website permissions, pick Manage permissions and select the URL in question.
  • Toggle the switch to the left to turn notifications off on Microsoft Edge.
  • Open Microsoft Edge, and go to Settings.
  • Select Site permissions.
  • Go to Notifications on the right.
  • Under Allow, you will find the unwanted entry.
  • Click on More actions and select Block.
  • Open Internet Explorer, and click on the Gear icon at the top-right on the window.
  • Select Internet options and go to Privacy tab.
  • In the Pop-up Blocker section, click on Settings.
  • Locate web address in question under Allowed sites and pick Remove.

From our report of Aug 2021 · not reviewed since

More from our earlier report on Whenwem.online

  • Redirects and ads might indicate adware infection, so you should check your system with anti-malware.

Check your browser and PC

  • Address: whenwem.online

How to remove Whenwem.online ads

How to stop Whenwem.online notifications

Do this in every browser you use, and in every profile inside it: each keeps its own list of sites allowed to send notifications.

Nothing has to be uninstalled for the notifications themselves.

Which browser shows the ads?

  1. Step 1: Remove whenwem.online from Chrome's notification list

    Open More (the three dots) > Settings > Privacy and security > Site settings > Notifications, or paste chrome://settings/content/notifications into the address bar.

    Under Allowed to send notifications, open the menu next to whenwem.online and choose Remove or Block, and do the same for any other address you do not recognise.

    Next to Not allowed to send notifications, click Add and enter whenwem.online, so the site cannot ask again. The menus are the same in Chrome on Windows 11 and Windows 10, and each Chrome profile keeps its own list.

    Chrome Settings, Notifications page with the allowed and not allowed site lists
    Chrome on Windows 11: Settings > Privacy and security > Site settings > Notifications.

    Full procedure with screenshots: Stop website notifications and pop-ups

Instructions for Google Chrome

Remove from Google Chrome

Delete malicious extensions from Google Chrome:

  1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
  2. In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.Remove extensions from Chrome

Clear cache and web data from Chrome:

  1. Click on Menu and pick Settings.
  2. Under Privacy and security, select Clear browsing data.
  3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
  4. Click Clear data.Clear cache and web data from Chrome

Change your homepage:

  1. Click menu and choose Settings.
  2. Look for a suspicious site in the On startup section.
  3. Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

  1. Click on Menu and select Settings.
  2. In the Settings, scroll down and click Advanced.
  3. Scroll down and locate Reset and clean up section.
  4. Now click Restore settings to their original defaults.
  5. Confirm with Reset settings.Reset Chrome 2

Then, whichever browser you use

  1. Step 2: Scan the PC if you downloaded anything from the ads

    Most people who only saw the notifications can skip this step. If a notification or the page it opened made you download or run a file, delete the file and run a full scan, then a Microsoft Defender Offline scan.

    In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.

    Windows Security Scan options with Microsoft Defender Antivirus offline scan selected
    Windows 11: Windows Security > Virus & threat protection > Scan options.

    Full procedure with screenshots: Run a Microsoft Defender Offline scan

Choose a proper web browser and improve your safety with a VPN tool

Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online.

One of the basic means to add a layer of security - choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features.

However, if you want true anonymity, we suggest you employ a powerful VPN - it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.

Lost your files? Use data recovery software

While some files located on any computer are replaceable or useless, others can be extremely valuable.

Family photos, work documents, school projects - these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur:

  • power cuts
  • Blue Screen of Death errors
  • hardware failures
  • crypto-malware attack
  • even accidental deletion

To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, can be your only hope to retrieve your invaluable files.

Questions about Whenwem.online ads

whenwem.online keeps sending notifications. Is it a virus?

No. Notifications from whenwem.online come from a permission stored in the browser, not from a program installed in Windows. Someone clicked Allow on a prompt from that site, usually without realising what it meant, and the site now sends ads through the browser's notification system.

Antivirus scans often find nothing because there is nothing to find on the disk. Removing whenwem.online from the browser's list of allowed sites stops the messages for good. A scan is still useful if you clicked a notification and downloaded or ran something from the page it opened, because those downloads can be unwanted programs.

Did a notification from whenwem.online infect my computer?

A notification cannot infect a PC. It is a short text with a link that the browser displays. Clicking it opens a page, and a page cannot install anything unless you agree to a download and run the file.

So the answer depends on what you did after clicking. Looked and closed: you are fine. Downloaded but did not open: delete the file.

Opened a downloaded file: uninstall what it added and scan the PC. Typed card or login details: contact the bank and change the password. In every case, remove whenwem.online from the browser's allowed notifications so the messages stop.

What is Whenwem.online?

Whenwem.online is a push-notification spam site, a kind of adware. It earns money by showing desktop notifications, and each view, click or redirect pays whoever runs it. It is not something people usually choose; it arrives through a free download, a fake button or a misleading prompt.

Whenwem.online does not encrypt files or take control of Windows, but its ads are sold to anyone, including scam operators, so they can lead to fake virus warnings and unwanted downloads. The steps in this guide remove it from Windows and from each browser.

Why does whenwem.online keep showing up?

There are two possible reasons. If it appears as desktop notifications, a browser on this PC was given permission to receive them from whenwem.online, usually through a misleading prompt. That permission stays until you remove it in the browser's site settings.

If it appears as tabs or redirects, an ad on a site you visit is opening it, or an extension or program on the PC is. Test a private window: if whenwem.online never appears there, an extension is the likely cause. The plan above covers each case.

Do I have to change settings in every browser?

Only in the browsers that allowed whenwem.online, but checking all of them takes a minute and is worth it. We saw the notifications in Chrome, Edge and Firefox. Chrome and Edge keep their notification lists under site settings, and Firefox under Privacy & Security > Permissions.

Remove whenwem.online and any other unfamiliar site from each list, then turn off new notification requests if you do not need them. Remember that every browser profile has its own list, so a second profile can keep the messages coming after you clean the first.

Are the pop-ups I see really from Whenwem.online?

Compare them with the details in the table above. Whenwem.online produces desktop notifications, and the clearest sign of it is notifications from whenwem.online. Other adware looks similar, so check the name of the sending site at the bottom of a notification, the address in the tab that opened, or the newest entries on the extensions page.

If those match, this guide fits. If you see a different name, the same kind of steps apply, but remove the item you actually find rather than guessing.

Is it safe to click Block or Allow on a notification prompt?

Clicking Block is safe; it only tells the browser not to show notifications from that site. Clicking Allow is not dangerous to your files either, but it gives the site a channel to your desktop that spam sites abuse at once.

The prompt itself is part of the browser, so you can trust its buttons. What you cannot trust is the text on the page around it. If a page explains why you must click Allow, choose Block or close the tab.

My scan found nothing, but the ads continue. Why?

Because the source may not be a file a scanner looks for. Browser notifications are a permission stored in the browser, and many adware extensions are not flagged because they come from an official store.

Some ad-supported programs are only reported if you enable detection of potentially unwanted apps. So a clean scan does not mean the job is done. Check each browser's notification permissions and extension list by hand, and turn on Potentially unwanted app blocking in Windows Security before scanning again.

I let a "support technician" from an ad connect to my PC. What should I do?

Act quickly but calmly. Disconnect the PC from the internet first, so the connection ends. Uninstall the remote access tool they asked you to install and check Installed apps for anything else added during the call.

Run a Microsoft Defender full scan and offline scan. From another device, change your e-mail and banking passwords and sign out of all sessions.

If you paid by card, bank transfer or gift card, contact your bank or the card issuer immediately, and report the scam to the police. Do not answer if they call back.

Will Fortect remove Whenwem.online?

No program removes Whenwem.online itself, because there is nothing on the PC to remove: the notifications come through a permission saved in the browser, and only the browser's settings take it away, as the steps above show.

What Fortect can do is check the rest of Windows. Its free scan looks for malware, unwanted programs and damaged system files, which is useful if you clicked the ads, downloaded something from the pages they opened, or are not sure what else changed on the PC.

If the scan finds nothing and the notifications stopped after you removed the permission, this problem is solved. Use Microsoft Defender as a second opinion whenever you have downloaded files from pages like these.

Sources

  1. Wikipedia: Get-rich-quick scheme (read October 6, 2026)
  2. Google Chrome Help: Use notifications to get alerts (no longer online) (read October 6, 2026)
  3. FTC: How to recognize, remove and avoid malware (read October 6, 2026)
  4. Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
  5. Microsoft Learn: How Microsoft names malware (read October 6, 2026)

More removal guides

Remove VideoBox virus

What should I know about VideoBox player? VideoBox virus is advertised as a free media player application that is able to open various video formats, download videos from Arabian versionAdwareMedium riskJake Doevan ·

Remove SaveFrom.net helper

SaveFrom.net Helper is a YouTube downloading service that might show intrusive ads and disrupt daily browsing sessions SafeForm Helper is a potentially unwanted program that might be used to download andAdwareMedium riskUgnius Kiguolis ·

Remove Google Lead Services

Google Lead Services is a bogus online advertising platform which has nothing in common with Google Google Lead Services, also known as GoogleLeadService.com, is fraudulent advertising platform which might lookAdwareMedium riskLucia Danes ·

Remove Stabilizeconnection.co.in ads

Stabilizeconnection.co.in is a push notification scam website you should not believe in Stabilizeconnection.co.in is a deceptive website that can be seen by users while browsing using Chrome, Firefox, Edge, orAdwareMedium riskUgnius Kiguolis ·

Questions and experiences: Whenwem.online ads

Still seeing it, or found something we did not cover? Ask here: members and our editors answer. Reading is open; writing needs a free account.

0 comments

…

5,516 members already hereReading, writing, commenting and voting. 0 verified · 241 joined this year