Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

False virus pop-ups, not on a browser

I keep getting pop-up notifications that appear to originate from settings. Screenshots of two examples are attached. Other notifications read things like "Someone is trying to steal 410 dollars from your Bank of America account" (I don't have a BofA account). These notifications sometimes appear on the screen before I've logged in, and disappear once I've unlocked my computer.


I am running Malwarebytes (installed after the notifications started appearing), and nothing suspicious is identified. I've also looked in my applications folder (following these instructions) and found no suspicious files. I've uninstalled and reinstalled browsers, also with no luck.


Apple store told me to update. I've done that, and notifications keep appearing.


Help!

MacBook Air

Posted on Jan 13, 2023 12:57 PM

Reply
Question marked as Best reply

Posted on Jan 13, 2023 3:18 PM

Check your Safari settings. Go to Safari > Settings > Websites > Notifications


Are they any sites listed that have authorization to display notifications? You can safely delete all websites in this list. Websites will then ask again and you can deny them this time.


I don't see any malware or scam ware in your EtreCheck report. It does show two Safari notifications. In the past, those would have Safari icons when they display. But lately it seems like websites are able to specify their own icons. It makes sense that scam sites would use the settings icon to try to trick you.

11 replies
Question marked as Best reply

Jan 13, 2023 3:18 PM in response to umeboshi_onigiri

Check your Safari settings. Go to Safari > Settings > Websites > Notifications


Are they any sites listed that have authorization to display notifications? You can safely delete all websites in this list. Websites will then ask again and you can deny them this time.


I don't see any malware or scam ware in your EtreCheck report. It does show two Safari notifications. In the past, those would have Safari icons when they display. But lately it seems like websites are able to specify their own icons. It makes sense that scam sites would use the settings icon to try to trick you.

Jan 13, 2023 5:30 PM in response to etresoft

Re: Kurt, There was nothing in Allow in Background that I didn't recognize. It was just Google updater and MalwareBytes.


Re: etresoft, Safari settings showed what I assume was Ask You (it didn't have a name but used the same settings-looking icon) in Notifications. I was able to remove it from there. Yay!


Also, more good news: I have stopped getting the notifications after getting them pretty much non-stop for nearly the past week. They stopped after I turned off notificactions as muguy recomended.


Thanks, Kurt, etresoft, Old Toad and muguy!

Jan 13, 2023 7:24 PM in response to umeboshi_onigiri

Excerpted from Effective defenses against malware and other threats - Apple Community:


Beware spontaneously appearing, unsolicited popups demanding immediate action. Think before you click.

  • ...
  • The same goes for website Notifications — attention-getting banners that appear at the top right corner of your screen. Safari gives you a great degree of control over them: Customize website notifications in Safari on Mac. Most of those Notifications are simply annoying, but some are intended to frighten and deceive you into installing something nefarious.


etresoft has the answer.


If a website asks to send Notifications, you should reflexively "just say no."

Jan 13, 2023 1:33 PM in response to umeboshi_onigiri

Download and run Etrecheck.  Copy and paste the results into your reply. Etrecheck is a diagnostic tool that was developed by one of the most respected users here in the ASC and recommended by Apple Support  to provide a snapshot of the system and help identify the more obvious culprits that can adversely affect a Mac's performance.


Copy the report



and use the Additional Text button to paste the report in your reply.



Then we can evaluate the report to see if we can determine the cause of the popups.



Jan 13, 2023 1:55 PM in response to umeboshi_onigiri

Ask You is malicious adware. It got installed by you when you installed something else. Possibly from a legitimate site that offers downloads of all kinds of demo, shareware and free software. Or, it came along with illegal, cracked software you may have installed.


No matter how it got there, it can be removed. It's just a matter of finding it. That MalwareBytes came up empty suggests it's fairly new. The only reference I found to it is from November 12th of last year.


Follow Old Toad's recommendation to run EtreCheck and post its results here.

False virus pop-ups, not on a browser

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.