Virus disguised as System Settings Notifications

[Canadia69]

For the last 3 days I keep getting notifications that look like system settings notifications (photo attached). I was trying to download some free class notes from a couple of shady websites, I think thats what started it.

I thought it might be a Chrome extensions so I turned off Chrome and Safari notifications but the issue still persists. I also ran cleanMyMac malware scanner but it didnt find anything. I tried looking online but didnt see anyone that had this issue.

I dont know what to try at this point other than a restoring my mac. But before I do that, anyone as something to suggest? If theres already a thread about this issue please refer it.

 

[iStorm]

Do you have any suspicious profiles installed? They can be found in System Settings -> Privacy & Security -> Profiles. (Most people shouldn’t have any profiles.)

Any suspicious apps in the Applications folder?

 

[TorbenIbsen]

For the last 3 days I keep getting notifications that look like system settings notifications (photo attached). I was trying to download some free class notes from a couple of shady websites, I think thats what started it.

I thought it might be a Chrome extensions so I turned off Chrome and Safari notifications but the issue still persists. I also ran cleanMyMac malware scanner but it didnt find anything. I tried looking online but didnt see anyone that had this issue.

I dont know what to try at this point other than a restoring my mac. But

before I do that, anyone as something to suggest? If theres already a thread about this issue please refer it.

CleanMyMac (which I also use) scans for "malware" which is registered in their database. But you should also use an anti-virus app like Bitdefender (which I also use). You can also check with Malwarebytes which may. have different "malware" registered in their database. - I think thay Google would send you mail if they detected someting wrong. And the bank thing sounds strange too. It does not sound probable that someone would attempt to steal a specific amount.

So you definitely did download some virus from those shady websites. Don't react to those notifications directly but get an antivirus app to solve the problem for you. And then remember why not to download stuff from shady websites.

 

[bogdanw]

This kind of spam was frequent on iPhones a few years ago and it was done by adding a Calendar subscription.

 

[VineRider]

Search for Intego in the Mac App Store. They have a free malware scanner that may help.

 

[stradify]

I was trying to download some free class notes from a couple of shady websites, I think thats what started it.

Agreed. Contact Apple Help and see if they can sort it out for you. I doubt reinstalling the OS will help as it's an SSV i.e. a Signed Sealed Volume. If they altered that, they wouldn't be asking you to click on the notifications as they'd likely already have control of your computer. The Data Volume is more likely where they put the malware. You'll need to find the malware to uninstall it. Try running KnockKnock. Malware installs itself persistently, to ensure it is automatically executed each time a computer is restarted. KnockKnock uncovers persistently installed software in order to reveal such malware generically. Here's a link: https://objective-see.org/products/knockknock.html

 

[bogdanw]

Search for Intego in the Mac App Store. They have a free malware scanner that may help.

Good recommendation - Intego VirusBarrier Scanner https://apps.apple.com/app/intego-virusbarrier-scanner/id1200445649
Also free - Bitdefender Virus Scanner https://apps.apple.com/app/bitdefender-virus-scanner/id500154009

 

[MacGizmo]

OMG, STOP with all this about virus scanners, restoring from backup, Apple Store, spam and such. Calm and clear thinking are generally the best cure in these cases.

I had the exact same thing happen about a week ago. I noticed it right after installing a tiny piece of software off GitHub. My first thought was malware, but since it was a notification, I decided to start there – sure enough, I found the problem and fixed it with not so much as a restart.

Just go into your Safari Notification preferences (Safari > Settings > Websites > Notifications) and delete it from the list. It will be the one that shows the System Settings icon but doesn't have an actual name (probably the first one in the list).

 

[bogdanw]

OMG, STOP with all this about virus scanners, restoring from backup and such. I had the same thing happen about a week ago.
Just go into your Safari Notification preferences and delete it from the list (turning off Notifications doesn't do the trick).

Turning off Safari notifications does not turn off Safari notifications?
I call it spam, not malware. #4
Since the OP did not provide an update, the discussion evolved.
If you think it’s off-topic, report it.

 

[MacGizmo]

Turning off Safari notifications does not turn off Safari notifications?
I call it spam, not malware. #4
Since the OP did not provide an update, the discussion evolved.
If you think it’s off-topic, report it.

Turning off Safari notifications DOES turn them off. The problem is that it turns them ALL off, which is throwing the baby out with the bath water.

My comments are directed at everyone, not just you. You can call it spam, but that's just the end-result of the notification settings. Call it virus, call it spam, or anything else you might think of. This is simply a case of some website adding itself to your browser notification list—so technically speaking, it's doing exactly what it's supposed to do. Malware is probably a good description for what this is. And the "spam" is the "scam" – in that when you click any one of those notifications, you're taken to a website trying to charge you money to fix the problem via software (which probably IS malware).

The OP didn't post a response, but I just offered the solution a few hours ago (in the middle of the night, no less). He may not ever respond, which would be frustrating for the people currently posting in this thread, but it doesn't change what it is or the solution, for future readers who may come across this issue.

I don't think your comment, or anyone else's here, is "off-topic" – they're just jumping to conclusions and offering solutions that are completely unnecessary. It's not a virus, it doesn't require an OS re-insall, it certainly doesn't require taking the Mac into the Apple Store for repair/diagnostics, etc. It simply needs to be clicked in a list and a delete button pressed.

The reason I'm 100% certain of everything I've said is that I literally just had this exact same thing happen (see screenshot below) and I deleted the one Safari Notification entry and it fixed the problem immediately and hasn't happened since. I also did a thorough diagnostic on the Mac and found absolutely nothing new on the Mac except that Notification compared to before that notification got there.

The only question is how it got in the list to begin with. Websites can do a lot with javascript and other web tech, or it could just be that I (and the OP) weren't paying attention when a nefarious pop-up asked for permission to allow notifications, or any number of other ways.

Here's my glorious Notification list from this past week:

 

[NEPOBABY]

Turning off Safari notifications DOES turn them off. The problem is that it turns them ALL off, which is throwing the baby out with the bath water.

My comments are directed at everyone, not just you. You can call it spam, but that's just the end-result of the notification settings. Call it virus, call it spam, or anything else you might think of. This is simply a case of some website adding itself to your browser notification list—so technically speaking, it's doing exactly what it's supposed to do. Malware is probably a good description for what this is. And the "spam" is the "scam" – in that when you click any one of those notifications, you're taken to a website trying to charge you money to fix the problem via software (which probably IS malware).

The OP didn't post a response, but I just offered the solution a few hours ago (in the middle of the night, no less). He may not ever respond, which would be frustrating for the people currently posting in this thread, but it doesn't change what it is or the solution, for future readers who may come across this issue.

I don't think your comment, or anyone else's here, is "off-topic" – they're just jumping to conclusions and offering solutions that are completely unnecessary. It's not a virus, it doesn't require an OS re-insall, it certainly doesn't require taking the Mac into the Apple Store for repair/diagnostics, etc. It simply needs to be clicked in a list and a delete button pressed.

The reason I'm 100% certain of everything I've said is that I literally just had this exact same thing happen (see screenshot below) and I deleted the one Safari Notification entry and it fixed the problem immediately and hasn't happened since. I also did a thorough diagnostic on the Mac and found absolutely nothing new on the Mac except that Notification compared to before that notification got there.

The only question is how it got in the list to begin with. Websites can do a lot with javascript and other web tech, or it could just be that I (and the OP) weren't paying attention when a nefarious pop-up asked for permission to allow notifications, or any number of other ways.

Here's my glorious Notification list from this past week:

View attachment 2146075

I don’t care what anyone says above but if my system was doing that I would clean install the system completely and restore an older version of my data before the infection. I would also double check the security of all online services And change every password.

I treat my systems just like my body. Protect this stuff seriously and if it gets infected don’t pretend it is all fine. Clean it all out and protect.

Don’t visit dodgy sites and don’t be tempted by any form of piracy.

 

[Sciuriware]

I don’t care what anyone says above but if my system was doing that I would clean install the system completely and restore an older version of my data before the infection. I would also double check the security of all online services And change every password.

I treat my systems just like my body. Protect this stuff seriously and if it gets infected don’t pretend it is all fine. Clean it all out and protect.

Don’t visit dodgy sites and don’t be tempted by any form of piracy.

Fully agreed: stay clean and healthy in 2023 and thereafter.
;JOOP!

 

[rpmurray]

Turning off Safari notifications DOES turn them off. The problem is that it turns them ALL off, which is throwing the baby out with the bath water.

I always turn off Safari notifications. I haven't come upon any use case where they are useful for anything other than spam.

 

[bogdanw]

I always turn off Safari notifications. I haven't come upon any use case where they are useful for anything other than spam.

ditto

 

[genexx]

Sometimes it is enough to just delete cache and cookies in Safari........

 

[Queen6]

Agreed. Contact Apple Help and see if they can sort it out for you. I doubt reinstalling the OS will help as it's an SSV i.e. a Signed Sealed Volume. If they altered that, they wouldn't be asking you to click on the notifications as they'd likely already have control of your computer. The Data Volume is more likely where they put the malware. You'll need to find the malware to uninstall it. Try running KnockKnock. Malware installs itself persistently, to ensure it is automatically executed each time a computer is restarted. KnockKnock uncovers persistently installed software in order to reveal such malware generically. Here's a link: https://objective-see.org/products/knockknock.html

Bitdefender is free on the Apple Mac Store for the manual AV scanner and KnockKnock can be linked to Virus Total, with over 70 AV engines. Solid advice given the small size of the apps and the differing types of detection and costs nothing to run the scans.

Objective See also offers BlockBlock which stops all persistent installs, but needs a little knowledge.

Q-6

 

[orionquest]

Sounds like an over reaction to this situation. @MacGizmo has identified it correctly.
Notifications on the Mac seem pretty much useless. I have it switched off completely the only 1 I am interested in are emails.
Also I never use Safari. Maybe another broswer will be less invasive or tied into the system doing without these annoyances.

 

[kitKAC]

Sounds like an over reaction to this situation. @MacGizmo has identified it correctly.
Notifications on the Mac seem pretty much useless. I have it switched off completely the only 1 I am interested in are emails.
Also I never use Safari. Maybe another broswer will be less invasive or tied into the system doing without these annoyances.

Any browser that supports notifications has this problem, I've seen it enough with Chrome at work (on Mac and PC).

 

[Mac Hammer Fan]

What's wrong with Malwarebytes? It's the only thing I have installed.

 

[Ruggy]

Are they actually system notifications though?
They look like some sort of phishing scam with a system icon pasted into them.
System never tells you things like that and I don't they they actually have the system icon in them.

 

[ajf.350d]

This may be from Chrome, just not an extension.
See if these settings are in MacOS (the original is for Windows)

• Open the Chrome app.
• To the right of the address bar, tap More ⋮ > Settings.
• Tap Site Settings > Notifications.
• Tap the suspicious website, then tap either Block or Remove.

 

[Takeo Apple]

I guess it’s been resolved by deleting website notifications lol.

Malware on Mac does not exist to the extend that it needs a virus scanner. What it needs is to never type in your admin password to grant permissions to unknown software from the internet you cannot trust. (Mostly illegal copies to be fair)

 

[MacGizmo]

Are they actually system notifications though?
They look like some sort of phishing scam with a system icon pasted into them.
System never tells you things like that and I don't they they actually have the system icon in them.

That's exactly what they are. They're notifications from a website, not the system. And they all lead to a site offering software to "fix" problems (obviously a scam).

 

[bogdanw]

Malware on Mac does not exist to the extend that it needs a virus scanner.

"The Mac Malware of 2022 👾 A comprehensive analysis of the year's new malware"
https://objective-see.org/blog/blog_0x71.html
"Apple Security and Privacy in 2022: The Year in Review"
https://www.intego.com/mac-security-blog/apple-security-and-privacy-in-2022-the-year-in-review/

 

[XY43137]

Turning off Safari notifications DOES turn them off. The problem is that it turns them ALL off, which is throwing the baby out with the bath water.

My comments are directed at everyone, not just you. You can call it spam, but that's just the end-result of the notification settings. Call it virus, call it spam, or anything else you might think of. This is simply a case of some website adding itself to your browser notification list—so technically speaking, it's doing exactly what it's supposed to do. Malware is probably a good description for what this is. And the "spam" is the "scam" – in that when you click any one of those notifications, you're taken to a website trying to charge you money to fix the problem via software (which probably IS malware).

The OP didn't post a response, but I just offered the solution a few hours ago (in the middle of the night, no less). He may not ever respond, which would be frustrating for the people currently posting in this thread, but it doesn't change what it is or the solution, for future readers who may come across this issue.

I don't think your comment, or anyone else's here, is "off-topic" – they're just jumping to conclusions and offering solutions that are completely unnecessary. It's not a virus, it doesn't require an OS re-insall, it certainly doesn't require taking the Mac into the Apple Store for repair/diagnostics, etc. It simply needs to be clicked in a list and a delete button pressed.

The reason I'm 100% certain of everything I've said is that I literally just had this exact same thing happen (see screenshot below) and I deleted the one Safari Notification entry and it fixed the problem immediately and hasn't happened since. I also did a thorough diagnostic on the Mac and found absolutely nothing new on the Mac except that Notification compared to before that notification got there.

The only question is how it got in the list to begin with. Websites can do a lot with javascript and other web tech, or it could just be that I (and the OP) weren't paying attention when a nefarious pop-up asked for permission to allow notifications, or any number of other ways.

Here's my glorious Notification list from this past week:

View attachment 2146075

DUDE! AWESOME! THANK YOU SO MUCH FOR THE SOLUTION! I FOUND IT!
Any idea what it may have come from? Anyway, I cannot thank you enough fore the education and solution.

Thank you again very much.