Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Canadia69

macrumors regular
Original poster
Sep 11, 2016
186
72
For the last 3 days I keep getting notifications that look like system settings notifications (photo attached). I was trying to download some free class notes from a couple of shady websites, I think thats what started it.

I thought it might be a Chrome extensions so I turned off Chrome and Safari notifications but the issue still persists. I also ran cleanMyMac malware scanner but it didnt find anything. I tried looking online but didnt see anyone that had this issue.

I dont know what to try at this point other than a restoring my mac. But before I do that, anyone as something to suggest? If theres already a thread about this issue please refer it.
 

Attachments

  • Screenshot 2023-01-20 at 10.35.07 PM.png
    Screenshot 2023-01-20 at 10.35.07 PM.png
    359.3 KB · Views: 174

iStorm

macrumors 6502a
Sep 18, 2012
932
1,235
Do you have any suspicious profiles installed? They can be found in System Settings -> Privacy & Security -> Profiles. (Most people shouldn’t have any profiles.)

Any suspicious apps in the Applications folder?
 

TorbenIbsen

macrumors regular
Feb 22, 2021
102
66
For the last 3 days I keep getting notifications that look like system settings notifications (photo attached). I was trying to download some free class notes from a couple of shady websites, I think thats what started it.

I thought it might be a Chrome extensions so I turned off Chrome and Safari notifications but the issue still persists. I also ran cleanMyMac malware scanner but it didnt find anything. I tried looking online but didnt see anyone that had this issue.

I dont know what to try at this point other than a restoring my mac. But

before I do that, anyone as something to suggest? If theres already a thread about this issue please refer it.
CleanMyMac (which I also use) scans for "malware" which is registered in their database. But you should also use an anti-virus app like Bitdefender (which I also use). You can also check with Malwarebytes which may. have different "malware" registered in their database. - I think thay Google would send you mail if they detected someting wrong. And the bank thing sounds strange too. It does not sound probable that someone would attempt to steal a specific amount.

So you definitely did download some virus from those shady websites. Don't react to those notifications directly but get an antivirus app to solve the problem for you. And then remember why not to download stuff from shady websites.
 

stradify

macrumors regular
Jul 4, 2015
177
77
USA
I was trying to download some free class notes from a couple of shady websites, I think thats what started it.
Agreed. Contact Apple Help and see if they can sort it out for you. I doubt reinstalling the OS will help as it's an SSV i.e. a Signed Sealed Volume. If they altered that, they wouldn't be asking you to click on the notifications as they'd likely already have control of your computer. The Data Volume is more likely where they put the malware. You'll need to find the malware to uninstall it. Try running KnockKnock. Malware installs itself persistently, to ensure it is automatically executed each time a computer is restarted. KnockKnock uncovers persistently installed software in order to reveal such malware generically. Here's a link: https://objective-see.org/products/knockknock.html
 

MacGizmo

macrumors 68030
Apr 27, 2003
2,565
1,861
Arizona
OMG, STOP with all this about virus scanners, restoring from backup, Apple Store, spam and such. Calm and clear thinking are generally the best cure in these cases.

I had the exact same thing happen about a week ago. I noticed it right after installing a tiny piece of software off GitHub. My first thought was malware, but since it was a notification, I decided to start there – sure enough, I found the problem and fixed it with not so much as a restart.

Just go into your Safari Notification preferences (Safari > Settings > Websites > Notifications) and delete it from the list. It will be the one that shows the System Settings icon but doesn't have an actual name (probably the first one in the list).
 
Last edited:

bogdanw

macrumors 68040
Mar 10, 2009
3,013
1,416
OMG, STOP with all this about virus scanners, restoring from backup and such. I had the same thing happen about a week ago.
Just go into your Safari Notification preferences and delete it from the list (turning off Notifications doesn't do the trick).
Turning off Safari notifications does not turn off Safari notifications?
I call it spam, not malware. #4
Since the OP did not provide an update, the discussion evolved.
If you think it’s off-topic, report it.
 

MacGizmo

macrumors 68030
Apr 27, 2003
2,565
1,861
Arizona
Turning off Safari notifications does not turn off Safari notifications?
I call it spam, not malware. #4
Since the OP did not provide an update, the discussion evolved.
If you think it’s off-topic, report it.
Turning off Safari notifications DOES turn them off. The problem is that it turns them ALL off, which is throwing the baby out with the bath water.

My comments are directed at everyone, not just you. You can call it spam, but that's just the end-result of the notification settings. Call it virus, call it spam, or anything else you might think of. This is simply a case of some website adding itself to your browser notification list—so technically speaking, it's doing exactly what it's supposed to do. Malware is probably a good description for what this is. And the "spam" is the "scam" – in that when you click any one of those notifications, you're taken to a website trying to charge you money to fix the problem via software (which probably IS malware).

The OP didn't post a response, but I just offered the solution a few hours ago (in the middle of the night, no less). He may not ever respond, which would be frustrating for the people currently posting in this thread, but it doesn't change what it is or the solution, for future readers who may come across this issue.

I don't think your comment, or anyone else's here, is "off-topic" – they're just jumping to conclusions and offering solutions that are completely unnecessary. It's not a virus, it doesn't require an OS re-insall, it certainly doesn't require taking the Mac into the Apple Store for repair/diagnostics, etc. It simply needs to be clicked in a list and a delete button pressed.

The reason I'm 100% certain of everything I've said is that I literally just had this exact same thing happen (see screenshot below) and I deleted the one Safari Notification entry and it fixed the problem immediately and hasn't happened since. I also did a thorough diagnostic on the Mac and found absolutely nothing new on the Mac except that Notification compared to before that notification got there.

The only question is how it got in the list to begin with. Websites can do a lot with javascript and other web tech, or it could just be that I (and the OP) weren't paying attention when a nefarious pop-up asked for permission to allow notifications, or any number of other ways.

Here's my glorious Notification list from this past week:

Screenshot 2023-01-15 at 2.14.45 AM.png
 

NEPOBABY

macrumors member
Jan 10, 2023
68
88
Turning off Safari notifications DOES turn them off. The problem is that it turns them ALL off, which is throwing the baby out with the bath water.

My comments are directed at everyone, not just you. You can call it spam, but that's just the end-result of the notification settings. Call it virus, call it spam, or anything else you might think of. This is simply a case of some website adding itself to your browser notification list—so technically speaking, it's doing exactly what it's supposed to do. Malware is probably a good description for what this is. And the "spam" is the "scam" – in that when you click any one of those notifications, you're taken to a website trying to charge you money to fix the problem via software (which probably IS malware).

The OP didn't post a response, but I just offered the solution a few hours ago (in the middle of the night, no less). He may not ever respond, which would be frustrating for the people currently posting in this thread, but it doesn't change what it is or the solution, for future readers who may come across this issue.

I don't think your comment, or anyone else's here, is "off-topic" – they're just jumping to conclusions and offering solutions that are completely unnecessary. It's not a virus, it doesn't require an OS re-insall, it certainly doesn't require taking the Mac into the Apple Store for repair/diagnostics, etc. It simply needs to be clicked in a list and a delete button pressed.

The reason I'm 100% certain of everything I've said is that I literally just had this exact same thing happen (see screenshot below) and I deleted the one Safari Notification entry and it fixed the problem immediately and hasn't happened since. I also did a thorough diagnostic on the Mac and found absolutely nothing new on the Mac except that Notification compared to before that notification got there.

The only question is how it got in the list to begin with. Websites can do a lot with javascript and other web tech, or it could just be that I (and the OP) weren't paying attention when a nefarious pop-up asked for permission to allow notifications, or any number of other ways.

Here's my glorious Notification list from this past week:

View attachment 2146075

I don’t care what anyone says above but if my system was doing that I would clean install the system completely and restore an older version of my data before the infection. I would also double check the security of all online services And change every password.

I treat my systems just like my body. Protect this stuff seriously and if it gets infected don’t pretend it is all fine. Clean it all out and protect.

Don’t visit dodgy sites and don’t be tempted by any form of piracy.
 

Sciuriware

macrumors 6502
Jan 4, 2014
472
73
Gelderland
I don’t care what anyone says above but if my system was doing that I would clean install the system completely and restore an older version of my data before the infection. I would also double check the security of all online services And change every password.

I treat my systems just like my body. Protect this stuff seriously and if it gets infected don’t pretend it is all fine. Clean it all out and protect.

Don’t visit dodgy sites and don’t be tempted by any form of piracy.
Fully agreed: stay clean and healthy in 2023 and thereafter.
;JOOP!
 

Queen6

macrumors G3
Agreed. Contact Apple Help and see if they can sort it out for you. I doubt reinstalling the OS will help as it's an SSV i.e. a Signed Sealed Volume. If they altered that, they wouldn't be asking you to click on the notifications as they'd likely already have control of your computer. The Data Volume is more likely where they put the malware. You'll need to find the malware to uninstall it. Try running KnockKnock. Malware installs itself persistently, to ensure it is automatically executed each time a computer is restarted. KnockKnock uncovers persistently installed software in order to reveal such malware generically. Here's a link: https://objective-see.org/products/knockknock.html
Bitdefender is free on the Apple Mac Store for the manual AV scanner and KnockKnock can be linked to Virus Total, with over 70 AV engines. Solid advice given the small size of the apps and the differing types of detection and costs nothing to run the scans.

Objective See also offers BlockBlock which stops all persistent installs, but needs a little knowledge.

Q-6
 
  • Like
Reactions: mikelets456

orionquest

macrumors 6502a
Mar 16, 2022
539
381
The Great White North
Sounds like an over reaction to this situation. @MacGizmo has identified it correctly.
Notifications on the Mac seem pretty much useless. I have it switched off completely the only 1 I am interested in are emails.
Also I never use Safari. Maybe another broswer will be less invasive or tied into the system doing without these annoyances.
 
  • Like
Reactions: russell_314

kitKAC

macrumors 6502
Feb 26, 2022
261
295
Sounds like an over reaction to this situation. @MacGizmo has identified it correctly.
Notifications on the Mac seem pretty much useless. I have it switched off completely the only 1 I am interested in are emails.
Also I never use Safari. Maybe another broswer will be less invasive or tied into the system doing without these annoyances.

Any browser that supports notifications has this problem, I've seen it enough with Chrome at work (on Mac and PC).
 

Ruggy

macrumors 6502a
Jan 11, 2017
894
566
Are they actually system notifications though?
They look like some sort of phishing scam with a system icon pasted into them.
System never tells you things like that and I don't they they actually have the system icon in them.
 

ajf.350d

macrumors member
Nov 23, 2010
93
41
Worcestershire, UK
This may be from Chrome, just not an extension.
See if these settings are in MacOS (the original is for Windows)

  • Open the Chrome app.
  • To the right of the address bar, tap More ⋮ > Settings.
  • Tap Site Settings > Notifications.
  • Tap the suspicious website, then tap either Block or Remove.
 

Takeo Apple

macrumors member
Sep 3, 2020
82
79
I guess it’s been resolved by deleting website notifications lol.

Malware on Mac does not exist to the extend that it needs a virus scanner. What it needs is to never type in your admin password to grant permissions to unknown software from the internet you cannot trust. (Mostly illegal copies to be fair)
 

MacGizmo

macrumors 68030
Apr 27, 2003
2,565
1,861
Arizona
Are they actually system notifications though?
They look like some sort of phishing scam with a system icon pasted into them.
System never tells you things like that and I don't they they actually have the system icon in them.
That's exactly what they are. They're notifications from a website, not the system. And they all lead to a site offering software to "fix" problems (obviously a scam).
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.