SYSTEM NOTIFICATION scam (Virus removal guide)

What is SYSTEM NOTIFICATION?

SYSTEM NOTIFICATION is a pop-up scam that masquerades as a message from Apple Security, but in fact has nothing to do with Apple. This scam is quite common on the Internet, as evidenced by numerous posts on public forums, Reddit, Apple Support Communities, etc. In all cases, security experts warn that these pop-ups are not legitimate ‘system notifications’, it is a scam generated by various malicious sites. Scammers use these malicious sites to promote untrustworthy programs such as PUAs, adware, browser hijackers and spyware.

Below we provide a message from the user who encountered this scam:

Just received a “System Notification”, while browsing Safari, from apple-warning.com, which stated “Please Read Important Notification Regarding Your iOS Device”. The Notification warned that 3 Viruses has been detected on your iPhone and battery has been infected and damaged. It further asked that if you don’t remove this Malware now, it may cause more damage and that how to fix this. There was an option of Download and Install and time was shown as ticking down. Beneath was written Detected by Apple. When I clicked on Download and Install, I found an app of Ad-blocking for protection from advertisement but I didn’t install it.

Most of the time, these scam messages say that you must read an important notification regarding your device (iPhone, iOS device, computer, Mac) by clicking the OK button. After clicking on this button, the message informs about the detection of viruses on the device (or other problems with the device) and offers to download and install the software that solves the described problem. The scammers behind these messages instruct the user to install the software as a way to remove viruses, protect the device from malware, and prevent personal data leaks. You cannot trust this message, in any case do not click on the links and buttons in this message, try to close the SYSTEM NOTIFICATION message immediately after it appears on the screen.

Text presented in the SYSTEM NOTIFICATION scam:

Apple Security

(3) Viruses have been detected on your iPhone and battery has been infected and damaged.

If you do not remove this malware now, it may cause more damage to your device. How to fix this:

Step 1: Tap the button below & install the recommended virus protection tool for free from the AppStore.

Step 2: Run the app to remove all malware to repair your phone to 100%

Download and Install
Detected By Apple.

These SYSTEM NOTIFICATION pop-ups are caused by shady advertisements on the web sites you visit, push notifications from malicious websites or Adware. Adware is a form of software that serves unwanted advertisements on your browser. Some of these advertisements are scams or fake advertisements created to trick you. Even the harmless advertisements can become really irritating. Adware software can be installed accidentally and without you knowing about it, when you open email attachments, install freeware.

The Japanese version of this scam.

Text presented in this scam message:

Apple Security水曜日
お使いのiPhoneで(3)件のウイルスが検出されており、バッテリーが感染しダメージを受けています。
今すぐこのマルウェアを除去しない場合、マルウェアがデバイスに さらにダメージを起こす原因となる場合があります。修復方法は以下の通りです：

手順1：下のボタンをタップし、 推奨されるウイルス対策ツールをAppStoreから無料で インストールします

手順2： アプリを実行しすべてのマルウェアを除去し、 携帯電話を完全に修理します
1 minutes and 57 seconds
ダウンロードとインストール
Detected By Apple.

（1）件のシステム通知
お使いのiOSデバイスに関する 重要な通知をお読みください。
OK

Threat Summary

Name	SYSTEM NOTIFICATION scam
Type	scam, phishing, fake alerts
Affected devices	iPhone, iPad, iOS devices, Mac computer, Android devices, Windows computers
Fake claims	“(129) Viruses have been detected on your iPhone”, “Malware detected. Hit OK to repair”, “Adblock update required. Access to Safari is blocked.”, “(16) Viruses have been detected on your iPhone and battery has been infected and damaged”, “Please Read Important Notification Regarding Your iOS Device”, “(3) Viruses have been detected on your iPhone and battery has been infected and damaged”, “お使いのiPhoneで(3)件のウイルスが検出されており、バッテリーが感染しダメージを受けています。”
Associated domains	appi-security.com, support-notify.space, service-care.space, global-info.space, customers-info.space, device-safety.com, alert-info.space, app-department.report, service24.report, global-support.report, internet-protection.com
Symptoms	unwanted advertisements appear on web-pages that you are visiting your browser is redirected to web sites you did not want your device starts automatically installing unwanted programs unwanted internet browser extensions or toolbars keep coming back your device settings are being changed without your request slow Internet browsing speeds your device starts performing very slowly
Removal	SYSTEM NOTIFICATION removal guide

 

This scam is not the only scam that every internet user can face. We have already reported on other types of scams on several occasions, such as Your MAC might be at risk, $100 Gift Card, YOUR IPHONE HAS BEEN COMPROMISED, WARNING CRITICAL MESSAGE, I sent you an email from your account. Therefore, security experts recommend that you always be on the alert, do not open suspicious links, do not install suspicious programs. If you have the slightest doubt, close the questionable website.

How to remove SYSTEM NOTIFICATION scam

1. Remove SYSTEM NOTIFICATION scam caused by shady advertisements
2. Remove SYSTEM NOTIFICATION scam caused by push notifications
3. Remove SYSTEM NOTIFICATION scam caused by Adware
4. How to stop SYSTEM NOTIFICATION scam

Remove SYSTEM NOTIFICATION scam caused by shady advertisements

If the SYSTEM NOTIFICATION scam keeps popping up on the device screen and, after closing it, it appears again and again, then try the following simple steps to solve the problem: turn on pop-up blocker; turn on fraudulent website warnings; delete web browsing data. Below we will demonstrate how to do this.

Open the Apple device settings, then scroll down the list of settings to Safari, tap on it.

In the list of settings, find switches “Block Pop-ups” and “Fraudulent Website Warning”, check if they are enabled. If any of the switches are off, then it must be turned on. Having done this, scroll down the settings and tap “Advanced”.

On the Advanced settings screen, tap “Website Data”, scroll down the list of web-domains and tap “Remove All Website Data”.

How to remove SYSTEM NOTIFICATION scam caused by push notifications

If you accidentally allowed a malicious website to send the SYSTEM NOTIFICATION spam to your device, then we’ll need to delete these permissions. Depending on your device/browser, you can use the steps below:

Google Chrome:

• Just copy and paste the following text into the address bar of Chrome.
• chrome://settings/content/notifications
• Press Enter.
• Delete rogue notifications by clicking three vertical dots button next to each and selecting ‘Remove’.

Android:

• Tap ‘Settings’.
• Tap ‘Notifications’.
• Find and tap the web-browser which shows the SYSTEM NOTIFICATION scam.
• Find malicious websites and set the toggle button to ‘OFF’ on them one-by-one.

Mozilla Firefox:

• In the right upper corner of the screen, click the Menu button, represented by three horizontal stripes.
• In the menu go to ‘Options’, in the menu on the left go to ‘Privacy & Security’.
• Scroll down to ‘Permissions’ and then to ‘Settings’ next to ‘Notifications’.
• Locate sites you do not want to see notifications from, click on drop-down menu next to each and select ‘Block’.
• Click ‘Save Changes’ button.

Edge:

• Click the More button (three dots) in the right upper corner of the screen.
• Click ‘Settings’. Click ‘Advanced’ on the left side of the window.
• In the ‘Website permissions’ section click ‘Manage permissions’.
• Right-click a malicious URL. Click ‘Delete’.

Internet Explorer:

• In the right upper corner of the window, click on the menu button (gear icon).
• In the drop-down menu select ‘Internet Options’.
• Click on the ‘Privacy’ tab and select ‘Settings’ in the pop-up blockers section.
• Find a malicous URL and click the ‘Remove’ button to remove the URL.

Safari:

• • On the top menu select ‘Safari’, then ‘Preferences’.
  • Select the ‘Websites’ tab and then select ‘Notifications’ section on the left panel.
  • Locate a malicious URL and select it, click the ‘Deny’ button.

How to remove SYSTEM NOTIFICATION scam caused by Adware

Fortunately, we have an effective solution that will help you manually or/and automatically get rid of SYSTEM NOTIFICATION scam from your Mac device and bring your web-browser settings, including search provider, new tab page and homepage, back to normal. Below you’ll find a removal guide with all the steps you can need to successfully delete adware software and its traces. Read this manual carefully, bookmark it or open this page on your smartphone, because you may need to close your web-browser or restart the system.

Remove unwanted profiles on Mac device

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile associated with SYSTEM NOTIFICATION.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac device, which is normal.

Delete Adware related software through the Finder

Go to the Finder and remove suspicious software, all programs you don’t remember installing. It’s important to pay the most attention to applications you have recently installed. If you do not know what a program does, look for the answer on the Net.

Open Finder and click “Applications”.

It will show a list of all applications installed on your computer. Scroll through the all list, and uninstall any dubious and unknown applications. Right click to questionable program and choose “Move to Trash”. Another way is drag the program from the Applications folder to the Trash.

Most important, scroll through the all list, and move to trash any unknown applications. Don’t forget, select Finder -> Empty Trash.

Remove Adware related files and folders

Now you need to try to find ‘SYSTEM NOTIFICATION scam’ related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: macsearch.plist, search.plist, com.machelper.plist and installapp.plist. Most often, browser hijackers, adware software and PUPs create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.plist, com.search.plist, com.installapp.plist and com.machelper.plist. In most cases, PUPs, adware and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

Manual Adware removal requires some computer skills. Some files and system entries that created by the adware can be not fully removed. We suggest that use MalwareBytes to scan the Mac computer. Moreover, this application will allow you to get rid of adware, PUPs, browser hijackers and toolbars that your PC can be affected too.

MalwareBytes Anti-Malware (MBAM) can be downloaded from the following link. Save it on your Desktop.

When downloading is finished, close all windows on your PC. Further, start the saved file. Follow the prompts.

The MalwareBytes AntiMalware (MBAM) will automatically launch and you may see its main window like below.

Next, press the “Scan Now” button to start checking your PC system for the adware that causes the SYSTEM NOTIFICATION scam. A system scan may take anywhere from 5 to 30 minutes, depending on your PC system. While the MalwareBytes is checking, you can see how many objects it has identified either as being malicious software.

Once MalwareBytes Anti Malware (MBAM) completes the scan, you can check all items found on your computer. Once you’ve selected what you wish to remove from your personal computer click the “Quarantine” button.

The MalwareBytes Anti-Malware (MBAM) will begin to remove adware software that causes SYSTEM NOTIFICATION scam.

Remove SYSTEM NOTIFICATION from Safari, Chrome, Firefox

The SYSTEM NOTIFICATION pop-up scam or other symptoms of adware software in your web-browser is a good reason to find and delete harmful plugins. This is an easy way to restore web browsers settings and not lose any important information.

Google Chrome	Mozilla Firefox
In the top right hand corner, click on ‘three vertical dots’, and this will open up the main menu on Google Chrome. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to delete SYSTEM NOTIFICATION pop-ups by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with SYSTEM NOTIFICATION pop up scam removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop SYSTEM NOTIFICATION scam

It is also critical to protect your web-browsers from malicious web sites and advertisements by using an ad-blocker program like AdGuard. Security experts says that it will greatly reduce the risk of malware, and potentially save lots of money. Additionally, the AdGuard can also protect your privacy by blocking almost all trackers.
 

 

1. First, click the link below, then click the ‘Download’ button in order to download the latest version of AdGuard.
   
   

   AdGuard for Mac download
   3675 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. Once downloading is done, start the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. After the installation is done, click “Skip” to close the install program and use the default settings, or press “Get Started” to see an quick tutorial that will allow you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you run your PC, AdGuard will start automatically and stop unwanted ads, block SYSTEM NOTIFICATION scam, as well as other harmful or misleading web-sites.

Finish words

Now your device should be free of the SYSTEM NOTIFICATION pop up scam. We suggest that you keep AdGuard (to help you stop unwanted popup ads and intrusive harmful webpages) and Malwarebytes (to periodically scan your device for new adware software and other malicious software). If you are still having problems while trying to delete this scam from your device, then ask for help here here.