Popup Notice: Virus Alert on Mac - what is it?

A few days ago, a reader wrote to me that she was receiving strange messages on her Mac telling her that she had a virus and that the virus scanner had expired. Here is an excerpt from her email:

My iMac has been showing pop-up messages that it has a virus or someone is downloading files (with the Mac System Preferences icon) lately. I recently updated my iMac from High Sierra to Catalina 10.15 (Maximum) and also updated Safari hoping these messages go away. The first thing that appeared after the installation were these messages again…. In addition, my Word program no longer works and the version that is suggested to be downloaded from the App Store only works from 11… I would be very grateful for any tips!

I then asked what the reports were exactly and then received screenshots on which the following messages can be found:

• Warning of critical Virus. Click here to renew Antivirus.
• Someone is downloading files from your computer. Is it you?
• Your antivirus has expired! Renew NOW to stay protected.

For my reader, the clues say:

To make it short: You look in System Settings → Notifications as well as under Safari → Preferences → General → Notifications and looks for a suspicious entry that has the same icon as the icon you see in the notification windows.

If you want a little more background information, you can read on.

Tip 1: Scan with Malwarebytes

My first suspicion was that somehow malware got lost on the Mac, which now needs to be found and removed. I have therefore referred the reader to the free version of Malwarebytes, which performs a manual scan of the Mac and also removes viruses or malware - if it finds any.

Why Malwarebytes? Because this app doesn't write itself deeply into the system and monitors everything like many other virus scanners do. Malwarebytes used to be one too Recommendation from the Geniusbar in the Apple Store and is therefore my choice. Even if I don't use a virus scanner myself.

But nothing of the sort came to light. The Mac was free from malicious apps.

2. Tip: Check notifications

Things got interesting because if it's not an evil app, what's left, then? A quick search on Google brought me to the Apple Support Forums where someone a similar problem had. The crucial clue in the forum post was: The messages, which look like they come from the macOS itself, actually come from a website that was given permission to send notifications via the notification center at some point.

To check this, follow the steps below:

1. System Settings
2. Messages
3. look there for an app or service that looks suspicious and might have the System Preferences icon.
4. Turn off the “Allow notifications” setting for this app.

The second place such notifications can come from is Safari. There are also notifications that can be disabled. This can be checked as follows.

• Open Safari
• Call up settings
• Webseiten
• Messages
• look there for a domain that looks suspicious and might have the System Preferences icon.
• Change the setting to “Don't Allow”.

This should fix your problems with those weird message boxes. If you still get suspicious messages, please leave a comment here and send me a screenshot of the message. I'm happy to take a look and try to help.

Jen Kleinholz( Founder & Sir Apfelot )

Jens has been running the blog since 2012. He acts as Sir Apfelot for his readers and helps them with technical problems. In his spare time he rides electric unicycles, takes photos (preferably with the iPhone, of course), climbs around in the Hessian mountains or hikes with the family. His articles deal with Apple products, news from the world of drones or solutions to current bugs.