Unwanted McAfee notifications

Topic

New Reply

Apologies if this is not the right place for this, but couldn’t find anywhere else.

My Windows 10 desktop uses Avast Free virus checker.  Nonetheless, I get regular  notifications purpoting to be from McAfee with dire warnings about bad things which are about to happen. As far as I remember, McAfee was never installed but it is certainly not included in the list of programs, so is not there to uninstall.  I use Firefox, Edge and Chrome as browsers.

What (if anything) can I do to stop the McAfee messages?

Many thanks

Reply | Quote

Replies

Perhaps your computer came with a McAfee Subscription that you never installed or activated, and that software is still there unused. You can use the McAfee Consumer Products Removal (MCPR) tool to clean out the remnants. Depending on the source of the software, run as directed. See:

https://service.mcafee.com/?articleId=TS101331&page=shell&shell=article-view

Or you can download MRCP from MajorGeeks or Bleepingcomputer.

If that doesn’t get rid of the notifications, then the source may be some adware you have picked up somewhere. Try a PUP removal tool such as Malwarebytes Free.

1 user thanked author for this post.

WSepzcaw

Reply | Quote

I ran MCPR yesterday and it removed lots of files.

However, today there were a whole set of new McAfee notifications.  I’m attaching a screen dump of one.

This is the URL

https://clicktocontinueb2.click/nZrIu7B/mc/rd23/?isp=BT&ip=86.141.249.32&g=uk&city=Derby&browser=Microsoft%20Edge&os=Windows&trk=WkVkV2RXUklTbkpNYlU1MllsRTlQUT09&tsid=4&lpkey=16c3549f76c185f639&lng=en&t1=362827&t2=GB&uclick=h9fv7vx90&uclickhash=h9fv7vx90-h9fv7vx90-ira2-0-h9bl-twoj-bzej-e78a2a

Doesn’t look genuine but who knows.

I downloaded Malwarebytes and ran it.  I’m attaching a screendump of this.  The only threat it found was a program for running photoscape which I allowed it to quarantine.

I ran MCPR again, and it went through exactly the same process as yesterday, suggesting that the files had all been re-installed or hadn’t been removed.

 

What next?  And thanks again!!

Reply | Quote

Are you running MCPR from an Admin ID, as opposed from a Standard ID?
Have you tried running it in Safe Mode as Administrator?

Reply | Quote

Not sure whether its Admin or Standard ID.  But it seems happy to run, deletes lots of files.

How do I run in Safe Mode as administrator?

Thanks

Reply | Quote

WSepzcaw wrote:

Nonetheless, I get regular notifications purpoting to be from McAfee with dire warnings about bad things which are about to happen.

If you’re referring to email notifications that indicate they’re from McAfee, they’re all scams/phishing and can be ignored.

Even though I’ve never had McAfee installed on my PC (it’s a DIY built tower) I get at least 6-7 such messages every day all with dire warnings about serious issues if I don’t renew/update my McAfee S/W.

They all come from “different sources” (i.e. the actual From IP address in the header is never the same) and include a link that use shortened URLs that effectively hide the real site they’d take you to if clicked (URL shortening Wiki)

2 users thanked author for this post.

WSepzcaw, geekdom

Reply | Quote

Treat these messages as spam and block the senders.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

HI,

They are not email messages – they are notifications I assume from browsers.

 

But thanks for helping.

Reply | Quote

Thank you both for your suggestions.

The messages are notifications, not emails.

I’ve run the MCPR tool as suggested, and it said it was removing lots of stuff.  So it is now wait and see.  Will let you know.

Best wishes

Reply | Quote

Check notification settings in the browsers:

How to Disable Web Notifications

1 user thanked author for this post.

WSepzcaw

Reply | Quote

Hi

Thanks for your advice.

But I’m not sure I want to block all notifications.  I think I have blocked them in EDGE which I suspect is the source of the problem so we’ll see if that helps.

And I am also concerned that something more sinister is going on here.  I’ve never had a McAfee subscription, and am already running virus protection so these messages are presumably lying.  It seems unlikely that they are actually from McAfee so someone else is managing to access my computer and send them.

I ran MCPR yesterday and it appeared to remove all McAfee files, but when I ran it again today, it did exactly the same thing.

I guess a clean install of Windows is probably required….

Again, thanking for trying to help!

 

Reply | Quote

Could you attach a screenshot or two so that we can examine the notifications?

(If they are web notifications, either icons or smallprint should identify the browser and site responsible.)

EDIT: I hadn’t seen your one notification screenshot eight posts up.

That isn’t a browser/web notification.

Reply | Quote

Screenshots attached.

The first looks diticnlty dodgy – and I’ve never had  McAfee account.

The second has McAfee in the URL, but again have never had a McAfee account.

Thanks for helping!

Have just seen your later comments  saying the are not brwoser notiifcaations.  If not what are they, and what do I do about them?

Re-install Windows from scratch?

Reply | Quote

Did clicking on the first get you to the second?

Reply | Quote

No, I retrieved both of these from teh Notifications tab at the bottom left had side of the screen.

There were several more which Avast blocked when I tried to open them.

Next time a new one appears, I will try to get a live screen grab.

 

Reply | Quote

Bottom LEFT?

I don’t see how you get from a notification to a web page in Edge without clicking.

I see CLICKDEALER at the end of the visible URL.

My bet would be an affiliate marketing scam taking you to a genuine McAfee page.

But the notification looks like malware to me.

Reply | Quote

Based on some information in this thread and in the interest of caution, check for viruses and adware.

• Update and run a full scan of your virus checker.
• Run this, the one-time scan: https://www.eset.com/us/home/online-scanner/
• Run this: https://www.bleepingcomputer.com/download/adwcleaner/

There are other virus-checkers available.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

I ran all these and they found nothing dangerous.

I now belueve the problem is “captchamodenr.top” – see screendump below.

Don’t know why the virus checkers don’t find it.

It is not in Firefox.

Instruction for ermonving from Edge was “reset all settings”.  I’ve done this,and will see what happens.

2 users thanked author for this post.

geekdom, Just another Forum Poster

Reply | Quote

WSepzcaw wrote:

I now belueve the problem is “captchamodenr.top” – see screendump below.

See Remove Captchamodern.top pop-up ads (Virus Removal Guide)

1 user thanked author for this post.

WSepzcaw

Reply | Quote

WSepzcaw wrote:

I now belueve the problem is “captchamodenr.top”

Captchamodern.top is a malicious web site that uses special code in it’s web pages to cause those pop ups to appear.

It’s not actually a piece of software on your PC although it’s possible you were infected with something (adware/malware) that’s redirecting you to the site.

Since you indicate your virus checkers aren’t finding anything, it’s more likely what’s happening is some ad that’s being displayed on a web site you regular visit is “redirecting” you to that site and that’s what’s causing the pop ups.

Here’s how to permanently prevent your PC from being able to connect to that site.

Open Windows explorer and go to C:\Windows\System32\drivers\etc

Right-click the file named hosts (no extension), select the open with option, then select notepad.

Scroll all the way to the bottom of the file and add this line

0.0.0.0 captchamodern.top (note that’s a tab character, not a blank space)

Save the file.

What this does is “forcible” redirect all attempts to connect to that site to the non-existent IP address 0.0.0.0

Note: you’ll likely get one or more UAC prompts during this process, always click allow.

BTW, that site wasn’t in my own personal hosts file (which has an extensive list of sites to be blocked), I added it. Thanks!

2 users thanked author for this post.

WSepzcaw, NaNoNyMouse

Reply | Quote

Just another Forum Poster wrote:

file named hosts

Do Windows updates reset your hosts file?

cheers, Paul

Reply | Quote

Paul T wrote:

Do Windows updates reset your hosts file?

Nope!

Neither will SFC, DISM, or an “in place” upgrade to a new version of Windows.

It takes a full reinstall to set it back to default.

1 user thanked author for this post.

Paul T

Reply | Quote

Just another Forum Poster wrote:

Captchamodern.top is a malicious web site that uses special code in its web pages to cause those pop ups to appear.

No special code required:

Captchamodern.top is a site that tries to trick you into subscribing to its push notifications so that it can send notification spam directly to your desktop or phone.

Remove Captchamodern.top pop-up ads (Virus Removal Guide)

2 users thanked author for this post.

geekdom, Just another Forum Poster

Reply | Quote

WSepzcaw wrote:

Don’t know why the virus checkers don’t find it.

Probably not a virus but an Adware.

Try Bitdefender Adware Removal Tool 1.1.8.1668

1 user thanked author for this post.

WSepzcaw

Reply | Quote

Since I “reset all settings” in Edge, there have been no more occurrences, which is not normal, so maybe I have got rid of it.

If it recurs, I will try Alex5723‘s suggestion first, and if that doesn’t work, will follow alejr‘s instructions.  I’m a but nervous about changing stuff in the system, but will grit my teeth….

Thank you again to everyone who has been offering help – I am always amazed and delighted a the support offered by strangers to strangers on these forums.

Reply | Quote

No more fake McAfee messages, so I’m confident that “Captchamodern.top” was the problem.

Again thanks to all for help and advice

2 users thanked author for this post.

b, geekdom

Reply | Quote