Fake 'McAfee' Alerts Every Few Minutes, All Day Long. It Was One Click on 'Allow.'
Second virus call of the day, and it looked worse than the first: fake “McAfee & Privacy Protection” alerts popping up over and over, every few minutes, warning that the subscription had expired and the computer was exposed. He already had a real antivirus, and it was not finding anything. That was the clue.
No malware. A subscription.
The computer was not infected. His antivirus was intact and current, and nothing was installed that should not be. What I found instead was a browser notification permission: at some point, while reading email or searching, a website had asked “Allow notifications?” and he clicked Allow. That one click let the site push messages to his desktop any time it wanted, even with the browser closed.
The site was a scareware ad network. I pulled the browser logs and traced the chain: a push notification, redirected through two ad-tracking domains, landing on a fresh fake-McAfee page with a random subdomain every time. Dozens of hits between 5:55 and 10:02 that morning alone. The “alert” was an ad, and the page it opened was built to get a credit card number for a “renewal.”
Shutting it off at the source
- Removed the notification permission for the offending site (and audited the rest of the list).
- Turned off the browser’s background push delivery and startup boost, so nothing can deliver notifications while the browser is closed.
- Flushed the queued notifications, cleared the tracking history, and verified through a reboot: zero bad notifications, zero scam processes. The last fake alert was at 10:02 AM. Nothing since.
The one habit that prevents this
When any website asks to send you notifications, click Block. Not “Allow,” not “Later,” Block. Your news site, your bank, and your email do not need desktop notifications to work, and nothing legitimate breaks when you say no. Scam networks depend entirely on that one click.
If you are already getting alerts like this, do not click them and do not call any number they show. It is not your antivirus talking. Call or text and I will trace it and shut it off, usually in one visit.