Jump to content

Red Shield with a White X Titled "Ask You" Is Posting Notifications on MAC


Recommended Posts

In a list of software programs allowed to post notifications on my husbands iMac, at the top, is a program with a red shield and white X that send weird notifications on his desktop.

Underneath the red shield, it says "Confirm that you are not a robot you need click Allow". What is this?  How can we get rid of it?

Susan

Screenshot 2022-11-12 at 1.29.29 PM.png

Link to post
Share on other sites

  • Staff

An app with the name "ask you" is pretty suspicious to start with, and the fact that the message says to "confirm that you're not a robot" when that is absolutely NOT what this is for makes it almost certain this is not something you want on your system. I have not seen such a thing before, though.

I'd like to get more information from your system. Please follow the instructions here to download the Malwarebytes Support Tool and use it to gather data:

https://support.malwarebytes.com/hc/en-us/articles/360038519834-Upload-logs-to-your-ticket-using-the-Malwarebytes-Support-Tool-for-Mac

It will create a file on the desktop called MWB_Info.zip. Please send that to me via direct message. (You can click on my name or profile picture at left and then click the Message button to send me a direct message.)

  • Like 1
Link to post
Share on other sites

  • 2 months later...

I just had this very issue, it's caused by a malicous website having been approved to send notifications through Safari, this fixes it:

Open Safari, go to Settings->Websites->Notifications. Check the list of approved websites and remove it from the list. Mine had the system preferences logo and no title in this list. Once removed the notifications will stop.

  • Like 1
  • Thanks 1
Link to post
Share on other sites

  • 2 months later...

I have a similar issue; however, the notifications come with an icon identical to the Mac "General" icon. I have managed to stop the actual notifications from appearing on my screen, in the upper right hand corner. (They were appearing there every half hour or so, telling me my system was infected.)

My current issues:

  1. I can't PERMANENTLY remove them from the System Settings > Notifications section (I have, however, turned them off there.)
  2. I can't PERMANENTLY remove them from the Safari > Settings > Notifications section. When I select it here, and click "Remove" then quit and reopen Safari, it reopens with the app again under Notifications with Allow activated. If I select Deny, then quit and reopen Safari, it reopens with the app set to Allow again. 

I downloaded a trial version of Malwarebytes and scanned my computer, but it didn't find any issues. 

Would appreciate help, so that I can remove any vestige of this annoyance from my system.

Thank you!

Screenshot 2023-03-24 at 12.16.48 PM.png

Link to post
Share on other sites

  • Staff

Since this topic started, we've determined that this is not being caused by any malware installed on the system. It is caused by being tricked into allowing notifications from a scam website in Safari. Ventura now displays these in System Settings -> Notifications in the form seen in your screenshot, which is very unfortunate.

You will need to change the item in your screenshot from Allow to Deny in Safari's settings. You can also remove it after doing so, if you like, though leaving it in the list will ensure that it continues to be denied that capability.

In System Settings, control-click the "ask you" item and choose Reset Notifications, then confirm. That will remove it from the list.

  • Like 1
  • Thanks 1
Link to post
Share on other sites

Thanks for your reply - however, when I set the item in Safari > Settings > Websites > Notifications to Deny, then quit out of safari and reopen it, it is turned back on to Allow - every single time. I have done this over and over and cannot get the Deny to stick.

When I set it to Deny, then it is immediately removed from System Settings > Notifications, so I can't right click on it at that point. However, as soon as I quit and restart Safari, it is back in the same places as pictured (Safari and System), with the notifications reset to Allow in Safari (as mentioned above). 

If I right-click on it in System Settings first (before I have set it to Deny), select Reset Notifications, and confirm that, nothing appears to change. 

I appreciate that this isn't an issue from a malware point of view, but I don't understand then what is reactivating the website in the Notification Center when I quit & restart Safari. 

 

Link to post
Share on other sites

So, this is what I did:

  1. In Safari > Settings > Websites > Notifications, I selected Deny for the "ask you" icon.
  2. Then I clicked Remove.
    The "ask you" icon is removed.
  3. I quit Safari.
  4. I reopened Safari > Settings > Websites > Notifications.
    The "ask you" icon has reappeared with the dropdown set to "Allow".

I have done this over and over, to no avail.

Link to post
Share on other sites

  • Staff

I would like to get more information about your system. Please follow the instructions at the following link to download our support tool, run it, and attach the results to a reply to this message:

https://support.malwarebytes.com/hc/en-us/articles/360038519834-Upload-logs-to-your-ticket-using-the-Malwarebytes-Support-Tool-for-Mac

Once I have that information, I can investigate to see what's going on.

Link to post
Share on other sites

  • Staff

I'm seeing a ton of stuff installed on your computer, but nothing that I can identify as malicious.

Can you do a couple other things for me?

First, if you're willing, I'd love to see a copy of the following file on your computer:

~/Library/Safari/RemoteNotifications/Permissions.plist

You can copy that path, then press command-shift-G in the Finder. In the window that comes up, paste that path and press return. If, instead of showing you a file, it beeps, that means you don't have that file on your system for some reason.

Note that this file will have information about websites you have visited that have at any point requested notification permission. I just want you to be aware, in case anything in that file is what you would consider sensitive.

Second, I'd like you to open the Terminal app, and paste in the following command:

ls -alO ~/Library/Safari/RemoteNotifications/; ls -alO /private/var/folders/*/*/*/com.apple.notificationcenter/db2

You will probably be asked if Terminal is allowed to have access for this, and you should allow it. Then copy the output that results from the Terminal into a message here. (The output will include your username on your computer... if you don't want that to be visible, edit the pasted text to replace your username with "username".)

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.