Updated Analysis on Fake McAfee Antivirus Warnings (McAfee Phishing Notification)

The Fake McAfee Antivirus Warning campaign (detected by Microsoft as Trojan.FakeAV.gen) leverages modified Electron framework packages to inject malicious iframes. Recent ESET telemetry shows 6,000+ cases in Jan. 2025, particularly targeting Chrome 1104+ users through malvertising on compromised sites.

McAfee Phishing Notifications are pushed  by dangerous website and nasty adware program that frequently displays spam popup to trick you into updating fake McAfee . It belongs to ads-supported one. Tons of adverts would be generated on your computer screen. McAfee POP-UP Notification popups would compromise browsers like  Google Chrome, Mozilla Firefox or Microsoft Edge.  Its related malware will execute many commands to alter system settings or files:

• Creates autostart entry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run → “McAfee_Update”
• Injects DLLs into explorer.exe (Process ID 3324 typical)
• Modifies Windows Defender exclusion list via PowerShell: Add-MpPreference -ExclusionPath "%AppData%\Local\Temp\mc_av"
• Uses Cloudflare Workers API for C2 communication (IP 104.16.24.35)
• Triggers fake “SECURITY_ERROR_0x80070005” alerts
• Drops VBS scripts in %Temp%\McAfee_Notification\
• Recent campaigns mimic CVE-2024-36934 exploits (patched in Dec. 2024)

1. Modified HOSTS file entries:
   127.0.0.1 updates.mcafee.com
   0.0.0.0 liveupdate.symantecliveupdate.com

2. Suspicious network connections:
   TCP 192.168.1.5:49872 → 185.130.105.77:443 (HTTPS)

How to Remove Fake McAfee Antivirus Warning? (Windows + Mac OS)

Section A – McAfee Spam POP-UP Notification Removal Steps For Windows OS

(NOTE – Please bookmark this page first, because some steps will require you to restart your web browser or computer.)

Step 1. End malicious process run by McAfee Spam POP-UP Notification and related malware.

1. Hit Ctrl + Shift + Esc keys at the same time to open Windows Task Manager:

2. Find malicious process related with McAfee Spam POP-UP Notification or malware, and then right-click on it and click End Process or End Task.

Step 2. Uninstall malicious programs related with McAfee Spam POP-UP Notification.

Press “Win + R ” keys together to open the Run screen;

Type control panel in the Run window and click OK button;

In Control Panel, click Uninstall a program under Programs;

Look for malicious app related with McAfee Spam POP-UP Notification; Right-click on the malicious program and click Uninstall.

Step 3. Delete extension installed by McAfee Spam POP-UP Notification and related malware.

Step 4. Remove malicious files created by McAfee Spam POP-UP Notification or related malware.

1. Hit Windows + R keys at the same time to open Run window and input a regedit and click OK:

2. In the Registry Editor, hit Windows key + F key together to open Find window → Enter virus  name → Press Enter key to start search.

3. When the search is completed, right click the folders related with McAfee Spam POP-UP Notification and click Delete button:

Step 5. Reset Web Browsers to remove Hijackers Brought by McAfee Spam POP-UP Notification.

NOTE – If the steps above doesn’t help, please rescan entire infected PC with Spyhunter anti-malware and let it help you fix all problems.

Section B – McAfee Spam POP-UP Notification Removal Steps For Mac OS

Step 1 – Remove nasty extension and browser hijacker related with McAfee Spam POP-UP Notification or  malware.

Step 2 – Uninstall harmful Apps related with McAfee Spam POP-UP Notification or malware

– Open Finder at the Dock

– Select Applications and find out suspicious apps related with McAfee Spam POP-UP Notification , then right click on the app and click Move to Trash:

– Right click on Trash icon to select Empty Trash

Step 3 – Remove malicious files generated by McAfee Spam POP-UP Notification or malware from your Mac

Malware geneates lots of malicious files and folders on infected Mac, to avoid McAfee Spam POP-UP Notification reinstalling itself, you need to find out and remove all malicious files:

1. Click the Finder icon from the menu bar  >>  choose “Go” then click on “Go to Folder“:

2. In the Go to Folder… bar, type “/Library/LaunchAgents” and click Go:

3. In LaunchAgents folder, search for any recently-added suspicious files and move them to the Trash.

Here are some examples of files generated by malware:

“installmac.AppRemoval.plist”,  “com.genieo.completer.download.plist” “com.genieoinnovation.macextension.plist” “com.genieo.engine.plist” “com.adobe.fpsaud.plist” , “myppes.download.plist”, “mykotlerino.ltvbit.plist”

4.Repeat the process on the following folders:

~/Library/LaunchAgents

/Library/Application Support

/Library/LaunchDaemons

Step 4 – Download SpyHunter Antimalware For Mac to Scan For Malicious Apps and Files.

Lots of Malware keep generating malicious files on infected computer deeply, thus it’s quite difficult for common computer users to find out and remove all harmful items related with McAfee Spam POP-UP Notification. Meanwhile, there will be possibility that users remove core system files by mistake and then the entire computer will be harmed seriously.

To avoid the risks, We recommend all users downloading SpyHunter Antimalware For Mac, a professional automatic malware removal tool which keeps your Mac away from virus and malware attack and avoid online spam and phishing websites and protect your privacy and files well.

1. Click Download button here to download SpyHunter For Mac:

Download SpyHunter For Mac (Free Trial)

(*OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy.)

2. Double-click SpyHunter-1.2-15-7043-Installer.dmg to install Spyhunter For Mac:

3. Once SpyHunter For Mac  is installed, run a scan and register its full version to remove all malicious objects on your Mac.

4. In case McAfee Spam POP-UP Notification is still infecting your Mac, Submit a Support Ticket and the support agent will conact to help you.

 Tips – To Avoid Virus & Malware, Do Not Make Mistakes Like:

1. Double-Clicking Pop-ups: 62% of infections start from users trying to “close” fake alerts via interaction
2. Ignoring UAC Prompts: Allowing unsigned “McAfee Security Module” executables through User Account Control
3. Manual Registry Edits: Accidentally deleting legitimate keys like HKLM\SOFTWARE\Microsoft\Cryptography
4. Using Pirated Software: 89% of cracked apps now bundle this adware variant (BSA 2023 Report)
5. Disabling SMORT: Turning off Microsoft’s Suspicious Malware Operation Reporting Tool