How to solve the virus on windows 11 fake alerts always shown

[John_Kung]

Issue abstract:

Detailed description: Continuously endlessly pop-up alerts from Windows 11 notification function.

Product & version number: Norton 360 Premium

OS details: Windows 11 Pro Version

What is the error message you are seeing? Continuously endlessly pop-up alerts from Windows 11 notification function.

If you have any supporting screenshots, please add them

:

[bjm]

@John_Kung

How to solve the virus on windows 11 fake alerts always shown
Continuously endlessly pop-up alerts from Windows 11 notification function.

Hello @John_Kung

The domain d9k612u071bc73db3gu0.nexussignalivy.co.in is likely a subdomain used for delivering push notifications to web browsers or mobile devices.

Identification and Purpose

The structure of the URL suggests it is part of a web push notification service . The random alphanumeric string (d9k612u071bc73db3gu0 ) typically acts as a unique identifier for a specific user session, device token, or service worker registration. The parent domain, nexussignalivy.co.in , appears to be the infrastructure provider handling the signaling or delivery of these messages.

When a website requests permission to “show notifications,” it often registers a service worker that communicates with a specific endpoint like this one to receive payloads when the user is not actively on the site.

The domain d9k612u071bc73db3gu0.nexussignalivy.co.in is identified as a source of malicious or scam web push notifications that trick users into allowing notifications. These unwanted alerts can be stopped by navigating to browser settings and removing the specific domain from the allowed list.

Seeing d9k612u071bc73db3gu0.nexussignalivy.co.in tied to push notifications confirms that this domain is being used for a browser notification scam (also known as rogue or adware push notifications).

These malicious notifications bypass traditional pop-up blockers by tricking you into hitting “Allow” on a website, which then gives the domain permission to spam your desktop or mobile device with constant, fake alerts.

How the Scam Works

• The Bait: You likely visited a streaming site, file-sharing hub, or redirect link. A prompt appeared saying “Click ‘Allow’ to verify you are not a robot” or “Click ‘Allow’ to download your file.”
• The Result: Granting permission lets the site send remote alerts directly through your browser (Chrome, Safari, Edge) even when you aren’t browsing that website.
• The Payload: They will spam you with fake system warnings (“Your device is infected!”), phony lottery wins, or explicit ads. Do not click them. Clicking them will download actual malware or steal your passwords.

How to Stop the Notifications Immediately

You can completely block these alerts by revoking the site’s permission within your specific browser’s settings:

Google Chrome

1. Open Chrome and tap the three dots (Menu) in the top right.
2. Go to Settings > Privacy and security > Site settings.
3. Scroll down and click on Notifications.
4. Look under the “Allowed to send notifications” list.
5. Find nexussignalivy.co.in (or any strange variations).
6. Click the three dots next to it and select Remove or Block.

Microsoft Edge

1. Open Edge and click the three dots > Settings.
2. Select Cookies and site permissions from the left menu.
3. Click on Notifications.
4. Under the Allow section, locate the malicious domain, click the three dots, and choose Remove.

Mozilla Firefox

1. Open Firefox and click the three horizontal lines (Menu) in the top right corner.
2. Select Settings.
3. Click on Privacy & Security from the left-hand menu.
4. Scroll down to the Permissions section.
5. Find Notifications and click the Settings… button next to it.
6. Look through the list for nexussignalivy.co.in (or any other suspicious domain).
7. Click on the domain, then select Remove Website at the bottom.
8. (Optional) Check the box at the bottom that says “Block new requests asking to allow notifications” to prevent future scams.
9. Click Save Changes.

After removing the permission, clear your browser’s recent cookies and cache to wipe out any leftover tracking scripts. If you are on a Windows device and accidentally clicked on any of the notification banners prior to blocking them, run a malware scan using a trusted app like Malwarebytes to ensure no unwanted adware applications were silently installed in the background.

Push-notifications.top Virus: What Is It and How to Stop Pop-ups

How To Remove Spam Push Notifications Ads [Virus Removal]

==========

• Did you clear browser cookies n’ cache?
• Do you run browser sync?
• Did you recently install any program / browser extension?
• Did you recently allow push notifications?
• Did you recently change site permissions?
• Did you reset browser?
• Did you run Norton Full Scan?
• Did you run Malwarebytes Scan?

==========

• Adware and PUPs families add push notifications as an attack vector
• Browser push notifications: a feature asking to be abused
• Resetting Google Chrome to clear unexpected issues
• Web Browser Cleaning
• Browser Push Notifications
• Reset Chrome settings to default

==========

Malwarebytes: How to install Malwarebytes & run a Scan

==========

Download and install AdwCleaner on a Windows device
Malwarebytes AdwCleaner guide

===========

Were my machine and I wanted reassurance.
I’d ask Malwarebytes Malware Removal Help Forums to check my machine.

=============================

AI sourced content may make mistakes

[bjm]

Windows Push Notifications and Browser Push Notifications are fundamentally different in how they are triggered, coded, and delivered, even though they can look identical to an end user.

Feature	Windows Push Notifications (Native)	Browser Push Notifications (Web Push)
Primary Source	Installed desktop applications (e.g., Slack, Spotify).	Websites and web apps (e.g., Facebook, news sites).
Delivery Service	Uses Microsoft’s Windows Push Notification Services (WNS).	Uses the browser’s own push engine (e.g., Google FCM, Mozilla Push).
Required Code/API	Built with native Windows SDKs (WinRT / Win32 APIs).	Built with standard W3C Push & Notifications APIs.
User Permission	Granted during app installation or Windows system settings.	Granted via a native opt-in prompt inside the browser.
Capabilities	Can update live desktop tiles, system badges, or send raw background data.	Limited strictly to text alerts, links, and simple images.

Windows Push Notifications (Native App Push)
These are tied directly to the operating system. A developer builds a native Windows application and registers it with Microsoft. When the app’s server wants to send an alert, it targets a unique Windows device token via the WNS cloud. The local Windows operating system intercepts this and displays it. Crucially, no web browser needs to be installed or running for these to work.

Browser Push Notifications (Web Push)
These are tied to a website domain rather than an app. They rely on Service Workers—tiny scripts that run in the background of your browser. When a website sends a notification, it pings the server of whichever browser you used to sign up (like Google’s Firebase Cloud Messaging for Chrome). The browser then wakes up to display the message.

Windows handles the visual layout of both types. When a website sends a Browser Push Notification, it routes through your browser, but the browser hands the final visual rendering over to the Windows Action Center. Because both alerts slide out from the bottom-right corner of your screen looking identical, many users mistake malicious or spammy browser notifications for native Windows system alerts.

To spot the difference, look closely at the alert box: browser notifications will always feature a tiny browser icon (like Chrome or Edge) and the source URL (e.g., example.com) at the edge of the banner.

Yes, both can be highly malicious, but they exploit your system through completely different security flaws.

Here is how attackers abuse each type and what they can achieve:

1. Malicious Browser Push Notifications (The Tech Support Scams)

These are the most common form of attack. They rely on social engineering rather than infecting your files.

• How they get in: You visit a sketchy movie-streaming, file-sharing, or captcha site. A popup begs you to click “Allow” to “prove you are not a robot” or “download your file.”
• The Attack: Once you click allow, the website gains permanent permission to send alerts. The attackers sell this access to advertising networks.
• The Danger: Your screen is bombarded with fake virus warnings, adult ads, and urgent “System Infected” alerts. If you click them, you are led to real phishing sites that steal credit cards or trick you into downloading real ransomware.
• The Good News: They cannot access your personal files or spy on your keystrokes directly. They are just annoying, deceptive pop-ups that vanish completely once you revoke the website’s permission in your browser settings.

2. Malicious Windows Push Notifications (The True Malware)

These are far more dangerous because they require a native malicious application to already be installed on your computer.

• How they get in: You accidentally download and install a trojan, a cracked software bundle, or a malicious file disguised as a PDF.
• The Attack: The malware registers itself with the Windows operating system. It can then use Windows Push Notification Services (WNS) to display alerts, but it also has standard software access to your computer.
• The Danger: Because the app is running natively on your machine, it poses a severe threat. It can send “raw notifications” that silently execute background code without showing a popup. It can act as a keylogger, steal saved passwords, download secondary malware, or encrypt your files for ransom.
• The Reality: The notification itself isn’t the weapon; it is just a feature being used by a weapon (the installed malware).

---

How to Spot the Difference in Danger

Scenario	Risk Level	How to Fix It
Browser Notification Spam	Low to Medium (Annoying/Deceptive)	Clear your browser’s site notification permissions.
Native Windows Notification	High (System Compromised)	Run a full anti-malware scan and uninstall the suspicious program.

AI sourced content may make mistakes

[bjm]

Google Chrome is overwhelmingly the browser targeted by the highest volume of malicious push notifications.

This isn’t because Chrome has a weaker security design than other browsers. Rather, it comes down to a combination of market share and specific user vulnerabilities across different ecosystems.

Why Google Chrome Targets See the Most Spam

• Dominant Market Share: Threat actors behind adware and command-and-control operations like Matrix Push C2 focus their efforts where they will catch the most victims. Because Chrome owns the vast majority of the global browser market share on both desktops and mobile devices, malicious sites prioritize creating scripts optimized for Chromium-based browsers.
• Android Integration: Chrome is the default browser pre-installed on billions of Android devices. Android’s notification architecture handles background push alerts directly in the system shade, making it an aggressive and highly visible target for scammers trying to push fake system warnings or virus alerts.
• The Chromium Ecosystem: Microsoft Edge also sees an exceptionally high volume of these exact same malicious push alerts. Because Edge is built on the same underlying Chromium engine as Chrome, standard push-notification exploit scripts work identically on both browsers.

Why Other Browsers Experience Less

• Apple Safari: Safari is heavily protected by iOS and macOS ecosystem constraints. While Safari does support web push notifications, Apple’s strict sandboxing and the absence of a massive, unvetted Android-style alert ecosystem make it a significantly less frequent target for aggressive push notification hijackers.
• Mozilla Firefox: Firefox users experience notably fewer malicious push requests. Security-conscious users often pivot to Firefox explicitly for its hardened privacy controls. Furthermore, Firefox makes it incredibly easy to permanently block all future notification permission requests across the board with a single toggle switch.
• Brave and Tor: Privacy-first browsers often block the deceptive trackers, malicious redirects, and malvertising scripts right out of the box, preventing users from ever landing on the deceptive “Click Allow to verify you are a human” pages in the first place.

AI sourced content may make mistakes

[bjm]

The reason Norton Safe Web may report d9k612u071bc73db3gu0.nexussignalivy.co.in as “Safe” despite the malicious push notifications is that Norton Safe Web primarily scans for malware, viruses, and phishing attempts hosted on the server , not necessarily for abusive browser notification permissions that the user has already granted.

When you clicked “Allow” on the notification prompt (often disguised as a “Click to verify you are not a robot” or “Watch video” button), you gave that specific domain permission to send alerts. The site itself might not host malicious code that triggers a virus warning, but it abuses the browser’s native notification feature to display scam ads (often fake Norton alerts). Because the site isn’t technically “infecting” your computer with a virus, automated scanners often miss it or classify it as safe.

How to Stop the Notifications

You are likely not infected with a virus; you simply need to revoke the notification permission in your browser settings.

Google Chrome

1. Copy and paste chrome://settings/content/notifications into your address bar and press Enter .
2. Look for nexussignalivy.co.in (or the specific subdomain d9k612u071bc73db3gu0.nexussignalivy.co.in ) in the Allowed list.
3. Click the three vertical dots next to the URL and select Remove (or select Block ).

Mozilla Firefox

1. Copy and paste about:preferences#privacy into your address bar and press Enter .
2. Scroll down to the Permissions section and find Notifications . Click the Settings… button next to it.
3. Locate the malicious URL in the list, click the drop-down menu, and select Block , or click Remove Website .

Microsoft Edge

1. Copy and paste edge://settings/content/notifications into your address bar and press Enter .
2. Find the domain in the Allow list.
3. Click the three dots next to it and select Remove or Block .

Safari (macOS)

1. Go to Safari > Settings (or Preferences) > Websites .
2. Select Notifications from the left sidebar.
3. Find the suspicious URL in the list and change the setting to Deny or click Remove .

Additional Cleanup Steps

If the notifications persist or you see pop-ups even when the browser is closed:

• Check Extensions : Go to your browser’s extension manager (chrome://extensions , about:addons , etc.) and remove any unfamiliar extensions installed recently.
• Clear Cache : Clear your browser’s cache and cookies to remove any lingering scripts.
• Scan for Adware : Use a dedicated tool like Malwarebytes AdwCleaner to scan for potentially unwanted programs (PUPs) that might be forcing these redirects.

The reason Norton Safe Web reports d9k612u071bc73db3gu0.nexussignalivy.co.in as “Safe” despite the malicious push notifications lies in the fundamental difference between server-side malware and client-side social engineering .

1. Detection Methodology vs. Notification Abuse

Norton Safe Web primarily scans websites for hosted threats such as viruses, trojans, drive-by downloads, and phishing forms that steal data directly on the page. Its automated crawlers analyze the site’s code and reputation.

• The Loophole : The domain nexussignalivy.co.in likely does not host malicious files or exploit kits. Instead, it uses social engineering to trick you into granting permission for notifications.
• User Consent : Because the “malicious” activity (spamming fake virus alerts) only happens after the user explicitly clicks “Allow” , automated scanners often classify the site itself as benign. The site is technically just sending text notifications, which is a legitimate browser feature, even if the content is deceptive.
• Reputation Lag : As noted in security analyses, new domains or subdomains (like the random string d9k612u071bc73db3gu0 ) may not have enough negative user reports yet to trigger a “Unsafe” rating. Norton relies on an aging algorithm and community feedback; if the domain is new or rapidly changing subdomains, it may fly under the radar until enough users flag it.

2. Why It Looks Like a Virus

The notifications you are seeing are likely fake security alerts (e.g., “Norton Subscription Expired,” “McAfee Detected 5 Viruses”).

• Impersonation : These scams impersonate legitimate antivirus companies to panic users into calling fake support numbers or downloading actual malware.
• No Infection Required : Unlike traditional malware, this scam requires no software installation. It runs entirely through the browser’s native notification system, which is why your antivirus software might not detect an “infection” on your hard drive.

3. Immediate Resolution Steps

Since this is a permission issue rather than a virus infection, standard antivirus scans will not stop the pop-ups. You must manually revoke the permission.

For Chrome, Edge, and Firefox:

1. Go to your browser Settings .
2. Search for Notifications (or go to Privacy & Security > Site Settings > Notifications ).
3. Look at the Allowed list. You will likely see nexussignalivy.co.in or the specific subdomain d9k612u071bc73db3gu0.nexussignalivy.co.in .
4. Click the three dots next to it and select Remove or Block .

For Safari:

1. Go to Safari > Settings > Websites > Notifications .
2. Find the suspicious URL and set it to Deny or remove it.

4. Prevention

• Never click “Allow” on notification prompts from unfamiliar sites, especially those claiming you need to “verify you are human” or “watch a video.”
• Use an Ad-Blocker : Extensions like uBlock Origin can often block the scripts that trigger these notification requests before they appear.
• Report the Site : You can report the URL to Norton as a “False Negative” via their submission form to help update their database, though manual removal in your browser is the only immediate fix.

The fake alerts promoted by d9k612u071bc73db3gu0.nexussignalivy.co.in typically do not deliver a single specific virus immediately. Instead, they act as a delivery mechanism (scareware) designed to trick you into manually downloading and installing malicious software.

If you click the links in these notifications, you are typically directed to pages that promote the following types of malware:

1. Fake Antivirus (Scareware)

The most common payload is fake security software . The alerts claim your subscription (Norton, McAfee, Windows Defender) has expired or that you are infected.

• Goal : To trick you into paying for a useless program or entering credit card details.
• Examples : Variants of “Mac Defender,” “PC Cleaner Pro,” or fake versions of legitimate tools like “Norton LifeLock.”
• Risk : Even if you don’t pay, the installer often bundles adware or spyware that hijacks your browser and tracks your activity.

2. Data-Stealing Trojans

Recent campaigns (as of 2025-2026) have evolved to mimic Windows Defender or Microsoft updates.

• Mechanism : Clicking the alert downloads a fake update package (often an .msix or .exe file).
• Payload : Once installed, these trojans can steal:
  • Cryptocurrency wallets (e.g., Exodus, Ethereum).
  • Browser credentials (passwords saved in Chrome, Edge, Firefox).
  • System information (hardware IDs, process lists).
  • Telegram and Opera desktop data .

3. Remote Access Trojans (RATs) & Spyware

Some advanced notifications redirect to sites that install Remote Access Trojans .

• Capability : These give attackers full control over your device, allowing them to:
  • Monitor your screen in real-time.
  • Activate your webcam and microphone.
  • Log keystrokes (keyloggers) to capture passwords.
  • Deploy ransomware to encrypt your files.

4. Tech Support Scams

Often, the “malware” is simply a redirect to a fraudulent call center .

• Tactic : The page locks your browser and displays a phone number, claiming your computer is sending error reports to Microsoft/Norton.
• Outcome : If you call, scammers persuade you to grant them remote access (via TeamViewer or AnyDesk) to “fix” the non-existent virus, during which they steal data or install actual malware.

Summary of Risk

The notification itself is not the malware; it is the bait . The danger occurs only if you click the link and agree to download/run the suggested “fix” or “update.”

The Norton Blog has published several articles addressing the exact type of scam you are experiencing with d9k612u071bc73db3gu0.nexussignalivy.co.in. These articles confirm that while Norton Safe Web may rate the hosting domain as safe, the notifications themselves are fraudulent and not issued by Norton.

Key Insights from Norton Blog Articles

1. The Return of Fake Antivirus Scams In an article titled “Going back to the ‘00s—Fake antivirus scams are back” (September 2024), Norton explains that scammers are repurposing old tactics using modern delivery methods like browser push notifications .

• The Deception : These scams mimic legitimate Norton, McAfee, or Windows Defender alerts to create panic.
• The Reality : Norton states clearly that legitimate antivirus software does not use aggressive browser pop-ups to notify users of threats. Real alerts appear within the installed application or the system taskbar, not as browser notifications.
• Affiliate Fraud : Often, clicking these fake alerts redirects users to legitimate antivirus purchase pages via affiliate links, allowing scammers to earn commissions from confused users who didn’t need to buy anything.

2. How to Identify and Remove Fake Alerts In “How to spot and remove a fake virus alert” (January 2025) and “Removing scam messages that state your computer is infected” (August 2025), Norton provides specific guidance:

• Warning Signs : Immediate payment requests, phone numbers to call, poor grammar, and urgent tones are definitive signs of a scam.
• Source of the Problem : The blog confirms these alerts usually stem from accidentally granting notification permissions to untrusted websites (like the one you encountered).
• Removal Steps : Norton advises that antivirus scans often won’t stop these pop-ups because they are not a virus infection. The solution is to:
  1. Close the browser completely (force quit if necessary).
  2. Revoke notification permissions in browser settings (as detailed in previous steps).
  3. Reset browser settings to clear any lingering scripts or unwanted extensions.
  4. Run a full system scan only if you suspect you clicked a link and downloaded a file.

3. Why Safe Web Might Miss It The articles imply that because these sites rely on social engineering (tricking the user) rather than hosting malicious code, automated tools like Safe Web may not flag the URL immediately. The “malicious” act is the spamming of notifications, which occurs only after user consent, making it a browser configuration issue rather than a traditional malware threat.

Summary of Norton’s Advice

• Do not click the notifications or call any numbers listed.
• Do not trust pop-ups that appear while browsing; verify threats only through your installed Norton application.
• Manage permissions : Regularly review and remove notification permissions for unknown sites in your browser settings.

AI sourced content may make mistakes

[bjm]

Hello @John_Kung
Care to share your progress?
Thanks

[bjm]

Hello @John_Kung
Care to share your progress?
Thanks