How to remove Nicyaboyenan.com pop-up scam (Virus removal guide)

What is Nicyaboyenan.com?

Nicyaboyenan.com is a website that is designed to promote various scams aimed at computers users, as well as owners of iPhones and Android phones. It claims that the visitor’s personal data is stolen because someone has access to the device and recommends installing a “security application” to stop it. In fact, there are no sites that can in any way determine that third parties have gained access to a visitor’s device (iPphone, iPad, Mac, Windows computer etc), so the “Your personal data has been stolen” alert is fake.

The purpose of this scam is to trick users to install untrustworthy apps, among which may be malware, trojans, browser hijackers and adware. Users can stumble onto Nicyaboyenan.com just by entering a misspelled web address. In addition, they can be redirected to this scam by malvertising (malicious advertisements), Adware and potentially unwanted programs (PUPs).

QUICK LINKS

• What is Nicyaboyenan.com?
• Threat Summary
• How to remove Nicyaboyenan.com pop ups

Nicyaboyenan.com is posing as a legitimate Apple Security site. Initially, it displays a fake notification informing that personal data has been stolen and prompting to click OK. Clicking on the OK button closes this notification and opens a message that informs that a third-party has access to the photos and messengers, knows the browser history. Nicyaboyenan.com prompts users to click the “Download and Install” button to download and install the recommended security app.

It must be emphasized, never download programs promoted by scam sites, as these apps can be dangerous for you and your device. Installing untrustworthy software can lead to loss of personal data, disclosure of confidential information, and even financial losses.

Text presented in this scam site:

(1) SYSTEM NOTIFICATION
Your personal data has been stolen!
Hit OK to protect your iPhone.
OK

Apple Security
Your personal data has been stolen!
Third-party has access to your photos and messengers. Third-party knows your internet browser history. Stop it now!
Step 1: Tap the button below & install the recommended security application free from the AppStore
Step 2: Run the app and follow on screen instructions.
Download and Install
Detected By Apple.

If your browser redirects to the Nicyaboyenan.com scam regularly, then it is possible that Adware or PUAs are installed on your device. Adware is considered a potentially security threat because it often installed without the knowledge of the user. Adware usually just displays unwanted ads, but sometimes adware may be used to obtain your personal information.

Threat Summary

Name	Nicyaboyenan.com
Type	scam, phishing, fake alerts
Symptoms	pop ups and newtabs are loaded without your request your web browser is re-directed to web-sites you did not want new entries appear in your Applications folder an unexpected toolbar appears in your web-browser your internet browser settings are being changed without your request slow Internet browsing speeds your MAC OS is no stable leading to freezes
Removal	Nicyaboyenan.com removal guide

 

Nicyaboyenan.com isn’t the only one on the Internet that aims to trick victims into installing untrustworthy software. Almost every day we report on new sites created by scammers, some of the most recent: Antivirushub.co, Equames.com, Freememoryhub.site. None of these websites can be trusted, you should not download any apps recommended by these sites.

How does Adware get on your computer

Most of unwanted advertisements and pop-ups come from web-browser toolbars and/or addons, BHOs (browser helper objects) and third-party software. In many cases, these items claim itself as applications that improve your experience on the Internet by providing a fast and interactive homepage or a search provider that does not track you. Remember, how to avoid the unwanted apps. Be cautious, launch only reputable software which download from reputable sources. NEVER install any unknown and dubious programs.

Text of the second nicyaboyenan.com variant:

É recomendável instalar um antivírus no seu Phone!

Segundo o DFNDR Lab, foram detectados 8 links maliciosos por segundo este ano. Para garantir sua proteção, lançamos uma nova atualização do DFNDR Security.

Sem o aplicativo, seu Android Phone poderá ser prejudicado e seus dados poderão cair na mão de hackers.

Instale GRÁTIS o app recomendado para limpar e reforçar a proteção do seu Phone imediatamente!
Instalar

Text of the third nicyaboyenan.com variant:

VPN Update
Please download the VPN from the App Store and continue watching in safe mode.
Install

If the Nicyaboyenan.com scam keeps popping up on the device screen and, after closing it, it appears again and again, then try the following simple steps to solve the problem: turn on pop-up blocker; turn on fraudulent website warnings; delete web browsing data. Below we will demonstrate how to do this.

Open the Apple device settings, then scroll down the list of settings to Safari, tap on it.

In the list of settings, find switches “Block Pop-ups” and “Fraudulent Website Warning”, check if they are enabled. If any of the switches are off, then it must be turned on. Having done this, scroll down the settings and tap “Advanced”.

On the Advanced settings screen, tap “Website Data”, scroll down the list of web-domains and tap “Remove All Website Data”.

How to remove Nicyaboyenan.com pop-up

When the adware software gets installed on your machine without your knowledge, it is not easy to delete. Most often, there is no Uninstall program that simply delete the adware responsible for Nicyaboyenan.com popup scam from your Apple Mac. So, we recommend using well-proven free specialized tool such as MalwareBytes Anti Malware (MBAM). But the best solution to get rid of Nicyaboyenan.com scam will be to perform several manual steps, after that additionally run antimalware utilities.

To remove Nicyaboyenan.com, complete the following steps:

1. Remove profiles created by adware
2. Delete Nicyaboyenan.com related software through the Finder
3. Remove Nicyaboyenan.com related files and folders
4. Scan your Mac with MalwareBytes
5. Remove Nicyaboyenan.com from Safari, Chrome, Firefox
6. How to block Nicyaboyenan.com pop-ups

Remove profiles created by adware

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to Nicyaboyenan.com pop-ups.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac computer, which is normal.

Delete Nicyaboyenan.com related software through the Finder

Some browser hijackers, PUPs and adware can be uninstalled by uninstalling the free applications they came with. If this way does not succeed, then looking them up in the list of installed apps in the Finder. Use the “Move to Trash” command in order to get rid of them.

Open Finder and click “Applications” as shown on the image below.

You will see a list of programs installed on your MAC. We recommend to pay maximum attention to the program you installed last. Most likely, it is the adware that causes multiple annoying popups. If you’re in doubt, you can always check the application by doing a search for her name in Google, Yahoo or Bing.

After the program which you need to uninstall is found, simply right press on its name, and select “Move to Trash”.

Don’t forget, choose Finder, then “Empty Trash”.

Remove Nicyaboyenan.com related files and folders

Now you need to try to find Nicyaboyenan.com related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, , search.plist, macsearch.plist and installapp.plist. Most often, adware, PUPs and browser hijackers create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.machelper.plist, com.installapp.plist, com.macsearch.plist and com.search.plist. In most cases, potentially unwanted programs, adware software and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

Manual Nicyaboyenan.com removal requires some computer skills. Some files and system entries that created by the adware can be not completely removed. We recommend that run MalwareBytes AntiMalware to scan the Mac device. Moreover, this program will allow you to get rid of adware software, browser hijackers, toolbars and PUPs that your Apple Mac can be affected too.

First, please go to the following link, then click the ‘Download’ button in order to download the latest version of MalwareBytes Free.

When the download is complete, run it and follow the prompts. Press the “Scan” button to perform a system scan for the adware that causes multiple intrusive pop ups. While the MalwareBytes Free application is scanning, you can see how many objects it has identified as threat. Make sure all items have ‘checkmark’ and click the “Quarantine” button.

MalwareBytes is a malware removal tool that you can use to remove all detected folders, files, malicious services and so on for free.

Remove Nicyaboyenan.com from Safari, Chrome, Firefox

Nicyaboyenan.com pop-ups or other symptoms of adware in your web-browser is a good reason to find and get rid of malicious plugins. This is an easy way to restore browsers settings and not lose any important information.

Google Chrome	Mozilla Firefox
In the top right corner, click on Google Chrome’s main menu button, represented by three vertical dots. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove Nicyaboyenan.com popups by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with Nicyaboyenan.com pop up removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to block Nicyaboyenan.com pop-ups

By installing an adblocker program such as AdGuard, you’re able to block Nicyaboyenan.com scam, stop autoplaying video ads and delete a large count of distracting and intrusive ads on web-sites.

Installing the AdGuard is simple. First you will need to download AdGuard by clicking on the link below. Save it directly to your Microsoft Windows Desktop.

When the downloading process is finished, run the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you start your MAC OS, AdGuard will run automatically and stop intrusive pop-ups, block Nicyaboyenan.com, as well as other malicious or misleading websites.

Finish words

Now your MAC system should be clean of the adware responsible for Nicyaboyenan.com popups. We suggest that you keep AdGuard (to help you block unwanted pop-up ads and annoying harmful webpages) and Malwarebytes Anti-Malware (to periodically scan your MAC for new malware, hijackers and adware). Make sure that you have all the Critical Updates recommended for Mac OS. Without regular updates you WILL NOT be protected when new browser hijackers, harmful programs and adware are released.

If you are still having problems while trying to get rid of Nicyaboyenan.com scam from your internet browser, then ask for help here.