Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Father-In-Law got this on his Mac. Solutions to get rid of this permanently?
- Thread starter DMG35
- Start date
- Sort by reaction score
Where does it show up? On the system itself, eMail, browser? All I can see is bunch of pop-ups. If it's running in a web browser, it's a known SCAM. Just close the browser window/tab and be done, nothing else to do.
If you check the Apple forums, this is usually what happens when going to fishy websites and your browser will give you these popups.
If you check the Apple forums, this is usually what happens when going to fishy websites and your browser will give you these popups.
If the machine were already infected with a Trojan, then the mission would be a complete, so to speak. What you are seeing on the screen are scare tactics, they want to scare you into contacting them so they can finish their mission to take over the computer. In other words, the computer is not full of malware (yet), if it were then their job would be done and they wouldn’t need you to contact them.. they would want to hide all traces of it instead.
As GrumpyCoder said, if this is happening inside a web browser then just close the web browser and be done with it. Many malicious people run JavaScript via the advertisements in a web browser to scare you into thinking your computer is full of malware. This is why I recommend using an ad blocker in web browsers.
As GrumpyCoder said, if this is happening inside a web browser then just close the web browser and be done with it. Many malicious people run JavaScript via the advertisements in a web browser to scare you into thinking your computer is full of malware. This is why I recommend using an ad blocker in web browsers.
Last edited:
Looks exactly like this https://www.myantispyware.com/2022/08/11/apple-security-center-pop-up-scam-virus-removal-guide/
See
"Remove profiles created by Adware"
"Check the list of installed apps"
"Check for Adware generated files in the “~/Library/LaunchAgents” folder"
"Check for Adware generated files in the /Library/LaunchDaemons folder"
See
"Remove profiles created by Adware"
"Check the list of installed apps"
"Check for Adware generated files in the “~/Library/LaunchAgents” folder"
"Check for Adware generated files in the /Library/LaunchDaemons folder"
Folks, if it were actual spyware, then they wouldn’t be prompting the user to contact them. Think about it, spyware wants to remain hidden and asking the user to contact them is one of the biggest red flags that there may be spyware… it defeats the mission of the people who placed the spyware. Why would a hacker go through all of the scare tactics if the spyware was already in place and working?
Throwing up all of those popups isn’t exactly the best way to be stealthy.
Throwing up all of those popups isn’t exactly the best way to be stealthy.
It's called "scareware" and it's been around for a long time.
en.wikipedia.org
Example thread where it appears on a phone:
forums.macrumors.com
Example thread for a Mac:
forums.macrumors.com
Fake ransomware attack:
forums.macrumors.com
One from 2020:
forums.macrumors.com
One point here is that MalwareBytes may not find anything, because there's nothing to find on the computer itself. The fake notice is being delivered and presented by the web browser. In this case, it's appearing as a website notification.
The short answer in all of these is:
The window / dialog / notification / whatever is lying.
Scareware - Wikipedia
Example thread where it appears on a phone:
iPhone hacked message!!
I was using "SaveFrom.net" in Safari to download a file. Then I got this message... I closed Safari and cleared the History Cache. Then I turned my phone off for a few minutes and restarted it. I enabled "Private Relay" in settings and also used the Private Tab in Safari. Everything seems...
forums.macrumors.com
Example thread for a Mac:
McAffee not installed, but's running anyway
Some months earlier I tried McAfee antivirus. I did not like it. So I removed it. It is no longer in the Applications Folder. And A search for it finds nothing. But it is running in the background. Anyone know how to completely remove it?
forums.macrumors.com
Fake ransomware attack:
Ransom Attack
Have had my new MacBook Pro 14 just a few weeks now, and just had a ransomware attack about two hours ago. Was happily browsing on Safari when a warning took over the screen that my computer had been taken over and whoever this was could help if I didn't turn off the warning but immediately...
forums.macrumors.com
One from 2020:
Getting Rid of Viruses and Malware on Mac
I just bought my Mac around June of 2019. Right after getting it, I attempted to get support in troubleshooting my printer connection, and in trying to do so I downloaded something that added malware. I downloaded CleanMyMac X to get rid of it, but ever since that first incident, I've received...
forums.macrumors.com
The short answer in all of these is:
The window / dialog / notification / whatever is lying.
Here is the key thing: it says "ads.financetrack(2).dll" – there is no such thing as a ".dll" in macOS. That is a Windows file type. Clear indication that this is BS.