Apple launches Apple Store app in India

The Apple Store app provides customers with the most personalized way to shop for Apple’s innovative lineup of products and services. Learn more >

You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

virus 'application.work' installs as a safari extension but is trying to mine banking data

I have been using safari in the last week (20th March today) when something automatically begins to download. It shows as a green magnifier in the dock and tries to instal a safari extension - the extension manager advises me that the extension will allow all banking transactions and passwords to be logged.


Obviously concerned I deleted the extension file immediately, and the application from the program folder.


A couple of days later it happened again.

This time I looked not just at the two locations but I tracked a file in among the apple.work section. it looked identical to all the others but did not have the 'apple' section in the file name.


I deleted the files too.


I have searched - but the name they are using 'application.work' brings up thousands of results none of which appear to relate to this 'virus'


I even searched here to see if anyone else is having the same issue, but there is nothing listed.


Can anyone tell me if this is safely removed? I am nervous about using any banking sites after this.


Thank you.

MacBook Pro 13", macOS 10.14

Posted on Mar 21, 2019 2:11 AM

Reply
Question marked as Top-ranking reply

Posted on Mar 21, 2019 3:34 AM

This is something new.

There was another post about it recently.

As a test, run Malwarebytes for Mac and see what it says and also post an EtreCheck report.


     Check for adware.

     Use  the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

     For instructions:  Install Malwarebytes for Mac          Uninstall Malwarebytes for Mac

     Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

     Restart the computer and relaunch Safari holding the shift key down.

I would appreciate it if you would post back.


    Download EtreCheck, https://etrecheck.com/maspro  and post the report here.

      Click  “Click to download” button,

      Open Downloads folder, click on it to open, and then select ”Open”.

      “Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.

      Click “Share Report” button in the toolbar, select “Copy report” .

      Paste the report when you reply.

      Note

      This is a diagnostic test.

      If 5000 words limit applies:

      Split the report into two parts and post as two separate posts. 

Similar questions

5 replies
Sort By: 
Question marked as Top-ranking reply

Mar 21, 2019 3:34 AM in response to susanna240

This is something new.

There was another post about it recently.

As a test, run Malwarebytes for Mac and see what it says and also post an EtreCheck report.


     Check for adware.

     Use  the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

     For instructions:  Install Malwarebytes for Mac          Uninstall Malwarebytes for Mac

     Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

     Restart the computer and relaunch Safari holding the shift key down.

I would appreciate it if you would post back.


    Download EtreCheck, https://etrecheck.com/maspro  and post the report here.

      Click  “Click to download” button,

      Open Downloads folder, click on it to open, and then select ”Open”.

      “Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.

      Click “Share Report” button in the toolbar, select “Copy report” .

      Paste the report when you reply.

      Note

      This is a diagnostic test.

      If 5000 words limit applies:

      Split the report into two parts and post as two separate posts. 

Reply

virus 'application.work' installs as a safari extension but is trying to mine banking data

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.