virus 'application.work' installs as a safari extension but is trying to mine banking data

Question

Level 1

9 points

virus 'application.work' installs as a safari extension but is trying to mine banking data

I have been using safari in the last week (20th March today) when something automatically begins to download. It shows as a green magnifier in the dock and tries to instal a safari extension - the extension manager advises me that the extension will allow all banking transactions and passwords to be logged.

Obviously concerned I deleted the extension file immediately, and the application from the program folder.

A couple of days later it happened again.

This time I looked not just at the two locations but I tracked a file in among the apple.work section. it looked identical to all the others but did not have the 'apple' section in the file name.

I deleted the files too.

I have searched - but the name they are using 'application.work' brings up thousands of results none of which appear to relate to this 'virus'

I even searched here to see if anyone else is having the same issue, but there is nothing listed.

Can anyone tell me if this is safely removed? I am nervous about using any banking sites after this.

Thank you.

MacBook Pro 13", macOS 10.14

Posted on Mar 21, 2019 2:11 AM

Reply

Answer 1

Best reply

dominic23

Level 10

83,910 points

Mar 21, 2019 3:34 AM in response to susanna240

This is something new.

There was another post about it recently.

As a test, run Malwarebytes for Mac and see what it says and also post an EtreCheck report.

Check for adware.

Use the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

For instructions: Install Malwarebytes for Mac Uninstall Malwarebytes for Mac

Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

Restart the computer and relaunch Safari holding the shift key down.

I would appreciate it if you would post back.

Download EtreCheck, https://etrecheck.com/maspro and post the report here.

Click “Click to download” button,

Open Downloads folder, click on it to open, and then select ”Open”.

“Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.

Click “Share Report” button in the toolbar, select “Copy report” .

Paste the report when you reply.

Note

This is a diagnostic test.

If 5000 words limit applies:

Split the report into two parts and post as two separate posts.

Reply

Answer 2

MadMacs0

Level 5

5,221 points

Mar 21, 2019 8:38 AM in response to susanna240

"Do you work for Apple?"

You will rarely see any posts from Apple here. They host the forum, but most all support is from fellow Mac users who help out here. You have to call AppleCare or visit an Apple Store Genius to receive support from them.

Reply

Answer 3

Eric Root

Level 10

684,039 points

Mar 21, 2019 8:45 AM in response to susanna240

I am a user like you, but I often recommend both programs dominic has suggested you use. They were both written by people who are participants in the Apple Support community and are recommended by long time posters as valuable troubleshooting tools.

Reply