Popup Warnings of Malware

My problem is this, I hit cancel and after I did so, the pop-up was modal and re-appeared. I cannot do anything until this pop-up goes away. Sure I can move it aside, but MacOS insists that I click on the trash button to get rid of it. SOOOO ANNOYING! If I hit CANCEL, it means I wish to cancel the pop up. It literally comes back within 4 seconds of cancelling. Apple, I own my computer, NOT YOU!

As others on this thread have reported I too suddenly saw this pop up and was concerned. I'm fairly certain I had Citrix installed at one time and think maybe this was some left over software from that install which may now be indicated as malware (Just a hunch). That said, I was not comfortable typing my password into he dialog box when trying to move files to the trash via the UI. So I decided to use terminal instead... The files are in /usr/local/libexec (that they're in /usr/local makes sense from a user installed application). There were three files in there, ServiceRecords and ReceiverHelp being two of them. I just decided to remove all three as the third, something mac_auth like isn't something I recalled installing and isn't a service directory.

From the terminal:

cd /usr/local/libexec

sudo rm ./*

Notice the period before the slash... Then it will prompt you for your password (as sudo typically does), but will be on the command-line not in a UI. That command will delete EVERYTHING from that directory down with a prompt for y/n. If you're unsure or uncomfortable at the command-line done do this.

I was also getting the two incessant pop-ups referenced here. A bit of research was performed and I quickly discovered these are files associated with the Citrix Receiver. These files have been on my Mac since 2015 (it's 2020 and we are going through the whole COVID-19 pandemic). These popups started after I upgraded my Mac OS to 10.15.3 and then performed a Malwarebytes update and then performed a malware scan. Malwarebytes itself does not see these files as malware.

To eliminate the two messages, I clicked the "Show in Finder" button on the alerts and then moved the files in question to trash. The files were located in the libexec folder.

So that others can find this error via a Google search, here is the content of the messages:

"ServiceRecords.app" will damage your computer.

This file was downloaded on an unknown date.

Report malware to Apple to protect other users

"ReceiverHelper.app" will damage your computer.

This file was downloaded on an unknown date.

Report malware to Apple to protect other users

Did this popup come via email? If it didn't come from outside, then it was triggered by anti-malware software on the computer. macOS has built-in anti-malware software. But you stated you have none installed by you, correct? In that case I would go ahead and delete the two items. They may not be malware but they aren't part of macOS.

From the official Citrix webpage:

https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/install-uninstall.html

I did this today and then installed Citrix Workspace for Mac, which is Citrix's official replacement for Citrix Receiver.

EDIT: Just as a precaution, I clicked on "Show in Finder", which I then simply moved the "offending" files to the Trash Bin, which I then deleted. Afterwards, I then followed the official Citrix uninstall procedure.

Hi,

I had the same problem today. I have just spoke to Apple Care who shared my screen and resolved the problem really quickly and efficiently. The advisor prompted me to bin the files and then empty my bin (this required my Mac password).

As a precaution, he suggested I scan my Mac for malware. I did so using the free version of 'Malwarebytes' as he claimed it was very reliable.

I have not recently downloaded anything from the internet which strange - the advisor suggested that due to Mac security updates, the Mac may have only recently identified these files as harmful.

I hope you find this reply useful!

:-)

I had exactly the same problem this morning! (2 pop ups warning about 'ServiceRecords' and 'ReceiverHelp'). I was not doing anything remarkable at the time other than to observe that my network had some momentary problems and my computer restarted on its own. After it came back up, I had the two messages that I could not remove. I rebuilt my HD with TimeMachine going back to last night and the problem persisted. I also tried 2 virus detection apps and they could not find the problem. After seeing this post, I deleted the two files and restarted. Problem resolved. I was not able to uninstall Citrix Receiver (uninstall program became unresponsive) but hopefully this is not a problem.

Same problem. Same solution. Click "show in finder", move (manually) to trash.

Open trash, delete the files.

Go to Citrix home page and install again.

So far so good.

It would be nice to know what happened!

^ I had same warnings. Asked for password. Would not trash without password. Very odd.

Went to prefs. Temporarily set password to none. Successfuly trashed ReceiverHelp.app and ServiceRecords.app. Emptied trash and reset password.

I will apply the same, but I remain concerned that there could be residual malware on my Mac.

It would be better if Apple (or another reliable vendor) could investigate this and provide a solution quickly to put my mind at rest.

I don't want to have to rebuild my machine.

Concerned because I logged in on my iMap this morning and received the same two messages, which warns they will "damage your computer". Yikes !!! The two files date back to 2014 and were transferred from my old MacBook Pro to my new iMac when I purchased it a year ago. I've not used my iMac in a week and haven't downloaded any new files recently! Happy, are you sure its safe to delete these?

I also got the same messages. Deleted the files after the password prompt, but concerned as well that these just popped up this morning. Strange issue and Mac is usually difficult to hack. It was the citrix files that I had to delete.

I'll update if anything comes up later as a result.

I have the same problem this morning, and have MalwareBytes running all the time, but it did not catch this. I'm concerned that this seems to be a very recent problem and nobody from Apple has responded in this thread.