Popup Warnings of Malware

From the official Citrix webpage:

https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/install-uninstall.html

I did this today and then installed Citrix Workspace for Mac, which is Citrix's official replacement for Citrix Receiver.

EDIT: Just as a precaution, I clicked on "Show in Finder", which I then simply moved the "offending" files to the Trash Bin, which I then deleted. Afterwards, I then followed the official Citrix uninstall procedure.

Hi,

I had the same problem today. I have just spoke to Apple Care who shared my screen and resolved the problem really quickly and efficiently. The advisor prompted me to bin the files and then empty my bin (this required my Mac password).

As a precaution, he suggested I scan my Mac for malware. I did so using the free version of 'Malwarebytes' as he claimed it was very reliable.

I have not recently downloaded anything from the internet which strange - the advisor suggested that due to Mac security updates, the Mac may have only recently identified these files as harmful.

I hope you find this reply useful!

:-)

I was also getting the two incessant pop-ups referenced here. A bit of research was performed and I quickly discovered these are files associated with the Citrix Receiver. These files have been on my Mac since 2015 (it's 2020 and we are going through the whole COVID-19 pandemic). These popups started after I upgraded my Mac OS to 10.15.3 and then performed a Malwarebytes update and then performed a malware scan. Malwarebytes itself does not see these files as malware.

To eliminate the two messages, I clicked the "Show in Finder" button on the alerts and then moved the files in question to trash. The files were located in the libexec folder.

So that others can find this error via a Google search, here is the content of the messages:

"ServiceRecords.app" will damage your computer.

This file was downloaded on an unknown date.

Report malware to Apple to protect other users

"ReceiverHelper.app" will damage your computer.

This file was downloaded on an unknown date.

Report malware to Apple to protect other users

Citrix Receiver has nothing to do with ReceiverHelper. Both items mentioned in the warning are part of malware the user installed.

Download and run MalwareByes for Mac. It may be able to recognize and remove it. The software is free to use and easily uninstalled from its menus when you're done.

Call Apple customer service immediately. I tried tinkering around with mine for a couple of hours and I couldn't figure it out, despite following step by step tutorials via youtube and directions on various threads. I gave up and called Apple and they walked me through fixing the problem within 15 minutes. It's malware and it's super annoying -- if you, like me, are not tech literate, call Apple. You can share your screen with them and they'll get you fixed up.

I had exactly the same problem this morning! (2 pop ups warning about 'ServiceRecords' and 'ReceiverHelp'). I was not doing anything remarkable at the time other than to observe that my network had some momentary problems and my computer restarted on its own. After it came back up, I had the two messages that I could not remove. I rebuilt my HD with TimeMachine going back to last night and the problem persisted. I also tried 2 virus detection apps and they could not find the problem. After seeing this post, I deleted the two files and restarted. Problem resolved. I was not able to uninstall Citrix Receiver (uninstall program became unresponsive) but hopefully this is not a problem.

Did this popup come via email? If it didn't come from outside, then it was triggered by anti-malware software on the computer. macOS has built-in anti-malware software. But you stated you have none installed by you, correct? In that case I would go ahead and delete the two items. They may not be malware but they aren't part of macOS.

I'm going to take a guess that these 2 files are not malware at all, but leftover Citrix 32 bit apps that are no longer compatible with MacOS which is now 64 bit only. Why apple had to label them malware, I don't know. Maybe somehow they are unsafe, or cause crashes.

I believe that this was part of Citrix Receiver, an outdated remote desktop app. I don't think it is malware per se, but since it is outdated, it may have security vulnerabilities that caused it to get flagged.

For me, these two items belong(ed) to the Citrix and Citrix Receiver programs, which I had previously used to access my employer network remotely. I now have a work laptop, so just got rid of Citrix on my Mac altogether today. Strange, though, how this error never popped up until I restarted my Mac today (and kept popping up over and over again) after trying to get a Pages update unstuck (it had been "waiting" for a literal month). I have a MacBook Pro 13-inch 2017 with the four Thunderbolt 3 ports running macOS Catalina 10.15.1, just FYI. This may pose a real problem for people working remotely at the moment r/t the pandemic. Hope this helps!

Those are not macOS apps. From where are you getting the malware warnings?

You need to completely uninstall the Citrix software, then reinstall it from scratch. This is an issue others who use Citrix are having, also.

Happened to me yesterday on a very new MacBook Pro...called Apple Support and we spent about 30minutes going through everything. It all appears ok-removed and trashed the files/programs. Not sure what prompted this-but removed it nonetheless. Hope that is enough!

^ I had same warnings. Asked for password. Would not trash without password. Very odd.

Went to prefs. Temporarily set password to none. Successfuly trashed ReceiverHelp.app and ServiceRecords.app. Emptied trash and reset password.