I got two popup warnings this morning that 'ServiceRecords' and 'ReceiverHelp' will harm my computer (MacBook Pro). These are two applications that, to the best of my knowledge, have been on the computer since it was first purchased.
Having gone through the help information associated with the warnings I moved the two identified applications to the Bin.
Are the applications required for anything? Should I delete them? What happens if I do?
MacBook Pro 13", macOS 10.15
From the official Citrix webpage:
https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/install-uninstall.html
I did this today and then installed Citrix Workspace for Mac, which is Citrix's official replacement for Citrix Receiver.
EDIT: Just as a precaution, I clicked on "Show in Finder", which I then simply moved the "offending" files to the Trash Bin, which I then deleted. Afterwards, I then followed the official Citrix uninstall procedure.
I also got the same messages. Deleted the files after the password prompt, but concerned as well that these just popped up this morning. Strange issue and Mac is usually difficult to hack. It was the citrix files that I had to delete.
I'll update if anything comes up later as a result.
I have same problem- How do I delete?
I also deleted the files that were related to Citrix in my case. Resolved the problem. I also installed 'Malwarebytes' and it picked up a few items that were not related to Citrix.
They came up on my screen when I turned on the computer this morning.
I went to open an old Word document via Finder, which had been transferred from the HDD of a Windows based computer, which we had got rid of after changing to Apple devices. There were no other programs running at the time. MS Word started up and the document opened. At the same time got the warning popup about the two items.
Check of the applications' information shows that they were both created in Oct 13 and last opened in Nov 14, which is about the time I got the MacBook Pro.
I will apply the same, but I remain concerned that there could be residual malware on my Mac.
It would be better if Apple (or another reliable vendor) could investigate this and provide a solution quickly to put my mind at rest.
I don't want to have to rebuild my machine.
Concerned because I logged in on my iMap this morning and received the same two messages, which warns they will "damage your computer". Yikes !!! The two files date back to 2014 and were transferred from my old MacBook Pro to my new iMac when I purchased it a year ago. I've not used my iMac in a week and haven't downloaded any new files recently! Happy, are you sure its safe to delete these?
I have the same problem this morning, and have MalwareBytes running all the time, but it did not catch this. I'm concerned that this seems to be a very recent problem and nobody from Apple has responded in this thread.
I got the same two messages about ReceiverHelper and Service Records. When I opened in Finder they were in a folder "libexec" with AuthManager_Mac. Should I also delete AuthManager_Mac and the folder "libexec"?
My problem is this, I hit cancel and after I did so, the pop-up was modal and re-appeared. I cannot do anything until this pop-up goes away. Sure I can move it aside, but MacOS insists that I click on the trash button to get rid of it. SOOOO ANNOYING! If I hit CANCEL, it means I wish to cancel the pop up. It literally comes back within 4 seconds of cancelling. Apple, I own my computer, NOT YOU!
When I try to move the files to the Trash Can it asks for my password. That seem suspicious. Is that normal? Also, a quick Google search shows there is a Service Records malware. Is it the same?
ServiceRecords.app popped up on my MacBook Pro as a malware. How do I get rid of it?
I had the same, I applied your recipe, seems to be solved. Thank you
Thanks. Have already deleted the files as previously suggested and this has solved the problem, but will run the Malware program as Apple suggested to you.
Same problem. Same solution. Click "show in finder", move (manually) to trash.
Open trash, delete the files.
Go to Citrix home page and install again.
So far so good.
It would be nice to know what happened!
As others on this thread have reported I too suddenly saw this pop up and was concerned. I'm fairly certain I had Citrix installed at one time and think maybe this was some left over software from that install which may now be indicated as malware (Just a hunch). That said, I was not comfortable typing my password into he dialog box when trying to move files to the trash via the UI. So I decided to use terminal instead... The files are in /usr/local/libexec (that they're in /usr/local makes sense from a user installed application). There were three files in there, ServiceRecords and ReceiverHelp being two of them. I just decided to remove all three as the third, something mac_auth like isn't something I recalled installing and isn't a service directory.
From the terminal:
cd /usr/local/libexec
sudo rm ./*
Notice the period before the slash... Then it will prompt you for your password (as sudo typically does), but will be on the command-line not in a UI. That command will delete EVERYTHING from that directory down with a prompt for y/n. If you're unsure or uncomfortable at the command-line done do this.
Popup Warnings of Malware
