How to remove viruses or malware not found by Norton or other antivirus programs?

I am forced to restore from a Time Machine backup since the old system drive (128GB) stopped working and I have installed a new larger drive and are about to restore to a working MacBook Pro again now.


I expect there were viruses in the old OS X files, is it possible to reinstall a fresh version High Sierra on the new system drive and then to restore only my personal files and programs easily and not so time consuming? Probably not. Those viruses are probably also spread outside the OS X? Or are the viruses mostly spread only in the system files?


Because there are programs that only works in High Sierra I would still want to stay with that older OS X.


Programs seemingly involved with virus or trojan activities were:

  • Google Chrome (I stopped using it after it behaved badly changing search engine on its own and forwarding me to bad sites) and I suspect it also changed the firewall settings, to open for a while, although I shut it afterwards.
  • Evernote. Although I never saw any viral activity using Evernote, but once Norton found a virus file amongst the Evernote files
  • Finder? When I visit friends and share their internet (I usually do by my ethernet cable), other computers tries to log into my Macbook Pro. It is over a year since but anyway not the best feeling when that occurs.


Any advice? I need to retrieve and restore my personal files, documents etcetera, so installing from scratch clean and then manually install personal files would probably take a huge amount of time.

MacBook Pro 13″, macOS 10.13

Posted on Jul 18, 2022 5:50 AM

Reply
Question marked as Top-ranking reply

Posted on Jul 18, 2022 6:31 AM

First, you should remove any anti-virus apps, as well as anything that claims to "clean", "speed up", "refresh", etc. your Mac (such as CleanMyMac, CCleaner, and many others). These apps are useless at best, and downright malicious at worst, often removing important system files to free up space that doesn't become evident until much later. Apple's built in security is all that is required.


You can read more about anti-virus softwares here and Mac's already sufficient built in security here. The only exception to this is Malwarebytes, which you can read about below. The important thing to remember is that YOU are the best defense against malware. Use your common sense when downloading anything from the Internet (especially if Mac advises against it). Apple's advice regarding malware can be found here. There are no native viruses that can harm Macs in the wild.


Your Chrome issue sounds related to an accidentally downloaded piece of adware. Besides this, Chrome is a known memory hog that won't run too well on High Sierra anyway. Other good options include the built-in Safari, Firefox, or Brave.


If you want to scan your Mac for malware, Malwarebytes is a generally trusted choice, as it was developed a while ago by a trusted member of this community. You can download it for free here. Any other anti-virus softwares should be skipped, no matter how tempting they sound. Use this before proceeding with the use of Migration Assistant below.


For your Time Machine backup restoration, follow the instructions here to start. See the image below, and only transfer what you need to. If you can get your downloaded Applications again without too much trouble, don't import them with Migration Assistant. Your User Profile contains everything in your Finder's Home folder. If your Malwarebytes scan identifies issues in certain areas of your computer, don't import the sections if you want to be absolutely sure no malware comes through. It's often difficult to remove it yourself (and developer instructions are usually less than helpful).



I hope this helps!

Similar questions

9 replies
Question marked as Top-ranking reply

Jul 18, 2022 6:31 AM in response to Norwegian_Macfan68

First, you should remove any anti-virus apps, as well as anything that claims to "clean", "speed up", "refresh", etc. your Mac (such as CleanMyMac, CCleaner, and many others). These apps are useless at best, and downright malicious at worst, often removing important system files to free up space that doesn't become evident until much later. Apple's built in security is all that is required.


You can read more about anti-virus softwares here and Mac's already sufficient built in security here. The only exception to this is Malwarebytes, which you can read about below. The important thing to remember is that YOU are the best defense against malware. Use your common sense when downloading anything from the Internet (especially if Mac advises against it). Apple's advice regarding malware can be found here. There are no native viruses that can harm Macs in the wild.


Your Chrome issue sounds related to an accidentally downloaded piece of adware. Besides this, Chrome is a known memory hog that won't run too well on High Sierra anyway. Other good options include the built-in Safari, Firefox, or Brave.


If you want to scan your Mac for malware, Malwarebytes is a generally trusted choice, as it was developed a while ago by a trusted member of this community. You can download it for free here. Any other anti-virus softwares should be skipped, no matter how tempting they sound. Use this before proceeding with the use of Migration Assistant below.


For your Time Machine backup restoration, follow the instructions here to start. See the image below, and only transfer what you need to. If you can get your downloaded Applications again without too much trouble, don't import them with Migration Assistant. Your User Profile contains everything in your Finder's Home folder. If your Malwarebytes scan identifies issues in certain areas of your computer, don't import the sections if you want to be absolutely sure no malware comes through. It's often difficult to remove it yourself (and developer instructions are usually less than helpful).



I hope this helps!

Jul 18, 2022 7:36 AM in response to Norwegian_Macfan68

Norwegian_Macfan68 wrote:

Highly appreciated! So you recommend installing the High Sierra OS X from fresh before doing the Restore?


Exactly. You'll need to reinstall OS X High Sierra, then use Migration Assistant to transfer the files.


To get High Sierra, first try booting into Recovery with Shift-Option-Command-R during startup to be offered the macOS that came with your Mac, or the closest version still available. If that's not High Sierra, you'll need to install it from the App Store's old installers. You can find High Sierra here - macOS High Sierra - App Store


If you can't install it with the installer (especially if you erase your disk), you'll need to make a bootable installer. Instructions can be found here.


Post back with any problems you have!

Jul 21, 2022 8:01 AM in response to Norwegian_Macfan68

To perform this action will require booting from a Bootable Installer


The Bootable Installer can Only be performed on an Apple Computer 


This will have to be performed from a Qualifying Computer to run the version of macOS to be made on the Bootable Installer. Example : Bootable Installer of High Sierra would have to be done on a computer that Qualifies to run High Sierra.


Notation: If the computer being used to perform this action is Too New or Too Old to qualify to run the version of macOS - this computer can not be used.


Alternative is, to gain access to a Qualifying Apple Computer from a family member, friend or associate.


Once that is done read on for preparing the Destination computer  >> Only works on Intel Based Apple Computers.


1 - Shutdown computer and disconnect all external drive Except the newly created Bootable Installer.


2- Restart and immediately hold the OPTION key until the Startup Manager appears and choose the USB Drive. 


3 - It will present options >> Disk Utilities >> View >> View ALL attached Drives. 


4 - Choose the Upper Most Drive ( not the volumes indented and list below ).


5 - Formatting for macOS 10.13 High Sierra and below requires HFS Journaled with the GUID Partition Map


6 - Once that is done >> backup out of Disk Utilities and choose install macOS. 


7 - Follow the prompts and it may automatically reboot several time. 


8 - Upon a final reboot - Setup Assist will present with the newer version of macOS.

Jul 18, 2022 6:20 AM in response to Norwegian_Macfan68

first off, there are no viruses that affect the Mac. you should uninstall Norton and / or any other antivirus apps that you have installed. those types of apps are well known to negatively affect macOS while providing zero benefits due to the sealed system that only apple can make changes to.


that said, from your description it does sound like you have managed to install some malware / adware. I will recommend downloading and running the free version of Malwarebytes for Mac. it will remove most malware from your Mac. and once you're done with it, you can use these instructions to remove it. uninstall Malwarebytes for Mac,


and finally, you should read this informative user tip to help you stay safe in the future. Effective defenses against malware and other threats - Apple Community. it's a long article, but it's worth your time to read every word.

Jul 18, 2022 8:59 AM in response to Norwegian_Macfan68

Don't worry- app preferences aren't stored in macOS. Time Machine takes care of that (it basically clones your system). It does not backup macOS, as that would be redundant and a waste of space (macOS X High Sierra is the same everywhere). After you reinstall macOS on your new disk, simply use the aforementioned Migration Assistant to move your data (including app preferences and settings).


Bottom line- your Keyboard Maestro settings are safe ;)

Jul 18, 2022 7:28 AM in response to -Bubba-

Thank you! Highly appreciated! So you recommend installing the High Sierra OS X from fresh before doing the Restore? My reason to ask is that I guess there are user specific files amongst the OS X files which were backed up by Time Machine which relates to programs I have installed which might be necessary for them to run properly?


And would the procedure booting via the internet (rescue mode), then installing & restoring from Time Machine install the original OS X I want (High Sierra)? Or do I risk that a newer OS X would be installed? Any reasons for not going with the internet rescue mode boot up routine?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How to remove viruses or malware not found by Norton or other antivirus programs?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.