I keep getting fake Virus alerts on my Mac. Luckily I know they are fake, because they want money. I think its from an app I installed a while ago. I uninstalled the app, but the popups are still coming. Is there a cache I need to clear or something?
Mac mini, macOS 12.6
Probably that app also installed other bits like agents or daemons, so just dragging the application to the trash did not completely eradicate it.
You may want to run the diagnostic program Etrecheck and post its report here so we can look for the bad actors involved.
Probably that app also installed other bits like agents or daemons, so just dragging the application to the trash did not completely eradicate it.
You may want to run the diagnostic program Etrecheck and post its report here so we can look for the bad actors involved.
Your only notifications are from Safari. These must be web notifications. Go to Safari > Preferences > Websites > Notifications. You should see that site listed. Change the notification setting to "Deny".
You may want to take a look at the /etc/hosts file.
Do NOT make any changes for now (it could make you lose connection to the internet, if you mess it up).
To reach the file, launch TextEdit, choose File->Open, the press Command-Shift-G and paste
/etc/hosts
The default content of the file is like the last lines below (starting with ##).
Yours clearly have a lot of stuff, which usually should not be there.
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
If you didn't make these changes in the System Preferences > Sharing yourself, I'd be concerned these are on:
Screen sharing: Enabled
Remote login: Enabled
Covenant Eyes
Project Llama
These items catch my eye. You might want to research them. Have you run the free version of MalwareBytes on your boot drive (if already installed)? If not already installed you might not want to download additional software given the nature of your concern.
The EtreSoft program itself or its documentation will walk you through the steps to follow to remove the putative miscreants.
Did you deliberately edit the /etc/hosts file?
/etc/hosts - Count: 197
This is unusual. My guess is that may be the work of that Covenant Eyes software. It seems to be meant to block access to things.
By the way “projectllama” mentioned is related to the grammarly software. You can uninstall it if you want but it is unlikely that it has anything to do with the issue at hand.
I don't even know what that file is so no.
There is 0 chance this has anything to do with covenant eyes. I've had covenant eyes for years and the problems didn't start until I installed an app just a few days ago.
Also yes I doubt Project Llama is malicious.
Report is attached.
Covenant Eyes was installed by me and belongs on the computer. Project Llama was not. How do I remove it?
Yes I did that. I sometimes use a VNC.
It's a perfect match for what you put.
Fake Tech support popup on Mac