Hello. Last week a have notification about file that will damage my computer. What I should do with that? Thank you

Posted on Nov 18, 2023 8:00 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 19, 2023 1:30 PM

Paul_M88, please follow the instructions below.



First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.


  • A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.


Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: How to use safe mode on your Mac - Apple Support. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".


The following files and / or folders need to be deleted while using your Mac in "Safe Mode":


First screenshot:


  • Drag the only file in that folder to the Trash.


Second screenshot:



Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now. Please read my comments regarding "Anydesk" later.


Next: open Safari and select the Safari menu > Preferences (or Settings) > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Then, select the Search pane and confirm your desired Search Engine. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).



There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.


Next: In an abundance of caution, examine System Preferences (or Settings) > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.


Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:



If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.


Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.


You can then restart your Mac and log in as usual. Launch Safari, evaluate its operation and ensure everything is working as you expect it should.


Next: Regarding the "Anydesk" product, the following Discussion may be of interest to you: AnyDesk installed by scammer - Apple Community. The only reason for mentioning it is the apparent installation date of that product is fairly recent, and if you contacted any number of unscrupulous entities in an attempt to rid that Mac of the problematic "StandardBoost.system" dialog (or any other problem) you may have invited additional troubles. If you are certain that you installed the "Anydesk" product intentionally and are certain that you need it, then please disregard this comment as irrelevant and unrelated to the problem at hand.


Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:


~/Library/Application Support


It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.


Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

14 replies
Question marked as Top-ranking reply

Nov 19, 2023 1:30 PM in response to Paul_M88

Paul_M88, please follow the instructions below.



First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.


  • A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.


Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: How to use safe mode on your Mac - Apple Support. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".


The following files and / or folders need to be deleted while using your Mac in "Safe Mode":


First screenshot:


  • Drag the only file in that folder to the Trash.


Second screenshot:



Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now. Please read my comments regarding "Anydesk" later.


Next: open Safari and select the Safari menu > Preferences (or Settings) > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Then, select the Search pane and confirm your desired Search Engine. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).



There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.


Next: In an abundance of caution, examine System Preferences (or Settings) > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.


Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:



If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.


Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.


You can then restart your Mac and log in as usual. Launch Safari, evaluate its operation and ensure everything is working as you expect it should.


Next: Regarding the "Anydesk" product, the following Discussion may be of interest to you: AnyDesk installed by scammer - Apple Community. The only reason for mentioning it is the apparent installation date of that product is fairly recent, and if you contacted any number of unscrupulous entities in an attempt to rid that Mac of the problematic "StandardBoost.system" dialog (or any other problem) you may have invited additional troubles. If you are certain that you installed the "Anydesk" product intentionally and are certain that you need it, then please disregard this comment as irrelevant and unrelated to the problem at hand.


Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:


~/Library/Application Support


It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.


Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Nov 18, 2023 12:14 PM in response to Paul_M88

You will not find a file bearing that name anywhere on your Mac.


EtreCheck is likely to identify the cause. To learn how to post its report in a reply to this Discussion, please read How to use the Add Text Feature When Posting Large Amounts of Text, i.e. an Etrecheck Report - Apple Community. Actually removing the cause will require more assistance, so post that report and wait for an answer.


EtreCheck may even be able to suggest the files you need to remove, in which case you may not need any more help. Refer to the following recent Discussion: How do I get rid of this popup notification? - Apple Community. But if you want to share that report here, you are welcome to post it.

Nov 18, 2023 5:40 PM in response to Paul_M88

You don't have to go to a store for help.


I need either that EtreCheck report or the three screenshots described in Removing "Search Marquis" / "Search Baron" / etc on your own - Apple Community.


You can follow either one of those sets of instructions — EtreCheck or that User Tip. It's up to you. I can work with either one. Or both. EtreCheck is more comprehensive while Removing "Search Marquis" / "Search Baron is more targeted for this specific concern.

Nov 26, 2023 7:54 PM in response to Paul_M88

The Documents folder shown in that screenshot should not be there. It is not useful in that location. How it came to arrive in that location is a mystery.


To change that folder's Permissions so that you can inspect its contents and / or delete it, follow these instructions: Change permissions for files, folders, or disks on Mac - Apple Support


The instructions I posted earlier should be sufficient to remove the StandardBoost.system dialog. Please confirm that you removed the file shown here:



That folder should be empty.

Nov 26, 2023 8:22 PM in response to Paul_M88

Sure, but restoring a Time Machine backup would be preferable.


The fact you had trouble running EtreCheck may have been an indication of some other, underlying problem. In such cases restoring macOS is a worthwhile first step, but in the end if a Mac is so messed up erasing it may be necessary.


Recover all your files from a Time Machine backup - Apple Support

Reinstall macOS - Apple Support

Erase and reinstall macOS - Apple Support

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Hello. Last week a have notification about file that will damage my computer. What I should do with that? Thank you

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.