I am repeatedly getting this pop-up on my Mac:
It does not appear that there is an Uninstaller application on MacOS, so this seems suspicious. But Malwarebytes does not find anything (until recently I used Avast antivirus, which also did not find anything) and I have not been able to find any reports of similar behavior online.
Any ideas what this is?
[Edited by Moderator]
MacBook Air 13″, macOS 14.4
I think MartinR is close to the issue. Doing an image lookup in Google, the site shows the icon as belonging to Avast BreachGuard.
Avast's own site confirms what you're seeing is part of their junk, as shown in the "how to uninstall" section:
https://support.avast.com/en-us/article/315/#mac
It's a known issue that Avast is incredibly difficult to remove.
I think MartinR is close to the issue. Doing an image lookup in Google, the site shows the icon as belonging to Avast BreachGuard.
Avast's own site confirms what you're seeing is part of their junk, as shown in the "how to uninstall" section:
https://support.avast.com/en-us/article/315/#mac
It's a known issue that Avast is incredibly difficult to remove.
I suspect it's the process called "SecurityA..." Note the grey icon next to SecurityA... looks like the symbol in the Unistaller message and the fact that it's associated with your username "mauryshenk." I suspect it's a leftover from removing Avast.
It would be more helpful to have the complete name of the "SecurityA..." process, which you will see if you expand the Process Name column.
DO NOT just terminate the process or attempt to remove it without further research on the possibility that it may be something other than Avast. (For example, that process could turn out to be part of macOS security.)
Use Spotlight to search for anything "Avast" or its components that may remain on disk. Also contact Avast for help with full removal of the app. Antivirus apps are notoriously difficult to remove.
First use the uninstaller provided by Avast, then post the free EtreCheck report using the Additional Text option when posting. This will show the files that continue to run on startup that is causing the problem.
Having Avast "mostly" removed from you computer is not good enough. It is not unusual for the uninstaller to not remove all files. Posting the EtreCheck report will be essential to identify these files.
I took the suggestion of Mac Jim ID of using EtreCheck (after spending some time on the various information online about whether that software is safe, and ultimately trusted what is posted in this community).
EtreCheck was able to find and remove a "user launch agent" for Avast Uninstaller, also stating that the target Avast executable had already been removed.
I think I'll leave it there for the time being. It seems that my computer is safe from various checks (including EtreCheck) performed today, and the pop-up agent seems to be removed.
I am a longtime Mac user, and this is my first time getting help in this community. I am very impressed. Thanks to all.
Did you recently install any new apps ... or recently attempt to remove any apps?
Does this pop-up occur only when you have a browser open (Chrome, Safari, Firefox, etc)?
Just a guess, but you said "until recently I used Avast antivirus ..." and the orange icon in the pop-up is the same color Avast uses ... this could be a leftover from Avast.
sailormaury wrote:
Any further recommendations on how to get rid of this?
Contact Avast -> https://support.avast.com/en-us/article/contact-support/#mac.
This is all extremely helpful.
The Uninstaller pop-up on the Avast web page that Kurt Lang links is the same one I am getting.
I had already run the Avast uninstaller and I believe its components are (mostly) off my computer. I spent a long time with Apple support on the telephone today, and they looked for Avast components and could not find any. (They ultimately concluded that the pop-up was an HP application because there is an HP file on my computer called Uninstaller.rb, but I do not think that is correct.)
On the question from MartinR, the process he identified appears to be called SecurityAgent. It was gone when I looked (I had closed the pop-up window) but then briefly popped up and disappeared again while I was looking at Activity Monitor.
Any further recommendations on how to get rid of this?
I’ve never seen anything like that in macOS, and Apple has never provided any sort of uninstall system.
It must be something you installed.
I install apps from time to time, but I am quite careful about checking where they are from. I believe the only recent changes were to remove Avast and install Malwarebytes (your comment about Avast is interesting -- my decision to remove Avast was in part because of suspicion about this pop-up).
The pop-up seems to occur intermittently. It usually comes up when I have Chrome open, as I do much of my computing in Chrome. I have looked for suspicious add-ons to Chrome and have not found any.
I did get tricked by the pop-up once and put in my admin password, which I changed shortly thereafter. I doubt this will have compromised other passwords, because I use a different password for everything (including my password keeper), but I am not certain: :-( I have not noticed any other suspicious activity.
I have some further information on this issue and would appreciate any reactions, including where I might report this malware which seems to be invisible to Malwarebytes and hiding in MacOS.
The Uninstaller pop-up appeared again this morning, just after I had agreed to update Microsoft Word. I them shut down all applications on my computer (including Chrome), and the Uninstaller window remained but was not visible in the Force Quit Applications window on MacOS. See screenshot:
Does anyone know whether any of the processes shown in Activity Monitor are suspicious?
I also this time attempted putting a wrong password into the Uninstaller pop-up and got the wrong password "shake" with the pop-up remaining visible, so it is definitely checking the system password rather than just logging input.
Congrats. We all hope that's the end of this particular issue.
This is a great community. I have not only been helped here over the years, but have also learned a lot from other participants. Come back!
Glad your issue has been resolved. I don't blame you for being suspicious of recommended solutions that involve running software from a provided link. EtreCheck is a safe program and was developed by a fellow user here on these forums. It is very effective in showing you files that are running on startup and users here also post the report for suggestions on how to proceed with solving a problem. The report provides a comprehensive picture of what is going on with your computer and does not show any personal information. We are here to help.
You will find that if anyone gives you false information, they will immediately be called out by other users and this self policing along with moderator input has been very effective on this site.
sailormaury wrote:
(including my password keeper),
What password keeper...?
I use MacOS Keychain Access with a different password to access the passwords from the system password. The password for accessing the passwords is not stored electronically.
Uninstaller Pop-Up on MacOS
