I was told I have a csrss.exe trojan on my Mac and need to buy Cisco

Scammers are out there. @ServantofCats has made a valid point about mistyping website addresses.

I believe it likely that the "fatal error..." popup may have been a scam to entice you to call or click into a suspicious website.

The constant notifications that you receive about your data security are likely scams, especially if these are coming at you via your email. Browser popups are usually scams as well. You should know that your computer cannot be scanned by a random website. These notifications that say "viruses have been detected" are definitely scams and may be safely closed and ignored. It happens to everyone.

If you are concerned about the security of your various passwords, you can change the most critical of these and continue to closely monitor your accounts.

If you want to keep your Mac secure and free from malware, here are just a few things to consider.

• Keep your software updated and macOS is capable of keeping itself secure.

• There is no need to run any anti-virus, cleaners, optimizers or VPN apps. These apps often cause more problems and headache than they prevent because they conflict with the macOS’ built in securities. If you have this type of app installed, you should uninstall it according to the developer's instructions, and use best practices when using your Mac.

• Don’t click links in email.

• Don’t download apps from unknown websites.

• Don’t disable your Mac’s built in security.

For more info, please see these support documents:

• Effective Defenses Against Malware - Apple Community

• Avoid phishing emails, fake 'virus' alerts…and other scams - Apple Support

D.I. Johnson wrote:

For your own edification, you may wish to download and run a copy of Malwarebytes on your Mac.

Malwarebytes is one of very few anti-malware programs that gets a thumb-up here in the Apple Communities.

You must download it directly from the publisher at malwarebytes.com.

Start with the free download and run the scan. It's probably all you need to ensure that you Mac is currently free of malware.

The OP should also remove the third-party remote access application that the scammers used, whether or not it shows up on a malware scan.

leightmoore wrote:

"Mark" called me, and asked if he could access my computer using "LMIrescue" app, which gave him access to my computer. He opened my activity log and terminal and showed me that several processes on my computer were "sleeping" and I had the trojan on my computer--it was even labeled "trojan"--and that it was stealing my identity and providing access to all my data. He said it was blocking the driver from being downloaded, and I needed to allow their techs to "clean" my computer and secure my IP address.

Several processes were "sleeping"? It is normal for many processes to be sleeping! A modern operating system such as macOS, Windows 10/11, or Linux has dozens upon dozens of background processes. They sleep most of the time, waking up only when presented with an event that tells them that they have work to do.

Finding a process with the name "trojan" would be more concerning, though I can't tell if this guy actually found a piece of malware, or if he pulled a sleight of hand so that it just looked like he had found one. That would be part and parcel of a scammer's bag of tricks.

He gave me a list of what the HP techs would do:

-Optimize computer and network

-Remove all the trojan file

-Remove all the spyware and block them

-Restart all the services

-Optimize my IP address

Optimize the IP address? That sounds like word salad to me – and I think it would to anyone working in the field of computer networking. A huge red flag.

Now I feel like I was scammed, but even more, I'm really really scared these scammers stole all my passwords and data while I thought they were fixing my computer. Three questions: 1-WAS this a scam? 2-HOW did they scam me straight from the HP website? 3-Is there a way to know if they stole all my data while "fixing" my network?

I think you were scammed. When I did a Google search using the search terms "123.hp.com scam", several HP Community threads (including these) popped up.

HP Community – Got Scammed on Fake 123 Site - October 10, 2023

HP Community – I was scammed by someone when I entered 123.hp.com ...

HP Community – I think I have been scammed

Also see:

HP – HP Fraud Alert: Protecting yourself from scams

"Scammers might call you on the phone and pose as representatives from HP technical or customer support. In some cases, scammers mask their originating phone number (Caller ID spoofing) so the calls appear to be from a genuine HP contact number."

FTC – How To Spot, Avoid, and Report Tech Support Scams

Finally, how the bleep am I supposed to know what's legit if I follow the written directions out of the box with my printer and get scammed? I'm really frustrated and nervous...

For your own edification, you may wish to download and run a copy of Malwarebytes on your Mac.

Malwarebytes is one of very few anti-malware programs that gets a thumb-up here in the Apple Communities.

You must download it directly from the publisher at malwarebytes.com.

Start with the free download and run the scan. It's probably all you need to ensure that you Mac is currently free of malware.

The app can easily be removed after use by following the publisher guidance here.

leightmoore wrote:

Is there a way to report these guys? Or do you think they're just gone?

If you gave these scammers any bank account or credit card account numbers, you need to contact the banks involved right away. They may want to cancel your accounts - under their current numbers - and reopen them with numbers that the scammers do not know. The FTC also suggests that you can ask if they can reverse the charges.

If you are worried about these criminals committing identity fraud against you, you might want to review

FTC - What To Know About Credit Freezes and Fraud Alerts

Are you sure that you went to the official HP site?

If you made a typo when entering the URL, you might have gone to a site set up by scammers who were hoping that a few people would type in the wrong URL, and not realize that they were connecting to someone other than HP.