Trying to Fix "Buffer" Pop-Up: Need Help Deciphering What Files Could be Damaging

mv_5, I understand you are encountering an "<app> will damage your computer" message upon startup; the app in question identified as "Buffer".

You are unlikely to find an app by that name anywhere on your Mac, but the annoying message persists. To stop the harassment please follow the instructions below.

This is the first of two replies so please be sure to read the next one.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your files with Time Machine on Mac.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Start up your Mac in safe mode - Apple Support. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Third screenshot:

Nothing needs to be deleted from the folders in the second screenshot.

Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: These next few steps may be optional but review them anyway.

Open Safari and select the Safari menu > Preferences (or Settings) > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Then, select the Search pane and confirm your desired Search Engine. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

• Specifically for Google Chrome: If you use it, you will also need to reset the Chrome product to its default settings. To learn how to do that read https://support.google.com/chrome/answer/3296214?hl=en
• No one, especially Mac users, should be using Google Chrome anyway.

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences (or Settings) > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Reply Part 2 of 2 follows next.

You are asking for what might be malware or unknown and likely malware.

That can not be answered in isolation, because you have several other very damaging packages installed, and you likely installed them deliberately.

By far the easiest way to cause poor performance, instability, overheating and crashing is to install ANY third-party speeder-uppers, Cleaners, Optimizers, Third-party Virus scanners, Bit Torrent, or a VPN that you installed yourself. They are relentless in scanning your files, non-stop, looking for virus-like patterns in Everything, or looking for files that have changed. When completed, they do it all again.

The idea that a third party, with no special knowledge of the inner workings of MacOS, can somehow find a simple way to protect or speed up your computer — that is not already being done by MacOS itself — suggests that the MacOS developers are somehow "holding out on you". That is absurd.

You should remove any and all (other than Apple built-in) virus scanners, speeder uppers, optimizers, cleaners, App deleters or VPN packages you installed yourself, or anything of that ilk.

Your exceptionally well-crafted Macintosh computer does not accumulate filth that needs any third-party anything to clean it. Everything needed to run it efficiently was included in the box, except ONE: a drive on which to store a second copy of your files in case the first copy is damaged or deleted by accident. The backup software, Time Machine, is already present -- integrated deeply into MacOS.

Reply Part 2 of 2:

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Next: One or more useless programs are present. They may be contributing to the problem or may be causing other problems.

Webroot: Like all similarly categorized products "Webroot" is utterly useless junk. Uninstall it in accordance with its uninstallation instructions, assuming you can find them, and that they work. You can see for yourself it did nothing to get rid of the harassing <app> will damage your computer messages. Be advised that removing it or things like it can be difficult, and it may be necessary to erase the Mac. Hopefully that won't be necessary. Try uninstalling it first, and if in doubt capture those screenshots again. There should be no files with "Webroot" in their names.

Rule 1 of Macs is don't install junk.

Along those lines, please read Don't use VPN services. One or more such things are installed, and are only likely to cause trouble.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Effective defenses against malware and ot… - Apple Community

once you have un-installed Onguard, Express VPN, and WebRoot, there are more files that should be deleted.

Please post new screen-shots after the Un-installs

Install and Un-Install

the fundamental principles:

• anything installed with drag-and-drop to the /Applications folder can be un-installed by Drag-and-drop to the Trash. After a restart, the Trash can be emptied.

• anything installed with a complex installer program requires the manufacturer's un-installer program. sometimes this is included as an "option" in the Installer package, but the software-maker's web site should specify how to un-install (if they don't, they get swamped with users clamoring for Un-install Instructions).

DO NOT use any other web site’s instructions, unless you have complete trust in that specific site to tell you the truth.

Third-party un-installers could be malicious. The Classic case is malicious updaters for Flash Player.

• anything claiming to be an 'uninstaller helper' is just JUNK. (worse than web site click-bait).

These programs have been known to do so much damage that a re-install was required.

DO NOT be tempted to remove ANYTHING using an App like CleanMyMac. They just guess, and you can (and should) do better.

Remember that you can not immediately DELETE anything that is part of the running MacOS, because if it were referenced after being deleted, your Mac would crash. What you can often do is Move to Trash, and after a Restart, the item will no longer be part of the running MacOS and the Trash can be emptied..