Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How to uninstall malicious viruses Rootkit.Sirefef.Spy and Trojan.FakeAV Download

I got a screen that states Warning: System may have found viruses on your computer. It references Rootkit.Sirefef.Spy and Trojan.FakeAV-Download.

I can no longer get onto Safari without directing me to the address:

macibr.com/mac/ibr-2?sub_id=008612858011772470948

There is a pop up window that reads:

Http://macibr.com

WARNING! Please Install Update To Continue.


How do I get rid of this warning? There isn't an appointment in the Apple store for two days.

Anyone had experience with this?

MacBook Pro, OS X Mountain Lion (10.8.5)

Posted on Sep 10, 2014 9:14 PM

Reply
Question marked as Best reply

Posted on Sep 10, 2014 9:18 PM

These are most likely scams. Ignore them. You do not have to do a thing.


The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.


Fix Some Browser Pop-ups That Take Over Safari.


Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.


Quit Safari


Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.


Relaunch Safari


If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.


This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.


You Don’t Have a Virus and Don’t Pay Money to Remove


This is not a virus nor is it pop-up adware. Fortunately, it doesn’t affect anything but the browser, and it can be easily removed.


If it has opened a tab or window, then close the window by pressing COMMAND-W. A large box may pop open. Press the RETURN key which should dismiss the box and close the page.


If the above does not work then try the following:


1. Select Safari preferences. Click on the Security icon in the toolbar.

2. Locate the checkbox labeled, Enable JavaScript, and uncheck the box. Do not

close the preferences dialog.

3. Close the bad window or tab.

4. Re-check the JavaScript box and close the preferences dialog.


If the Preferences menuitem is inactive then quit or force quit Safari. Run Safari by holding down the SHIFT key while clicking Safari’s Dock icon. Select Safari preferences and click on the Privacy icon in the toolbar. At the top is a dropdown menu labeled, “Cookies and other website date.” Click on the Remove All Website Data… button.


Check your Downloads folder for anything you don’t recognize or remember downloading and delete it.


Also see: I just got a "warning: system may have found viruses on your computer" message on safari.

5 replies
Question marked as Best reply

Sep 10, 2014 9:18 PM in response to holdyourhorses

These are most likely scams. Ignore them. You do not have to do a thing.


The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.


Fix Some Browser Pop-ups That Take Over Safari.


Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.


Quit Safari


Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.


Relaunch Safari


If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.


This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.


You Don’t Have a Virus and Don’t Pay Money to Remove


This is not a virus nor is it pop-up adware. Fortunately, it doesn’t affect anything but the browser, and it can be easily removed.


If it has opened a tab or window, then close the window by pressing COMMAND-W. A large box may pop open. Press the RETURN key which should dismiss the box and close the page.


If the above does not work then try the following:


1. Select Safari preferences. Click on the Security icon in the toolbar.

2. Locate the checkbox labeled, Enable JavaScript, and uncheck the box. Do not

close the preferences dialog.

3. Close the bad window or tab.

4. Re-check the JavaScript box and close the preferences dialog.


If the Preferences menuitem is inactive then quit or force quit Safari. Run Safari by holding down the SHIFT key while clicking Safari’s Dock icon. Select Safari preferences and click on the Privacy icon in the toolbar. At the top is a dropdown menu labeled, “Cookies and other website date.” Click on the Remove All Website Data… button.


Check your Downloads folder for anything you don’t recognize or remember downloading and delete it.


Also see: I just got a "warning: system may have found viruses on your computer" message on safari.

Sep 11, 2014 4:52 PM in response to holdyourhorses

It's not malware. It's a JavaScript scam that only affects your web browser, and only temporarily.

1. Some of those scam pages can be dismissed very easily. Press command-W to close the tab or window. A huge box will pop up. Press the return key and both the box and the page will close. If that doesn't happen, continue.

2. From the Safari menu bar, select

Safari ▹ Preferences... ▹ Security

and uncheck the box marked Enable JavaScript. Leave the preferences dialog open.

Close the malicious window or tab.

Re-enable JavaScript and close the preferences dialog.

3. If the Preferences menu item is grayed out, quit Safari. Force quit if necessary. Relaunch it by holding down the shift key and clicking its icon in the Dock. From the menu bar, select

Safari Preferences... Privacy Remove All Website Data

to get rid of any cookies or other data left by the server. Open your Downloads folder and delete anything you don't recognize.

Sep 13, 2014 2:17 PM in response to Linc Davis

I also had 'macibr.com' try to load on my computer. I am on OS X and Safari. I turned off my wireless internet. At that point I was able to close Safari without installing the macibr.com. After a lot of searching, I tripped on a solution that worked for me.


With my internet connection disconnected, I opened Safari. Clicked on "Safari" in the tab bar, clicked 'reset Safari', and pressed the 'reset' button. For me, that cleared out whatever was causing that file to open and lock up my browser. Hope this helps the next person.

Feb 21, 2015 11:31 PM in response to Kappy

HI, So this happened to me on our computer last night but I was nîeve enough to call the number on the screen, thinking it was legit, yes DUMB, I KNOW! And gave (Indian accent) "Daniel" access to remotely get into my computer, what else did I unknownly give him access to? I refused to buy the US$200 fee to fix the problem, I told him that's a lot of money, I'm not doing that now, which he wasn't so pleased about. But he gave me a number to call here in Australia to call them when I'm ready. Which I wont! It wasn't untill I talked an IT guy I know who told me this was a scam, because my husband just left the safari n opened Firefox n it worked. I feel a little silly I didn't click earlier

but ut now my concern is how to I make sure he can't access my computer anymore?? On my iPad i changed the name and password of our wifi network, but I was told its nothing to do with the network if I let him access my computer, can he acess the passwords n stuff I have saved on there? 😐

How to uninstall malicious viruses Rootkit.Sirefef.Spy and Trojan.FakeAV Download

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.