Safari locked with Mac security alert

May have a virus but Safari is locked with multiple windows open and displaying a Mac Security alert below...

System Alert.

Suspicious activity of intrusions detected which is trying to redirect you to an attack site.

This may happen due to obsolete virus protections.

To fix, please call system support at 1-647-360-4454 immediately. Please ensure you do not restart your computer to prevent data loss.


Anyone know how to get rid of this?


Thanks

Mac Pro, OS X Yosemite (10.10.3)

Posted on May 14, 2015 4:50 AM

Reply
34 replies

May 18, 2015 6:00 PM in response to Echo7196

Please read this whole message before doing anything.

This procedure is a test, not a solution. Don’t be disappointed when you find that nothing has changed after you complete it.

Step 1

The purpose of this step is to determine whether the problem is localized to your user account.

Enable guest logins* and log in as Guest. Don't use the Safari-only “Guest User” login created by “Find My Mac.”

While logged in as Guest, you won’t have access to any of your documents or settings. Applications will behave as if you were running them for the first time. Don’t be alarmed by this behavior; it’s normal. If you need any passwords or other personal data in order to complete the test, memorize, print, or write them down before you begin.

Test while logged in as Guest. Same problem?

After testing, log out of the guest account and, in your own account, disable it if you wish. Any files you created in the guest account will be deleted automatically when you log out of it.

*Note: If you’ve activated “Find My Mac” or FileVault, then you can’t enable the Guest account. The “Guest User” login created by “Find My Mac” is not the same. Create a new account in which to test, and delete it, including its home folder, after testing.

Step 2

The purpose of this step is to determine whether the problem is caused by third-party system modifications that load automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

Please take this step regardless of the results of Step 1.

Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

Test while in safe mode. Same problem?

After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of Steps 1 and 2.

May 24, 2015 2:06 PM in response to Linc Davis

Same thing just happened to me today. I had a pop-up and was instructed to call 1-647-360-4454. I thought the area code looked odd, so I got on my other windows computer and googled. It is a Canadian area code-I knew something wasn't right. Thank heavens for my other computer. I was able to come to this Apple post and it fixed the problem right away. I also followed the other advice about verifying and repairing disk permissions and did that too. thank you so much!!!!!

May 24, 2015 2:52 PM in response to blueCdreams

Same evil vile scam here: I had a very annoying pop-up driveby or phishing scam kind of thing associated with the sites clevervc.com and/or securitywarns.com.


I was visiting a prospective housemate's linked in profile when suddenly various tabs opened and finally, a popup says I have been phished and demands I call securitywarns.com at some 844 number. Safari is completely unresponsive even after quitting and restarting, restarting with spacebar down, restarting with internet off, etc.


I finally fixed it by command-w as fast as possible trying to get that in in-between clicking on the popup.


Irritating and nasty. The web page had all sorts of safari logos on it, though it is easy enough to detect the browser without any true specific code, I suppose


I recommend blocking clevervc.com and/or securitywarns.com, or perhaps if you security folks can verify and get the same thing from them.



I wish these people appropriate bad karma. Plus at least a few bonus parking tickets.


-B


keywords: safari phishing scam, phishing site report, popup scam

May 24, 2015 3:24 PM in response to Linc Davis

I wish I had seen your reply yesterday. Unfortunately I responded to the phone number and bought the cheapest option that purported to clean my computer and get it unlocked. They try to upsell an annual service for $289 that provides quarterly cleaning/servicing. The company behind the phone number 1-647-360-4454 claims to be Infiniti Tech Solutions - offshore tech support but registered in Southern California. They use Team Viewer software to remotely do the cleaning while you can follow along and observe. They seemed to just use the CleanMy Mac software. So my question is a little different - how can I be sure that this service hasn't inserted anything into my network? And if it has how can I get it removed?


Thanks for any help or insight!

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Safari locked with Mac security alert

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.