Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Safari locked with Mac security alert

May have a virus but Safari is locked with multiple windows open and displaying a Mac Security alert below...

System Alert.

Suspicious activity of intrusions detected which is trying to redirect you to an attack site.

This may happen due to obsolete virus protections.

To fix, please call system support at 1-647-360-4454 immediately. Please ensure you do not restart your computer to prevent data loss.


Anyone know how to get rid of this?


Thanks

Mac Pro, OS X Yosemite (10.10.3)

Posted on May 14, 2015 4:50 AM

Reply
Question marked as Best reply

Posted on May 14, 2015 4:52 AM

You need to use Adwaremedic. It is a tiny tool, which will remove the adware within several seconds. You can download Adwaremedic from this website: http://www.adwaremedic.com/index.php

You can also remove the adware manually using the steps provided by Apple: https://support.apple.com/en-us/HT203987

I'd also suggest this:

Go to Safari menu (At the very top right side of your screen next to Apple icon), choose "Quit Safari"

press "Shift" button and while holding this button on your keyboard single click on the Safari icon on your Dock.

Open Safari - Preferences - Privacy - Remove All Website Data.

Go menu with Option (Alt) key pressed - Library - locate Safari folder and move it to your desktop.

Also, you may try this:

- Shut down your Mac

- Wait until your computer turns off and after that press the Power button

- Right after you hear the startup tone, press and hold the Shift key

- Release the Shift key when you see a grey Apple sign and the progress bar below this sign

- Once you see Desktop, start a Disk Utility scan to detect and repair file system errors (don't forget to choose your main hard drive)

- Click on Verify Disc and then, if asked to fix problems, on Repair Disk

- After this, click on Verify Disk Permissions and then on Repair Disk Permissions

- After the process is finished, shut down your Mac and turn it back on after about 30 seconds

Hope this helps!

34 replies

Jun 17, 2015 6:21 AM in response to JenLGood

You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.

Back up all data before making any changes.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Jun 17, 2015 6:57 AM in response to JenLGood

In the upper right of the menu bar on your Mac, click the Wi-Fi icon, and click Turn off Wi-Fi. If you are using an Ethernet connection to get online, disconnect the Ethernet cable instead. Now force quit Safari, and restart it normally. The malicious page will still try to load, but it can't without an Internet connection. Close the tab. Reconnect to the Internet.

Nov 4, 2015 10:54 AM in response to ptb9896

There is a better fix for this:


  1. In terminal, type: sudo nano /etc/hosts
  2. paste '0.0.0.0 macsecurityservice.info' onto the last line
  3. ctrl-x, enter to save the file
  4. In terminal, type: sudo dscacheutil -flushcache


The /etc/hosts file should look something like this (assuming you've never edited it): https://gist.github.com/hanleybrand/08ea56c15fc6c9d595ec

Safari locked with Mac security alert

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.