Announcement: Upgrade to macOS Mojave

With features like Dark Mode, Stacks, and four new built-in apps, macOS Mojave helps you get more out of every click. 
Find out how to upgrade to macOS Mojave > https://support.apple.com/macos/mojave
Question:

Question: Pop-up window: Apple wants to make changes

I repeatedly get a pop-up window saying “Apple want to make changes. Enter your password to allow this.” There is no mention of what is to be changed nor why. I, of course, don’t enter the password and have to close three iterations of the window before it goes away until the next day.

Is this an attempted hack of my computer? IF so, how to delete it from my system?


User uploaded file


Mac Pro (mid 2010), OS X 10.13.5

VIN,MacBook Air (13-inch Mid 2011), macOS High Sierra (10.13.5)

Posted on

Reply
Question marked as Helpful

Sep 19, 2018 7:32 AM in response to QZ9 In response to QZ9

It appears this adware/malware is doing what a lot of newer ones do. It keeps changing the name of the files it uses to run. Some of these have a list of thousands of names it randomly chooses.


I've been following all of the topics of this malware, and even in the same topic, MalwareBytes finds different file names that when removed, clear up this "Apple wants to make changes" junk.

Question marked as Helpful

Sep 16, 2018 5:46 PM in response to QZ9 In response to QZ9

I found the the Tituricsec files as well. I deleted them several weeks ago and have not had the problem since.


After finding this malware, I decided that I should have an AV program. I purchased McAfee Total Protection and installed it on 4 Macs. The scans found ( and quarantined) some additional files that looked suspicious and I deleted them as well.


After a week or so, I began having network problems (Bonjour not working, some Macs not able to ping others, et al). I drove myself crazy looking at router and firewall configurations, but I couldn't solve the problems. Today, on a whim, I decided to uninstall McAfee on all 4 Macs. I don't understand why, but all my network problems magically disappeared! It doesn't make sense. I can't prove that McAfee was the culprit, but I'm not going to recommend it to anyone after this experience.


David Krause

Question marked as Helpful

Sep 1, 2018 6:04 AM in response to QZ9 In response to QZ9

Check Safari > Preferences > Websites > then the Plug-Ins panel on the bottom left corner. Look and see if you have anything there you don't recognize. I suggest too actually running Malwarebytes and see if it detects it. This one is pretty solid of at least finding a part of a file tied to any form of malware. The wording is definitely off as someone pointed out Apple Vs Finder. It's definitely something installed or piece of something attached to a program or file.

Prior to this happening do you remember if you downloaded or were prompted to update anything that wasn't done directly through the Mac App Store.

Question marked as Helpful

Aug 19, 2018 11:29 PM in response to QZ9 In response to QZ9

I'm having the same problem on my Mac Pro with High Sierra 10.13.6. It occurs every 2 or 3 days and goes away after exactly 3 pop-ups and 3 cancels. I believe that it is malware mainly because I trust that Apple would not do this. Also, the use of "Apple" vs. "Finder" or some other system component is troubling. I'm using a WatchGuard Firebox T-70 security appliance with network anti-virus and I thought that I was immune from this stuff... apparently not. I listened to the "security now" podcast suggested by macfrombrampton and although possible, that vulnerability sounds like a bit of a stretch. I would appreciate an update if anyone finds out anything else. Otherwise, I'll sit and wait for Mojave and hope that no damage is done.

There’s more to the conversation

Read all replies
Question marked as Helpful

Aug 19, 2018 11:29 PM in response to QZ9 In response to QZ9

I'm having the same problem on my Mac Pro with High Sierra 10.13.6. It occurs every 2 or 3 days and goes away after exactly 3 pop-ups and 3 cancels. I believe that it is malware mainly because I trust that Apple would not do this. Also, the use of "Apple" vs. "Finder" or some other system component is troubling. I'm using a WatchGuard Firebox T-70 security appliance with network anti-virus and I thought that I was immune from this stuff... apparently not. I listened to the "security now" podcast suggested by macfrombrampton and although possible, that vulnerability sounds like a bit of a stretch. I would appreciate an update if anyone finds out anything else. Otherwise, I'll sit and wait for Mojave and hope that no damage is done.

Aug 19, 2018 11:29 PM

Reply Helpful (5)

Aug 21, 2018 10:59 AM in response to QZ9 In response to QZ9

This same message has been showing up on my iMac mid 2011 with OS 10.12.6 for about 2 weeks. As stated it takes three cancels for it to go away. Very suspicious. The only recent updates were Affinity Photo 1.6.7 and WiFi Explorer 2.4.2 both updated on the 7th of August which is about when this started showing up.

Aug 21, 2018 10:59 AM

Reply Helpful
Question marked as Helpful

Sep 1, 2018 6:04 AM in response to QZ9 In response to QZ9

Check Safari > Preferences > Websites > then the Plug-Ins panel on the bottom left corner. Look and see if you have anything there you don't recognize. I suggest too actually running Malwarebytes and see if it detects it. This one is pretty solid of at least finding a part of a file tied to any form of malware. The wording is definitely off as someone pointed out Apple Vs Finder. It's definitely something installed or piece of something attached to a program or file.

Prior to this happening do you remember if you downloaded or were prompted to update anything that wasn't done directly through the Mac App Store.

Sep 1, 2018 6:04 AM

Reply Helpful (10)

Sep 4, 2018 5:25 AM in response to QZ9 In response to QZ9

This just happened to me as well. I was working in Safari and it crashed. Then the message popped up. I installed malwarebytes and it said it detected something. When Iclicked to read the results, my computer restarted. Did not want to log in again because don’t want to give my password. Any suggestions?

Sep 4, 2018 5:25 AM

Reply Helpful

Sep 4, 2018 12:35 PM in response to minners In response to minners

The restart of Malwarebytes detects something is fairly normal. It does that because when macOS reboots it actually pulls in the parts of Gatekeeper that were designed to fight against malware and the restart also searches the purpose of stopping anything actively running to remove it. Go ahead and log back in and run another scan and also check your Applications list and make sure you recognize every program listed. https://support.apple.com/guide/mac-help/apps-included-on-your-mac-mchl110b00b7/ mac


That link is a list of what’s built in so you know how to recognize what should be there that you didn’t install yoirs

Sep 4, 2018 12:35 PM

Reply Helpful
User profile for user: QZ9

Question: Pop-up window: Apple wants to make changes