Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Pop-up window: Apple wants to make changes

I repeatedly get a pop-up window saying “Apple want to make changes. Enter your password to allow this.” There is no mention of what is to be changed nor why. I, of course, don’t enter the password and have to close three iterations of the window before it goes away until the next day.

Is this an attempted hack of my computer? IF so, how to delete it from my system?


User uploaded file


Mac Pro (mid 2010), OS X 10.13.5

VIN,MacBook Air (13-inch Mid 2011), macOS High Sierra (10.13.5)

Posted on Aug 19, 2018 4:45 PM

Reply
Question marked as Best answer

I have the same problem. Called APPLE Support. They had me run Malweare bytes. It found 9 issues. And cleaned them out. Apple had me delete them, and empty the trash so I don't have a list. I will post again in a couple of days with the results.

Posted on Sep 9, 2018 5:41 PM

107 replies

Sep 13, 2018 7:49 AM in response to QZ9

Like a novice idiot, I fell for this and entered my password after getting the "Apple wants to make changes" pop up. Then I checked the forums and found this thread. Needless to say I should have checked the forum first! Anyway, I have immediately changed my MAC access password. Then I ran Malwarebytes and deleted everything it detected. Then I cleared: Cache, history & website data. Here are a few links to help clean up your computer.


Free Antivirus Replacement & Anti-Malware Tool | Malwarebytes

https://nektony.com/blog/how-to-reset-safari-on-mac

https://macsecurity.net/view/188-remove-anysearchmanager-malware-from-mac

Sep 13, 2018 1:17 PM in response to QZ9

I called Apple Support today, 9/13/18. They said it's ok and to type password. I had just uninstalled Norton Security because I realized I didn't need it. The weird thing was though, the popup came after it UNinstalled and my computer restarted. Apple Support said it was ok. I hope they are right. They helped me install Malwarebytes as well at my request.

Sep 13, 2018 1:31 PM in response to Gailbrickner

I called Apple Support today, 9/13/18. They said it's ok and to type password.

It would be interesting to know what number you called. It's hard to believe an Apple employee would say it's okay to allow a vague request for admin access.


Is this a number you found by doing a Google search for "Apple support", or the actual customer service number found on Apple's site?

Sep 15, 2018 2:44 PM in response to QZ9

I've had the same problem for about two weeks. The open Safari browser disappears and a few seconds late, the pop-up appears, asking for a password. This morning, I took the advice of several posters and downloaded the trial version of Malwarebytes. After the first scan, Malwarebytes found and quarantined two files titled "com.ExploreSearchResults" and "com.ExploreSearchResults.plist"

Sep 15, 2018 7:08 PM in response to tammylig

I had same issue. I believe it first appeared when I was reading a news site, perhaps the Washington post, as another poster suggested. It would pop up periodically and it would go away for a while when I hit cancel 3 times. Followed tammylig's advice - except for Malwarebytes. The Plugins panel did have a plug in I did not remember seeing or using in the past, called Widevine something or other. I unchecked it in this plug in panel. But then I used finder to search for the plug in and then trashed it, and emptied the trash. Hopefully, that gets rid of it.

Sep 16, 2018 9:37 AM in response to QZ9

Following the suggestions of many participants in this thread, I downloaded and ran Malewarebytes (trial version). It found just two files of concern:

/Users/xxx/Library/Application Support/com.Tituricsec

/Users/xxx/Library/LaunchAgents/com.Tituricsec.plist


I deleted both files and emptied the trash.


That was over three days ago. Have rebooted the Mac and run Firefox, Safari and Chrome. So far, the annoying twice-daily pop-up has not popped up again.


Couldn’t find much about Tiuricsec on-line, so don’t have any third-party confirmation that this was the offending software. It’s interesting that nobody else has mentioned Tiuricsec.


Will post again if the pop-up reappears.


As the OP I want to thank all for helping address this issue.

Question marked as Helpful

Sep 19, 2018 7:32 AM in response to QZ9

It appears this adware/malware is doing what a lot of newer ones do. It keeps changing the name of the files it uses to run. Some of these have a list of thousands of names it randomly chooses.


I've been following all of the topics of this malware, and even in the same topic, MalwareBytes finds different file names that when removed, clear up this "Apple wants to make changes" junk.

Question marked as Helpful

Sep 16, 2018 5:46 PM in response to QZ9

I found the the Tituricsec files as well. I deleted them several weeks ago and have not had the problem since.


After finding this malware, I decided that I should have an AV program. I purchased McAfee Total Protection and installed it on 4 Macs. The scans found ( and quarantined) some additional files that looked suspicious and I deleted them as well.


After a week or so, I began having network problems (Bonjour not working, some Macs not able to ping others, et al). I drove myself crazy looking at router and firewall configurations, but I couldn't solve the problems. Today, on a whim, I decided to uninstall McAfee on all 4 Macs. I don't understand why, but all my network problems magically disappeared! It doesn't make sense. I can't prove that McAfee was the culprit, but I'm not going to recommend it to anyone after this experience.


David Krause

Pop-up window: Apple wants to make changes

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.