Pop-up window: Apple wants to make changes

I found the the Tituricsec files as well. I deleted them several weeks ago and have not had the problem since.

After finding this malware, I decided that I should have an AV program. I purchased McAfee Total Protection and installed it on 4 Macs. The scans found ( and quarantined) some additional files that looked suspicious and I deleted them as well.

After a week or so, I began having network problems (Bonjour not working, some Macs not able to ping others, et al). I drove myself crazy looking at router and firewall configurations, but I couldn't solve the problems. Today, on a whim, I decided to uninstall McAfee on all 4 Macs. I don't understand why, but all my network problems magically disappeared! It doesn't make sense. I can't prove that McAfee was the culprit, but I'm not going to recommend it to anyone after this experience.

David Krause

1. Download Malwarebytes from https://www.malwarebytes.com. It is free to use a few times.

2. Run a scan using Malwarebytes. It may show you some threats that are "quarantined".

3. Follow Malwarebytes instructions to delete the threats.

At this point your problem may be solved. You may want to pay for a subscription to Malwarebytes, which will allow you to set up a regular schedule to automatically scan and identify new problems.

In my case I was getting three popups every day, and Malwarebytes showed three "Adware" threats. After deleting these three threats, I no longer get the popups.

Have been getting this pop-up 'Apple Wants to Make Changes' requesting my password. Not right so checked my extensions and plugins and found Stuckopoe and thought I successfully removed. This continued to happen so I ran Malware Bytes and it found and quarantined/removed several items, mostly Stuckopoe related. Will report back in a week or so to be sure this corrected the problem.

It seems like a scam to be told to go pay for something to solve a problem that only started after an update.

I had only used my laptop 4 times in the past 3 weeks to view google maps as I was on vacation. When I got home I did a system update and this pop up started. I am weary as most of the things I have read tell us to download something else to solve the issue. Sounds like an added layer of malware. I just dont understand how I got it since all I did was run an update.

It would be reassuring if Apple would weigh in on this solution. Thanks Apple in advance.

First off, MalwareBytes for Mac was written by a long-time trusted member here - thomas_r. - under the name of AdwareMedic

Thomas is now Director of Mc Products for the company.

Next, " Free download comes with a 30-day trial of Premium. " >

Malwarebytes for Mac — Mac Antivirus Replacement | Malwarebytes

https://www.malwarebytes.com/mac/

So it is NOT a scam to get you to buy it - you cn clean up your system and uninstall it if you want

The networks you connected to while on vacation, were they networks you managed and controlled?

Malware is a blanket term that spans not just viruses, which are a form of malware. You can pick up something from it being placed into a network, another infected computer already on a network, websites, ads within websites, software installed with malicious files within it. A macOS update won’t install malware but for all intents and purposes it actually scans for it and also macOS is designed that when you restart or turn on your computer it runs a scan then. I can understand not wanting to install a program however read through this and countless other threads, most of us trust it because malwarebytes is on that doesn’t go fiddling or removing important systems files like some purported cleaning programs

What happened when you entered it?

For fun, I entered in a fake password or two and the window wouldn't accept it. I got that vibrating wiggle effect and then it asked again. Made me think it's legit?

Still, I'm not putting my real password in till the pop-up source is confirmed.

That box is supposed to wiggle when you enter an incorrect admin name, password, or both. The box you're seeing is legitimate. That is, the OS is presenting it because some app is asking permission to install in places it isn't normally allowed. In this case, it's a malicious app that you most definitely don't want to give such permission no matter how many times it asks.

The OS keeps track of its own installation logs. As rccharles noted, EtreCheck is a good way to find out what was recently installed as one of last entries in an EtreCheck report is a listing from those logs.

I don't know if there's a way to separate out general installs from those that required admin approval.

Those "Tituricsec" files look like they probably belong to something that we call Adware.OperatorMac at Malwarebytes. I'm guessing that's what they were detected as. If so, this isn't true malware, in the sense that it's doing malicious things to you. It's adware, which does things like inject ads in your browser, or change your search engine.

I'll be interested to hear if removing those files cured the problem. We haven't seen this particular behavior, but we have seen new variants of OperatorMac circulating lately. It's possible this behavior only happens after it has been installed for a while.

"True" malware or not, it was a PITA.

No doubt.

The only reason for the distinction is malware is intended to do something malicious. Such as destroying files, encrypting your data (ransomware), or any other action that causes harm to your computer/files or tries to get money out of you.

Adware, on the other hand, is only highly annoying . Its not intended to do any of the above. Just bombard your computer with ads. Which, some of them do so aggressively, they slow the entire computer down.

QZ9 wrote:

"True" maleware or not, it was a PITA. One doesn't know, when faced with the pop-up, the degree of its maliciousness. Therefore, all such occurrences should be aggressively attacked.

I agree. However, my intent in providing the additional information was to put your mind at ease that your computer and your personal information are not at risk here.

I've been getting this same pop-up for several weeks now - (Apple wants to make changes). I did notice that anysearch had somehow slithered into my Safari extensions, and have deleted that, but the problem persists.

I've recently been keeping an eye on the Network pane in activity monitor to see if I can catch what's causing this. The last time it happened, the following showed up:

Process Name: P

Sent Bytes: 2kb

Recvd By...: 214kb

Sent Pack...: 3

Rcvd Packets: 156

PID: 5161

Could P be the culprit here, and if so where could it be hiding on my computer? Searching for P on my hard drive was not very fruitful.

I've had this issue. I just ran Malware Bytes and cleared out malware that I thought I had already deleted. Stupid "anysearch" add on. Guess where I got it? From downloading Adobe flash player. Hopefully that cleans up my issues.