Pop-up window: Apple wants to make changes

This same message has been showing up on my iMac mid 2011 with OS 10.12.6 for about 2 weeks. As stated it takes three cancels for it to go away. Very suspicious. The only recent updates were Affinity Photo 1.6.7 and WiFi Explorer 2.4.2 both updated on the 7th of August which is about when this started showing up.

I also have had this pop-up "Apple wants to make changes". After reading everyone's experience of this problem, I contacted Apple Support. They guided me through the process of changing Safari preferences to turn off pop-ups. They also had me delete extensions that I didn't use or recognize. Both of these were found with the Safari browser open under the "Safari" menu item. The block pop-up setting was a check box under "Security". And the extensions were listed and able to be deleted under "Extensions" in preferences. An article on this is at How to block pop-ups in Safari - Apple Support.

I tried this and found something called "test my net" that had been allowed to send notifications. Disallowed and trashed it. I don't know for sure yet, but since it was the only thing allowed to send notifications I'm assuming it was the problem.

Malware, for sure.

I had same issue. I believe it first appeared when I was reading a news site, perhaps the Washington post, as another poster suggested. It would pop up periodically and it would go away for a while when I hit cancel 3 times. Followed tammylig's advice - except for Malwarebytes. The Plugins panel did have a plug in I did not remember seeing or using in the past, called Widevine something or other. I unchecked it in this plug in panel. But then I used finder to search for the plug in and then trashed it, and emptied the trash. Hopefully, that gets rid of it.

I found the the Tituricsec files as well. I deleted them several weeks ago and have not had the problem since.

After finding this malware, I decided that I should have an AV program. I purchased McAfee Total Protection and installed it on 4 Macs. The scans found ( and quarantined) some additional files that looked suspicious and I deleted them as well.

After a week or so, I began having network problems (Bonjour not working, some Macs not able to ping others, et al). I drove myself crazy looking at router and firewall configurations, but I couldn't solve the problems. Today, on a whim, I decided to uninstall McAfee on all 4 Macs. I don't understand why, but all my network problems magically disappeared! It doesn't make sense. I can't prove that McAfee was the culprit, but I'm not going to recommend it to anyone after this experience.

David Krause

It doesn't make sense.

Sure it does. Don't run McAfee. Just another example of why people don't recommend running antivirus software on the mac.

Simple put, Apple attempts to provide all the malware detection and removal you need in Mac OS X.

"Effective defenses against malware and other threats" by John Galt

https://discussions.apple.com/docs/DOC-8841

"Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams"

https://support.apple.com/en-ca/HT204759

"MalwareBytes Anti-Malware for Mac Removes adware and malware Revives your Mac." MalwareBytes has a more restrictive filter for adware than Apple. MalwareBytes has come to be accepted as the only malware detector you should consider. For those pestered by browser attacks consider MalwareBytes.

https://www.malwarebytes.org/antimalware/mac/

etrecheck

Run etrecheck. The first five runs are free. Provided a report on your machines hardware and software. Great for diagnosing your system. Click on the download link at the bottom of the screen.

http://etrecheck.com/

The OS keeps track of its own installation logs. As rccharles noted, EtreCheck is a good way to find out what was recently installed as one of last entries in an EtreCheck report is a listing from those logs.

I don't know if there's a way to separate out general installs from those that required admin approval.

Those "Tituricsec" files look like they probably belong to something that we call Adware.OperatorMac at Malwarebytes. I'm guessing that's what they were detected as. If so, this isn't true malware, in the sense that it's doing malicious things to you. It's adware, which does things like inject ads in your browser, or change your search engine.

I'll be interested to hear if removing those files cured the problem. We haven't seen this particular behavior, but we have seen new variants of OperatorMac circulating lately. It's possible this behavior only happens after it has been installed for a while.

I've had this issue. I just ran Malware Bytes and cleared out malware that I thought I had already deleted. Stupid "anysearch" add on. Guess where I got it? From downloading Adobe flash player. Hopefully that cleans up my issues.

What exactly are you doing when this occurs?

(you Mac will bark at you like this if it believes that "you" don't have "permission" to do that thing)

It came back again after I went to CBS's website. I noticed another user went to a news site and got it. Had to install Malwarebytes. It did find two items and now the problem has gone away.

Tried cleanmymac free download and it didn’t find anything. Downloaded malwarebytes for free and it found 4 threats.

I cannot find the malware bytes app. Am I missing something?

Malwarebytes for Mac — Mac Antivirus Replacement | Malwarebytes

Do not use cleanmymac. It's regarded as malware around these forums.

R