You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Suspected Malware following system update to "Mojave"

I recently updated to Mojave. I'm getting a pop up which can't be deleted ""MacOSDefender.app" wants access to control "Safari.app"".

I've used EtreCheck in Safe Mode and this reports no issues.User uploaded file

EtreCheck not in Safe Mode reports Adware (Support/amc/helperamc.app/Contents/MacOS/helperamc) which cannot be removed.


Can anyone give guidance please?

iMac, Mac OS X (10.7.3)

Posted on Oct 22, 2018 12:17 PM

Reply
Question marked as Top-ranking reply

Posted on Oct 22, 2018 2:17 PM

All of the published self help remedies seem to have been made obsolete by continuing changes to the malware. I found that the offending path was ........./Library/Application Support/.dir/MacOSDefender.app/Contents/Mac OS/MacOSDefender. The problem seems to be the .dir element.


I installed Malwarebytes https://www.malwarebytes.com/mac/ freeware and the popup hasn't appeared.


Thanks for the interest everyone.

6 replies
Question marked as Top-ranking reply

Oct 22, 2018 2:17 PM in response to John Galt

All of the published self help remedies seem to have been made obsolete by continuing changes to the malware. I found that the offending path was ........./Library/Application Support/.dir/MacOSDefender.app/Contents/Mac OS/MacOSDefender. The problem seems to be the .dir element.


I installed Malwarebytes https://www.malwarebytes.com/mac/ freeware and the popup hasn't appeared.


Thanks for the interest everyone.

Oct 22, 2018 1:17 PM in response to welldo

EtreCheck not in Safe Mode reports Adware (Support/amc/helperamc.app/Contents/MacOS/helperamc) which cannot be removed.

I don't know why it (or you) can't remove it, but it must be removed.
The following Discussion is about a year old but the procedure I described worked last time I tried it: Advanced MacCleaner popup virus

If you have questions reply to this Discussion. That one is locked, as any outdated post should be.

Oct 22, 2018 12:29 PM in response to welldo

Go to Applications > Utilities and launch Activity Monitor.

Look for a process with the name MacDefender, MacSecurity or MacProtector. Highlight any that you see and click “Quit Process.”

You’ll be asked if you’re sure you want to quit the process. Click “Quit.”

Once you quit it, find the MacDefender icon in the Applications folder. ( It’ll have the same name as the process you just quit, so if you cant find it, look for MacSecurity or MacProtector. Drag the icon to the trash, then empty trash.

Open Applications > System Preferences > Accounts.

Click your account on the left, then select the “Login Items” if it’s not already selected.

Highlight MacDefender (or MacSecurity or MacProtector) and click the minus button to remove it from the startup.

Suspected Malware following system update to "Mojave"

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.