By Staff [MANDATORY] Preparation Guide Before Requesting Mac Malware Removal Help

[Jack]

The quickest way to get help: Get help wizard
The wizard asks the questions below step by step, takes your EtreCheckPro report and screenshots, and opens your topic for you. The steps in this guide stay here for reference.

Welcome to the MalwareTips Mac Malware Removal forum. Here we help with adware, browser hijackers, fake "macOS update" or "virus found" alerts, notification spam and suspected malware on Macs.

Please also read the Malware Removal Assistance rules. The same rules apply here.

Please be aware

• You are helped by volunteers in their free time, at no cost to you. Please be patient.
• We do not help with work or school Macs managed by an organization. Contact your IT department instead.
• Pirated apps and "cracked" software are a common source of Mac malware. Tell us honestly what you installed. We will help you remove the malware, but we will not help you keep or repair pirated software.
• Never paste a command into Terminal because a website, video, pop-up or "verification" page told you to, unless a helper in your own topic asked you to. That is one of the most common ways Macs get infected today.

Do this first​

• If you entered your Mac password into an unexpected window, or ran a Terminal command from a website, change your important passwords from another device you trust. Start with your email and Apple Account, then sign out other sessions and turn on two-factor authentication.
• Don't delete files or apps by hand yet. The report below is more useful while everything is still in place.

Step 1. Run EtreCheckPro (required)​

1. Download EtreCheckPro (free download) from the official Etresoft site, open the ZIP and move EtreCheckPro to the Applications folder.
2. Open it and run a report. You don't need the paid upgrade.
3. When asked, give it Full Disk Access (System Settings → Privacy & Security → Full Disk Access), so the report can see startup items.
4. When the report is ready, save or copy it as text and attach it to your topic.

Step 2. Notification spam? Check this too​

Most "update-macos", "virus found" or similar notifications come from a website that you once allowed to send notifications, not from malware.

• Safari: Safari → Settings → Websites → Notifications. Screenshot the list.
• Chrome: type chrome://settings/content/notifications in the address bar. Edge: edge://settings/content/notifications. Firefox: Settings → Privacy & Security → Permissions → Notifications. Screenshot the list of allowed sites.

Step 3. Screenshots that help​

• The pop-up or notification itself.
• System Settings → General → Login Items & Extensions: both the "Open at Login" and "Allow in the Background" lists.
• System Settings → Privacy & Security → Profiles (or System Settings → General → Device Management): only if any profile is listed.
• Your browser's extensions page.

Optional: if you already use Malwarebytes for Mac, update it, run a scan and include what it found.

Step 4. Open your topic​

Click Post thread in Mac Malware Removal Help & Support. Use a clear title, such as the main symptom plus your macOS version. In your message, include:

• Mac model and macOS version (Apple menu → About This Mac)
• what happens, and since when (date)
• what you downloaded, installed or ran just before it started
• what you already tried

Then attach the EtreCheckPro report and your screenshots. Before posting, cover any email address or account name in them.

Get notified when someone replies​

Open Account → Preferences. Tick Automatically watch content you create... and ...and receive email notifications, then click Save.

Please reply within 3 days, even if only to say you need more time. Follow instructions only from the authorized helpers listed in the rules.