Mac Security · Mac Malware: Myth vs Reality · Lesson 5 of 5

Challenge: The Mac Cleaner Pop-Up

Help a neighbor through a scary "3 viruses found" pop-up on her Mac.

Three viruses found

Your neighbor Dee knocks on your door, worried. She was reading recipes in Safari on her MacBook when the page suddenly changed.

Now a big box fills the screen. It shows an Apple logo and says: "Your Mac is infected with 3 viruses. Download MacCleaner Pro now to remove them." A countdown clock ticks down from 60 seconds. A beeping sound plays. A phone number for "Mac Support" sits at the bottom.

Dee hasn't clicked anything yet. She asks you what to do.

Look closely at where the box is. It's inside the Safari window, on a web page. Think about what you learned in this course about where real Mac warnings come from. Notice the countdown and the phone number too. They're pressure tricks, made to rush her.

Closing it safely

Dee tries to close the box, but it keeps coming back. Every click seems to open another one.

Here's what to do. Don't click anything inside the pop-up, not even its Close or Cancel buttons, since those can be part of the trick. Instead, close the whole tab with Command+W. If that doesn't work, quit Safari with Command+Q. If Safari is stuck, you can force it to quit from the Apple menu › Force Quit.

Then open Safari again. If the scary page comes back, close that tab right away. Don't call the number. Real Apple support won't put a phone number in a pop-up.

The download she already opened

While Safari reopens, Dee admits something. Last week a similar pop-up appeared, and she clicked Download. When she opened the file, a box said: "MacCleaner Pro will damage your computer. You should move it to the Trash." She clicked Move to Trash.

That was the right choice. The warning came from the Mac's own protection, not from a website. It recognized known malware and stopped it from opening.

To be extra safe, you check System Settings › General › Login Items & Extensions together. Nothing unusual is there.

The next day

The next morning, Dee calls you. When she searches in Safari, the results now come from a site called QuickFind that she never chose. She changed it back in Safari's settings, but it switched again overnight.

Dee also remembers installing a free "Speed Booster" app the same day, from a link in an ad. It's still in her Applications folder.

You'll help her remove the app, but you want to find what keeps changing her search engine too.