Immediate Action Required: a fake virus alert, and what to do

What the "Immediate Action Required" alert is

What it is

A web page, not a program on your device: a pop-up headed IMMEDIATE ACTION REQUIRED that says a trojan named e.tre456_worm_osx (Mac) or e.tre456_worm_Windows (PC) was found, drawn over a page made to look like Apple's or Microsoft's. The name belongs to the page; we found no source that lists it as a program

What it claims

That your computer has "3 viruses" (2 malware and 1 phishing/spyware), that a percentage of the system is damaged, and that personal and banking information is at risk

What it wants

A click on OK, then on Scan Now, a made-up scan, and then a download of a "cleaner" that the page rates highly. That program, and the payment for its "full version", is what the page is selling

Does it need an infection?

No. Visiting a site that shows it is enough to see it. A computer is only at risk from what you then download, open or pay for, so seeing the page does not mean you have a Trojan

Which devices

Our pictures show a Mac page and a Windows copy; the page changes its look to match what the visitor's browser reports. Any browser can display a web page like this. We have tested no steps for phones and name only what Apple's Safari page says

Our 2019 guide called this a "fake notification". It is not a notification in the browser sense (the sort you allow with a button); it is an alert box drawn by a page you opened. That difference decides what to remove: a page is closed, a program is uninstalled, and a notification permission is revoked.

What rahsecure.com and securewalle.com mean in this alert

rahsecure.com and securewalle.com are addresses that people report next to the words Immediate Action Required in the browser.

The browser puts the address of the page into the alert, so this is a page you were sent to and not a message from Apple or Microsoft. We found no source that describes these two addresses, so we cannot say who runs them. Treat them as part of the scam this page describes.

e.tree 456 worm and e.tree 465 worm are misspellings of the name e.tre456_worm that the alert shows. A trojan with this name is invented by the page, and a real security product does not announce a threat in a web page.

If you see the alert, close the tab (Command-W or Ctrl-W) or end the browser, and do not click OK or Scan Now. The steps on this page cover what to do if you downloaded the cleaner or paid.

rahsecure.com says, e.tree 456 worm and other words people search for

"rahsecure.com says Immediate Action Required" means the fake alert was opened by a page on rahsecure.com.

The browser puts the name of the site that opened a pop-up box in front of the word "says", so the line shows who sent the message, not that Apple or Microsoft did. The same holds for "securewalle.com says Immediate Action Required". Close the tab, click nothing in the box and download nothing it offers.

"e.tree 456 worm windows" and "e.tree 465 worm windows" are misspellings of e.tre456_worm, the made up trojan name this alert shows. On a Mac the page writes it as e.tre456_worm_osx; on a Windows PC the same page simply swaps in the Windows look.

It is not a real virus, and a web page is not a file, so a scanner has nothing to find unless you installed a program from it.

"Claim your resources, last step" is a phrase we found no reliable source for. Our reading is that it comes from a similar page that pushes you to click once more, download a file or enter details to finish a reward or a scan.

Treat it the way you treat this alert: close the tab and do not enter anything. If you already downloaded or paid, follow the steps for people who clicked Scan Now, downloaded or paid.

Ending up on the page does not mean your computer is infected, and certainly not with the trojan the page names. What matters is whether it happened once or keeps happening.

What we checked and what we did not

The addresses behind it

The names follow one trick: the Apple name comes first and the real domain comes at the end, so apple.com-scan.live is a page on the domain com-scan.live. The real Apple site is apple.com, with nothing after it but a slash. Our 2019 text said the sites are shut down quickly because search and security companies flag them. We have no source for the reason, but the registry answers above are in line with short-lived domains.

The pages and versions we know of

1. 9 May 2018

   A Safari capture

   The date printed on our Safari picture. The page shows the visitor's current date, so this is the capture day, not the start of the scam. Its address ends in .download, which is where the real domain sits.

   

2. 2018

   PCrisk's first record

   PCrisk records the fake alert for Mac with a fake scan and an Advanced Mac Cleaner download. The same name is used on a Windows page.

3. 17 December 2018

   A new version

   PCrisk records an updated page that adds "Your MacOS 10.14 Mojave is infected with 3 viruses!" and promotes Mac Cleanup Pro.

4. 6 August 2019

   The Windows copy

   The date printed on our Edge capture: the same text in Microsoft colours with a Windows Security Scan header.

5. 20 September 2019

   Our guide

   We published the first version of this guide. We updated it on 29 June 2020.

6. 19 January 2022

   PCrisk's page updated

   PCrisk's guide for the Mac version shows its last update on this date.

7. 25 August 2026

   Same words, a different scam

   PCrisk updates its guide to an e-mail headed "Immediate Action Required" that asks you to update an e-mail password. It is not this alert; see the next section.

8. 6 October 2026

   This rewrite

   We corrected the notification wording, separated the page from adware, checked the old domains and rewrote the steps for current macOS and Windows.

Same words, other scams

What the alert says, line by line

Our reasoning, not a sourced fact: if a program really were stealing your data, it would not stop to show a countdown. The countdown tells you the page is selling something.

The fake scan and the download it sells

1. Step 1

   OK

   The pop-up has one button. It starts the page's own scan; our 2019 text said it offers an "alleged system scan". Nothing on your computer is read.

2. Step 2

   Scan Now and a progress bar

   The page shows a scan running and then lists results. They are the same for everybody. PCrisk's page on the Mac version says the scan is fake and the results are used to push dubious software.

3. Step 3

   Made-up names and a damage figure

   The results page lists three invented viruses (Tapsnake, CronDNS and Dubfishicv on the Mac page that PCrisk copied), a risk of HIGH and "infected files" in folders that no source we found describes. On the Windows copy the list includes a name such as Ransomware 2.0.

   

4. Step 4

   A cleaner, rated and priced by the page

   The button says Remove Viruses Now and the page names a program to download: Advanced Mac Cleaner in PCrisk's 2018 copy, Mac Cleanup Pro in its later one, PC Cleanup on the Windows page above. Our 2019 text also named Mac Auto Fixer, Driver Tonic and Malware Crusher; we found no 2026 source for those, so treat them as unconfirmed.

5. Step 5

   Payment

   PCrisk says the free version cannot remove what it lists and asks for payment for the full one. That is the same pattern as a fake support call: the "problem" and the fix come from the same seller.

Our 2019 text observed that the scheme matches a tech-support scam and that what the programs do mirrors the page they came from: both invent a problem and then offer a paid fix. We have tested none of these programs, so we make no claim about their behaviour beyond what PCrisk records.

Why a page like this works on people

Our 2019 guide said these scams are easy for experienced users to spot and that the aim is to get people to install software and pay. We keep that and add the part we can source: the FTC says legitimate tech companies do not contact you to say there is a problem with your computer, and Microsoft says its error messages never include a phone number. We dropped the claim that one group is more vulnerable than others, because no source we read supports it.

What clicking can cost

• High

  Paying for a program that fixes nothing

  PCrisk says the free version shows threats it cannot remove and asks for payment for the full version. If you paid, call the bank or card issuer.

• High

  Handing over card or personal details

  A fake scan result and a payment form can collect card numbers and an e-mail address. The FTC says to change a password you gave a scammer right away, and wherever else you use it.

• Medium

  An unwanted program on your computer

  PCrisk records the cleaners these pages promote as unwanted applications that track browsing and show intrusive ads, and says such ads can lead to other unwanted programs or malware. Our 2019 text said the same, adding that they can be hard to remove; we found no source for that part.

• Low

  Only seeing the page

  A page that shows a warning does not change your computer, and closing it ends it. Our 2019 text listed money loss, useless software and malware infections; all three begin with a download or a payment.

First: how to close the alert

1. 1

   Do not click OK, Scan Now or Remove Viruses Now

   Apple says some pop-ups have fake buttons that resemble a close button. Here OK starts the scam. Our 2019 text said to ignore the alert and not to download the suggested apps; that is still the right first move.

2. 2

   Leave the page

   On a Mac, click the address bar and type a new address or a search (Apple's advice), or close the tab with Command-W. On Windows close it with Ctrl-W. If unsure, close the whole window.

3. 3

   If the page will not close, end the browser

   PCrisk says some scam pages use scripts that stop a tab from closing, and that you then end the browser from Activity Monitor or restart the Mac. On a Mac press Command-Q, or Option-Command-Esc, choose the browser and click Force Quit. On Windows, if the page is full screen, press Esc or F11, then Ctrl-Shift-Esc, select the browser and click End task. Microsoft says scam pages can go full screen and try to disable Task Manager; if so, restart the PC. These key presses are standard but untested here on a live alert.

4. 4

   Reopen without the old tabs

   In Safari, quit it, then hold Shift while opening it so it does not reopen the old windows (Apple). In other browsers do not choose Restore or Reopen last session: PCrisk warns that restoring it takes you back to the page.

If you only saw the page, you are done with the urgent part. Nothing needs to be uninstalled and no scan is required for a page you closed.

Stop it coming back: notifications and extensions

This alert is a page, not a notification, so these steps matter only if you once clicked Allow on a site that sent you to it. Our 2019 guide said to reset each browser after removing adware; we keep it as a last step, for a page that returns after everything else. Internet Explorer was retired in 2022 and is not covered.

If the pop-ups keep coming: look for unwanted software

Our 2019 guide said the alert is seen most by people with adware, and that the programs causing it must be found and uninstalled. Apple and PCrisk agree on the narrower part: if you see such pages on many unrelated sites, something on the computer may be sending you there. If it appeared once, that site's ads are the cause.

1. 1

   Update, then restart

   Apple says to update to the latest macOS and, if it is already current, restart: macOS includes a tool that removes known malware at restart. On Windows, apply updates under Start > Settings > Windows Update > Check for updates (Microsoft).

2. 2

   Remove apps you did not choose

   On a Mac, in Finder > Applications, sort by Date Added and drag anything you do not recognise, or installed just before the alerts began, to the Trash. On Windows use Settings > Apps > Installed apps and sort by install date.

3. 3

   Remove unknown login items on a Mac

   System Settings > General > Login Items & Extensions. Select an item you do not know and click the remove (minus) button (Apple).

4. 4

   Check extensions

   Use the table above. An extension you did not add is a more common cause than a file you cannot see; we have no figures for that, so treat it as a place to look.

5. 5

   Scan, with the right expectation

   Our 2019 text recommended automatic removal software. A scan can find an installed cleaner or adware, but this alert is a web page with nothing to find, so a clean scan does not mean the page cannot come back. Microsoft's page suggests a full scan in Windows Security after you uninstall what scammers asked for. We recommend no product and tested none.

PCrisk's note on PUAs: they record data such as search queries and visited pages and show intrusive ads. That is why unfamiliar programs are worth removing even when the alert itself was only a page.