Severity scale:  

Mac virus. Its prevalence, main versions and removal (2019 guide)

removal by Jake Doevan - - | Type: Malware

Mac virus – computer infection showing ads, redirecting to suspicious sites or even stealing sensitive information

Mac virus - Your Mac is infected with 3 virusesYour Mac is infected with 3 viruses is one of the most notorious scams that target macOS users - it has many versions by always claims malware infections on the device and asks to install bogus software in order to remove it

Mac virus is a term used to describe infections that specifically target Mac operating systems and includes adware, browser hijackers, trojans, backdoors, and other malware. While mild infections might be just a nuisance, threats like OSX/Shlayer can sneakily install various potentially unwanted programs in the background, disable Gatekeeper security agent and compromise victims' online safety.

Most users might not even notice Mac virus, as the most dangerous threats, are designed in a way that prevents users from spotting them right away. Nevertheless, if your Mac is behaving strangely, for example, you see apps like Advanced Mac Cleaner installed without your consent, or Google Chrome, Safari or another browser is continuously showing you ads, it is most likely that you are infected with a Mac virus.

Questions about Mac virus

However, some computer behavior, like slowdowns, might not be related to any infections and might be related to configuration problems, or merely outdated software. Therefore, it is important to know whether or not your device is infected, and if it is – Mac virus removal should be performed as soon as possible to avoid such consequences like further malware infection, money loss or even identity fraud.[1]

Name Mac virus
Type Adware, browser hijackers, scareware, spyware, trojans, ransomware, droppers, cryptominers, and other malware
Targeted systems macOS, Mac OS X, iOS
Distribution methods Software bundling, fake Adobe Flash updates, spam emails, hacked websites, torrent sites, etc.
Risk factors Installation of other malware, sensitive data exposure, redirects to scam or phishing sites, loss of money, identity theft or fraud, etc.
Termination In some cases, the built-in protection is not enough to delete Mac malware. Thus, install reputable security software and perform a full system scan
Recovery  To restore normal macOS operation after virus infection, use Reimage Reimage Cleaner Intego

Depending on the type of infection, Mac virus can use a variety of methods to get into your device. Adware and browser hijackers usually spread as browser plugins, or standalone applications that pretend to be useful – they are referred to as scareware by security researchers.[2] Nevertheless, more severe malware is usually propagated with the help of more sophisticated methods, such as:

  • Hacked sites;
  • Fake updates (especially Adobe Flash[3] or Java, which was eventually killed by Apple in 2012)[4];
  • Torrent sites;
  • Spam emails;
  • Exploits, etc.

These methods are usually used by more dangerous threats, such as backdoors, RATs,[5] ransomware, cryptojackers, and many others.

To find out if your Mac device is infected, you should scan it with reputable security software, such as SpyHunter 5Combo Cleaner or Malwarebytes and remove Mac virus for good. In other cases, however, you will most be able to eliminate potentially unwanted programs manually, although that is not a rule either. Finally, if you do find an infection, terminate it and then scan it with Reimage Reimage Cleaner Intego – it can restore Mac's operation and fix virus damage.

“Mac viruses do not exist” myth debunked

For years, many users believed that Macs could not get infected by viruses simply because of the way the machines are designed. Indeed, your device will not allow you to install applications from anywhere else apart from the official App store, by default at least. Besides, built-in protection tools like Xprotect keep malicious software at bay.

Nevertheless, Mac viruses do exist, and they manage to bypass Apple's security measures, as more and more sophisticated malware is created by hackers. While it is true that Macs are less prone to be infected than Windows machines, they are not immune to viruses. Unfortunately, there are hundreds if not thousands of Mac users who still believe that Macs do not get infections and fail to use even basic security measures.

Mac virus terminationMac virus is a type of malware that targets Macs and can result in money loss, installation of bogus software and even identity theft

While Mac virus is generally a rare occasion, adware and phishing that relates to Macs have increased dramatically over the years. In 2019, Mac virus infection rate increased by 60% in comparison to the previous year, while 2016 to 2017 resulted in 270% increase.[6] Therefore, do not ignore warnings from cybersecurity experts, and adequately protect your machine from infections – install security software, keep your device updated, and use caution when installing new applications or browsing the web.

Fake Mac optimization tools are becoming more active

One of the most common Mac virus examples is fake optimization software, otherwise known as scareware. These tools are created to deliberately mislead users into thinking that their machines are in deep trouble by either claiming severe virus infections or flagging the false positives.[7]

Nevertheless, the main goal of such software is to make users pay for its full version, instead of actually helping them fix their computers. In fact, bogus optimization tools might not only fail to deliver but also disrupt the normal operation of Mac by deleting necessary files or affecting other system elements.

Below you will see the most prevalent versions of Mac virus that relates to scareware category – make sure you terminate any type of such programs if they land on your device.

Advanced Mac Cleaner

Advanced Mac Cleaner is one of the most notorious Mac viruses in the wild – it gets installed into systems via software bundles, via fake Adobe Flash updates, or infiltrated by malware downloaders like Shlayer trojan.

Advanced Mac Cleaner is a piece of software that is specifically designed for Macs and belongs to the scareware category. These potentially unwanted programs usually focus on scamming users and making them buy a full version of the application. Advertised as “system optimizers,” such tools usually show fake scan results, claiming dangerous computer infections or other discrepancies that need to be fixed immediately.

Quite often, users are also scared with specific timers, red flashing text, and other social engineering tricks. While most of the savvy computer users are aware of the scam scheme, the elderly or those who are not familiar with the world of computing often believe the lies and end up spending money on useless software like Advanced Mac Cleaner.

Mac virus Advanced Mac CleanerAdvanced Mac Cleaner is a fake system optimizer and can often be found promoted on scam sites like "Your Mac is infected with 3 viruses"

Mac Auto Fixer

Mac Auto Fixer is another scareware application that operates very similarly to all the tech support scams that are designed for Macs. Designed by PCVARK, one of the most controversial software developers out there,[8] it is promoted as a tool that can clean and speed up the Mac computer, while in reality, it is a fake system optimizer designed to scam users into buying its full version.

In reality, Mac Auto Fixer is a type of Mac virus that will not optimize, clean, or improve the operation of your computer. In fact, the software is also often included on scam sites that claim fake virus infections – users typically get redirected to such rogue sites by adware – a type of potentially unwanted application that focuses on displaying ads on all websites that they visit.

Therefore, if you see that Mac Auto Fixer performing scans on your computer out of nowhere, it is best to remove it immediately. While the tool is not dangerous, it might result in money loss and will keep reminding that it is thereby claiming fake virus infections.

Mac Tonic

Mac Tonic is another fake system optimizer and a potentially unwanted program designed for Mac operating systems. While many will find this application on their computers soon after the installation of freeware or shareware, the app was known to be spread with the help of fake Adobe Flash and Adobe Shockwave updates.

The application has typical behavior of a PUP:

  • gets installed without users noticing;
  • instantaneously performs system scans claiming various problems and infections;
  • asks users to buy its full version to fix their machines;
  • constantly displays ads that promote its full version;
  • adds entries to the system that prevents easy Mac Tonic removal.

Therefore, if you found it on your device, do not pay attention to any claims that the application makes, and immediately delete it either manually or automatically – pick the latter option if you struggle to terminate it by yourself.

Mac virus Mac tonicMac Tonic is another scareware application that tries to steal users' money by claiming fake virus infections

Main hijackers, adware and scams to know


QSearch is a browser hijacker that was explicitly crafted for Mac operating systems but can affect any type of browsers, including Google Chrome, Safari, Mozilla Firefox, Opera, and others. The potentially unwanted program specializes in taking over users' browsers by setting the homepage and new tab URL to or and then displays fake search results that are filled with sponsored links.

The scheme is straightforward and quite similar to adware – QSearch developers accumulate revenue each time the deceptive links are clicked – a program that is called pay-per-click. Therefore, the more ads and pop-ups it displays the more money software authors gain.

Unfortunately, the end users experience is completely forgotten, as they have to deal with QSearch hijack, which can pose security risks:

  • Alternative search results that not necessarily are useful, and might sometimes prevent finding relevant information;
  • Some text on sites is turned into hyperlinks;
  • Pop-up ads appear on sites that are legitimate and do not serve ads usually;
  • Phishing sites might result in a money loss or installation of bogus software;
  • Information tracking might expose even private data to unknown third-parties.
Mac virus QSearchQSearch is one of the most popular browser hijackers that targets Mac operating systems


MyShopcoupon is a plugin that allegedly helps users to find the best deals online and save some money while doing so. While theoretically, it sounds like a great option to find the best coupons, offers, and discounts while shopping online, the activity of this potentially unwanted application often disappoints Mac users.

As soon as users install MyShopcoupon, they can quickly see that their web browsers are filled with advertisements that come in forms of pop-ups, in-text links, banners, blinking windows and other intrusive content that disturbs web browsing sessions, instead of actually helping users find relevant information or products they are interested in.

Besides the intrusive ads, MyShopcoupon also tracks users that have the application installed. The gathered data includes:

  • IP address;
  • Geolocation;
  • Cookies;
  • Search queries;
  • Sites visited and the duration of the visit;
  • Links clicked;
  • System information, such as OS versions, etc.

While this Mac virus is not as dangerous as keyloggers or data stealers, it can still damage the web browsing experience and might lead to insecure websites.

Mac Detected TAPSNAKE infection

Mac Detected TAPSNAKE infection is a scam used to get personal details from people by tricking them into calling provided numbers. There are numerous versions of this scam scaring users into believing that the Tapsnake, CronDNS, and Dubfishicv viruses were detected. You must stay away from calling any amount from the pop-up or a warning message like this. The message delivers the awarning like this:

****Dont Restart Your Computer ****

Mac Detected TAPSNAKE infection, The Infections detected, indicate some recent downloads on the computer which in turn has created problems on the computer.Call Mac professionals at 800-130-1949 and share this code B2957E to the Technician to Fix This.


Exit windows like this because any interaction with these alerts can lead to more severe issues than Mac virus itself. You need to get a reliable anti-malware tool and clean the machine thoroughly because all these symptoms often are caused by PUPs – cyber intruders that come behind your back.

Mac virus scamsApple Security Breach is just another Mac virus variant and technical support scam that tries to swindle innocent user money

Mac OS X is infected (4) by viruses

Mac OS X is infected (4) by viruses is yet another the social engineering campaign based on the lock screen that claims about malware's activity on the system. This scam focuses on tricking people into calling the support for an immediate fix. However, this is a technical support scam that is closely related to adware. Once such a virus infects the system, it modifies it and starts showing fake warnings.

Mostly, the malware aims to steal account logins, other credentials like passwords or credit card details. However, this scam can also be used to infect the system with other malware or just sign the victim for the useless services that will be revealed only when the telephone invoice is inspected. Keep in mind that the message which is delivered to your web browser once you start browsing is nothing but a scam! Ignore it to avoid giving the attacker the remote access to your machine!

Macs are not immune to viruses – here's how to adequately protect yourself

As we already mentioned, the most common infections that plague Macs are adware and similar, potentially unwanted programs. While initially seen as harmless, they can compromise the device's security and result in much more severe infections, so having an adware is not safe at all.

To protect yourself from rogue software that continually displays ads, redirects you to phishing or scam sites and tries to convince you that the Mac is infected, you should never download applications from third-party websites and only trust official sources like App Store or Chrome web store. Nevertheless, even then it does not render your Mac immune to unwanted programs.

Therefore, you should always pay close attention to the installation process of all apps you are installing, even the legitimate ones. Always read through the installation instructions, do not skip through steps, and terminate all the suggested optional apps in the Advanced/Custom mode.

Additionally, one of the best security advice would be installing and running comprehensive security software that would prevent the most dangerous mac viruses from entering, and also making sure that your system is updated to the latest version. Just like Windows, Apple's software is not perfect and holds vulnerabilities that hackers can exploit in order to infiltrate malware automatically. While such threats are rare, it is always best to keep your system patched to avoid infections.[9]

Know more about Mac viruses in the dedicated section

While Mac is generally considered to be a much safer operating system than Windows, it is not entirely true. Experts estimate that around 1 billion computers run Windows, while approximately 100 million users choose a Mac.[10] Therefore, it makes sense for cybercriminals to create more malware for the most dominating computer system, as it increases the count of potential victims.

Nevertheless, Mac viruses do not step down when it comes to diversity, sophistication, prevalence, and other features of malware. As a result, users might encounter the following categories or Mac virus:

  • Adware
  • Browser hijackers
  • Fake system optimizers
  • Cryptominers
  • Banking Trojans
  • Ransomware
  • Info-stealers
  • Keyloggers, etc.

Regardless of which type of Mac virus your machine is suffering from, it is vital to delete it, as such infections can result in a sensitive information disclosure to cybercriminals, money loss, installation of other malicious software, etc. Additionally, your computer might be added into a botnet, which would turn it into unstoppable spam machine that sends fake messages to all the contacts on Facebook, email, Skype, etc.

For more information and types of Mac virus, refer to our Mac viruses category.

Mac virus

Delete Mac virus from your system to prevent additional issues

If your system is showing infection symptoms, you should immediately take action and remove Mac virus from your computer immediately. However, there are two different ways to terminate infections – manual and automatic. While both of them can be just as effective as each other, the latter gives users a benefit of preventing infections in the future.

If your Mac suffers from a browser hijacker or adware, you will most likely we able to perform a full Mac virus removal by simply moving the unwanted app to Trash and cleaning /Library/LaunchAgents, /Library/Application Support and /Library/LaunchDaemons folders. Nevertheless, if you are unsure how to do that, you should instead install security software and terminate unwanted apps automatically.

Besides, more severe threats like trojans and similar viruses make substantial modifications to Mac systems, so terminating these infections manually would be almost impossible. Thus, download SpyHunter 5Combo Cleaner or Malwarebytes in order to get rid of Mac virus for good and then scan your device with Reimage Reimage Cleaner Intego for best results.

You may remove virus damage with a help of Reimage Reimage Cleaner Intego. SpyHunter 5Combo Cleaner and Malwarebytes are recommended to detect potentially unwanted programs and viruses with all their files and registry entries that are related to them.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove Mac virus, follow these steps:

Erase Mac from Mac OS X system

To delete Mac virus from your device, please follow these steps:

  1. If you are using OS X, click Go button at the top left of the screen and select Applications. Cick 'Go' and select 'Applications'
  2. Wait until you see Applications folder and look for Mac or any other suspicious programs on it. Now right click on every of such entries and select Move to Trash. Click on every malicious entry and select 'Move to Trash'

Delete Mac from Internet Explorer (IE)

  1. Remove dangerous add-ons
    Open Internet Explorer, click on the Gear icon (IE menu) on the top right corner of the browser and choose Manage Add-ons. Click on menu icon and select 'Manage add-ons'
  2. You will see a Manage Add-ons window. Here, look for Mac and other suspicious plugins. Disable these entries by clicking Disable: Right click on each of malicious entries and select 'Disable'
  3. Change your homepage if it was altered by virus:
    Click on the gear icon (menu) on the top right corner of the browser and select Internet Options. Stay in General tab.
  4. Here, remove malicious URL and enter preferable domain name. Click Apply to save changes. Delete malicious URL, enter your desired domain name and click 'Apply' to save changes
  5. Reset Internet Explorer
    Click on the gear icon (menu) again and select Internet options. Go to Advanced tab.
  6. Here, select Reset.
  7. When in the new window, check Delete personal settings and select Reset again to complete Mac removal. Go to 'Advanced' tab and click on 'Reset' button. Now select 'Delete personal settings' and click on 'Reset' button again

Remove Mac virus from Microsoft Edge

Reset Microsoft Edge settings (Method 1):

  1. Launch Microsoft Edge app and click More (three dots at the top right corner of the screen).
  2. Click Settings to open more options.
  3. Once Settings window shows up, click Choose what to clear button under Clear browsing data option. Go to Settings and select 'Choose what to clear'
  4. Here, select all what you want to remove and click Clear. Select 'Clear' button
  5. Now you should right-click on the Start button (Windows logo). Here, select Task Manager. Open the start menu and select 'Task Manager'
  6. When in Processes tab, search for Microsoft Edge.
  7. Right-click on it and choose Go to details option. If can’t see Go to details option, click More details and repeat previous steps. Right-click 'Microsoft Edge' and select 'Go to details' Select 'More details' if 'Go to details' option fails to show up
  8. When Details tab shows up, find every entry with Microsoft Edge name in it. Right click on each of them and select End Task to end these entries. Find Microsoft Edge entries and select 'End Task'

Resetting Microsoft Edge browser (Method 2):

If Method 1 failed to help you, you need to use an advanced Edge reset method.

  1. Note: you need to backup your data before using this method.
  2. Find this folder on your computer: C:\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe.
  3. Select every entry which is saved on it and right click with your mouse. Then Delete option. Go to Microsoft Edge folder on your computer, right-click every entry and click 'Delete'
  4. Click the Start button (Windows logo) and type in window power in Search my stuff line.
  5. Right-click the Windows PowerShell entry and choose Run as administrator. Find Windows PowerShell, right-click it and select 'Run as administrator'
  6. Once Administrator: Windows PowerShell window shows up, paste this command line after PS C:\WINDOWS\system32> and press Enter:
    Get-AppXPackage -AllUsers -Name Microsoft.MicrosoftEdge | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register $($_.InstallLocation)\AppXManifest.xml -Verbose}
    Copy and paste a required command and press 'Enter'

Once these steps are finished, Mac should be removed from your Microsoft Edge browser.

Uninstall Mac from Mozilla Firefox (FF)

Certain infections might change the settings on Mozilla Firefox and stay persistent, even after the primary payload removal. Therefore, make sure you refresh Mozilla Firefox after you delete the virus:

  1. Remove dangerous extensions
    Open Mozilla Firefox, click on the menu icon (top right corner) and select Add-ons Extensions. Click on menu icon and select 'Add-ons'
  2. Here, select Mac and other questionable plugins. Click Remove to delete these entries. Select 'Extensions' and look for malicious entries. Click 'Remove' to get rid of each of them
  3. Reset Mozilla Firefox
    Click on the Firefox menu on the top left and click on the question mark. Here, choose Troubleshooting Information. Click on menu icon and then on '?'. Select 'Troubleshooting Information'
  4. Now you will see Reset Firefox to its default state message with Reset Firefox button. Click this button for several times and complete Mac removal. Click on 'Reset Firefox' button for a couple of times

Get rid of Mac from Google Chrome

  1. Delete malicious plugins
    Open Google Chrome, click on the menu icon (top right corner) and select Tools Extensions. Click on menu icon. Select 'Tools' and 'Extensions'
  2. Here, select Mac and other malicious plugins and select trash icon to delete these entries. Look for malicious entries and delete each of them by clicking on the Trash bin icon
  3. Click on menu icon again and choose Settings Manage Search engines under the Search section. When in 'Settings', select 'Manage search engines...'
  4. When in Search Engines..., remove malicious search sites. You should leave only Google or your preferred domain name. Click 'X' to remove malicious URLs
  5. Reset Google Chrome
    Click on menu icon on the top right of your Google Chrome and select Settings.
  6. Scroll down to the end of the page and click on Reset browser settings. When in 'Settings', scroll down to 'Reset browser settings' button and click on it
  7. Click Reset to confirm this action and complete Mac removal. Click on 'Reset' button to complete your removal

Eliminate Mac from Safari

To ensure that Safari does not keep any elements of the infection, reset it by following these steps:

  1. Remove dangerous extensions
    Open Safari web browser and click on Safari in menu at the top left of the screen. Once you do this, select Preferences. Click on 'Safari' and select 'Preferences'
  2. Here, select Extensions and look for Mac or other suspicious entries. Click on the Uninstall button to get rid each of them. Go to 'Extensions' and uninstall malicious add-ons
  3. Reset Safari
    Open Safari browser and click on Safari in menu section at the top left of the screen. Here, select Reset Safari.... Click on 'Safari' and select 'Reset Safari...'
  4. Now you will see a detailed dialog window filled with reset options. All of those options are usually checked, but you can specify which of them you want to reset. Click the Reset button to complete Mac removal process. Select all options and click on 'Reset' button

Do not let government spy on you

The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices. Avoid any unwanted government tracking or spying by going totally anonymous on the internet. 

You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using Private Internet Access VPN.

Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.

Backup files for the later use, in case of the malware attack

Computer users can suffer various losses due to cyber infections or their own faulty doings. Software issues created by malware or direct data loss due to encryption can lead to problems with your device or permanent damage. When you have proper up-to-date backups, you can easily recover after such an incident and get back to work.

It is crucial to create updates to your backups after any changes on the device, so you can get back to the point you were working on when malware changes anything or issues with the device causes data or performance corruption. Rely on such behavior and make file backup your daily or weekly habit.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware occurs out of nowhere. Use Data Recovery Pro for the system restoring purpose.

About the author
Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions

Removal guides in other languages