Your system is infected with 3 viruses on Mac: what it is and how to remove it
Your system is infected with (3) viruses is a scam message which pops up during your browsing sessions to "inform" the victim about 2 malware and 1 spyware infection found on the device. Thus, users are urged to perform a system scan if they want to protect their personal and banking data. This page covers it on macOS.
Facts checked October 7, 2026. Removal steps checked against Apple's current documentation and the security vendors' reports. We have not run the malware on a Mac. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your Mac is infected.
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds before you decide anything.
A scan of the PC is a quick way to confirm nothing was installed alongside the "Your system is infected with 3 viruses!" pop-up.
Do it yourself · free Remove Your system is infected with 3 viruses yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Your system is infected with 3 viruses: summary
| Distribution | Software bundles |
|---|---|
| Damage | Users can be tricked to submit credit card details and/or install malicious programs |
| Name | Your system is infected with 3 viruses |
| Type | Malware, fake pop-ups caused by adware |
| other versions | Your Mac is infected with three (3) viruses MAC OS is infected with Spyware Your MacOS 10.14 Mojave Is Infected With 3 Viruses! Your Mojave Is Infected With (3) Viruses! We Detected Unwanted Pop-Ups on Your Mac |
| Symptoms | Adware program starts delivering fake virus alerts which pop up in a new window and prompt to scan the PC |
| Removal | Scan the Mac with security software to find the malware and anything installed with it. Fortect for Mac scans for malware and unwanted programs. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 6 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Evidence | 5 write-ups by security sites; no sample analysed yet |
| Imitates | Microsoft support |
| Phone number | +1-844-295-3111 |
| First seen | 4 January 2021 |
| Facts checked | 7 October 2026 |
What the Your system is infected with 3 viruses pop-up looks like
Your system is infected with 3 viruses!
Your Mac is infected with 3 viruses. Our security check found traces of 2 malware and 1 phishing/spyware.
System damage: 28.1% - immediate removal required!
The immediate removal of the viruses is required to prevent further system damage, loss of Apps, Photos or other files. Traces of 1 phishing/spyware were found on your Mac with OS X High Sierra. Personal and banking information are at risk.
To avoid more damage click on 'Scan Now' immediately. Our deep scan will provide help immediately!
Is the Your system is infected with 3 viruses warning real?
- Phone number:
+1-844-295-3111
From our report of Jan 2021 · not reviewed since
More from our earlier report on Your system is infected with 3 viruses
- The scam can be seen on an infected website.
- Additionally, it can be caused by an adware virus hiding in the system.
- MAC OS is infected with Spyware and other malicious applications.
- Spyware must be removed and system damage repaired.
- It is necessary to Call Apple Support +1-844-295-3111 and follow Virus removal procedures immediately, please proceed.
- If you leave this site your Mac OS will remain damaged and vulnerable The removal of (3) Spyware is required immediately to prevent further system damage, loss of Apps, Photos and other files.
- Traces if (1) Phishing/Spyware were found on your Mac OS X.
- 4 minutes and seconds 52 remaining before damage is permanent.
How to get rid of Your system is infected with 3 viruses on a Mac
Close the page safely and stop it coming back.
If you called, paid or let someone in, the last steps matter most.
Step 1: Close the page without touching its buttons
Do not click anything on the Your system is infected with 3 viruses page, not even its Close or OK button. Press Command + Q to quit the browser.
If the page blocks that, press Command + Option + Esc, select the browser and click Force Quit. When you open Safari again, hold Shift while it starts so the old windows are not restored.
Step 2: Remove the site's permission to send notifications
In Safari open Settings > Websites > Notifications and remove any site you do not know, or set it to Deny. In Chrome open
chrome://settings/content/notifications, in Firefox Settings > Privacy & Security > Notifications > Settings. Then check System Settings > Notifications for browser alerts you did not expect.Step 3: Check the browsers for extensions and changed settings
In Safari open Settings > Extensions and General (homepage). In Chrome open
chrome://extensions, in Firefoxabout:addons.Remove any extension you did not add, and reset the homepage and search engine if they changed. Browsers hold saved passwords and cookies, which is why the password step comes first.
Step 4: If you called, paid or gave access
If you called the number on the page, let someone connect to the Mac, or paid, act now. Remove any remote access app they asked you to install from the Applications folder, then change your e-mail and bank passwords from another device.
Call your bank or card issuer, tell them it was a scam and ask to block or dispute the payment. Apple does not show alerts with phone numbers in a browser and does not ask for payment to fix a Mac.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 5: Report it and watch your accounts
Report the site and the command to the authorities in your country, and tell your bank if any card was saved in a browser or in Keychain.
Over the next weeks watch your e-mail, bank and exchange accounts for sign-ins and transfers you did not make. Keep the notes you made, such as the process names and the file dates, in case a bank or the police ask for them.
Full procedure with screenshots: Report a cyber attack or scam to the authorities
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Remove from Microsoft Edge
Delete unwanted extensions from MS Edge:
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click Remove.
Clear cookies and other browser data:
- Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
- Under Clear browsing data, pick Choose what to clear.
- Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.
Restore new tab and homepage settings:
- Click the menu icon and choose Settings.
- Then find On startup section.
- Click Remove next to any suspicious startup page.
Reset MS Edge if the above steps did not work:
- Press on Ctrl + Shift + Esc to open Task Manager.
- Click on More details arrow at the bottom of the window.
- Select Details tab.
- Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.
Delete extensions from MS Edge (Chromium):
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.
Clear cache and site data:
- Click on Menu and go to Settings.
- Select Privacy, search and services.
- Under Clear browsing data, pick Choose what to clear.
- Under Time range, pick All time.
- Select Clear now.
Reset Chromium-based MS Edge:
- Click on Menu and select Settings.
- On the left side, pick Reset settings.
- Select Restore settings to their default values.
- Confirm with Reset.
- This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
From our report of Jan 2021 · not reviewed since
Your system is infected with (3) viruses is a fake Safari pop-up urging users to scan Mac to prevent the loss of personal information
Your system is infected with (3) viruses is a scam message which pops up during your browsing sessions to "inform" the victim about 2 malware and 1 spyware infection found on the device.
Thus, users are urged to perform a system scan if they want to protect their personal and banking data. Keep in mind that this is a Mac scam designed to either infiltrate it with potentially dangerous software or trick people into giving sensitive information to the scammers.
This tech support scam encourages people to use the provided phone number to contact Apple support which is obviously fake. People behind it have nothing to do with Apple, and calling these numbers can lead victims to more significant damage.
The phishing scam messages occur when the browser is active and information about threats appears alongside the Apple Support number that should be called if the user wants to remove all those viruses. However, this is not related to any threats and real security issues.
If you run across a particular warning, make sure to ignore it and move on to system cleaning processes. Visiting any redirect sites can lead to insecure sites filled with malware. Also, calling the provided number or contacting criminals in any way can result in serious issues either with your device or privacy and security of information.
Usually, the pop-up is delivered by an adware program. You can get infected with one via software-bundles if you do not pay close attention during the installation of freeware. The false message appears in a new window and displays the following warning:
Scammers behind the fake warning are motivated to gain illegal revenue from this fake alert. Likewise, they can ask you to submit your personal information if you proceed and click on the "Scan now >>" button displayed in the bottom-right corner of the window.
The pop-up message of the second scam reads the following:
After Apple presented Mojave OS, scammers released the following scam which is almost identical to the previous ones:
Note that this message is fake and you should not agree to perform the system scan. Keep in mind that criminals try to make the scam look convincing. Thus, it's easy to get tricked as they claim that the user must scan their computers immediately if they do not want to lose the following data:
However, we can assure you that your computer is safe you should never fall into the trap of scammers. Instead, you can remove adware and check your device for other cyber threats using a reliable antivirus. This way, you will not be tricked to install fake security programs or even malware.
We advise using for preventing any issues related to system changes caused by the scam. However, for Your system is infected with 3 viruses removal, you need to get rid of every adware-type virus that could be related to this scam.
Unfortunately, there are numerous ad-supported threats that could cause this fake error, so make sure you opt for a full system scan instead of going thru your PC system manually. Note, that there are alternative ways how you can get rid of this fake pop-up as well. They are presented at the end of this article.
- Banking details;
- Apps;
- Photos;
- Other files.
From our report of Jan 2021 · not reviewed since
Mac OS is infected with Spyware - yet another version of this tech support scam
MAC OS is infected with Spyware is yet another error message displayed on the system by cybercriminals.
It is stating about possible malware infections and offering to contact Apple support.
The error message indicates that there is adware on your system that causes these issues and redirects you to websites filled with commercial content. Those advertisements cause redirects to rogue sites where this scam message is displayed.
Be aware that this alert about spyware and malware danger is fake and your device is probably safe, the only infection is this potentially unwanted program that delivers intrusive ads to you.
You must remove adware from the system immediately because such programs can also track users' information. An IP address, location, browsing habits, and search preferences can be accessed immediately after infiltration without any additional malware tools.
From our report of Jan 2021 · not reviewed since
Your Mac Might Be Infected is seeking the same aim - to trick users into dialing fake support numbers
Your Mac might be infected message is an identical scam mostly displayed on the Safari web browser.
It resembles the official Apple background and can easily lure people into calling the questionable number. This scam message can easily affect other browsers, so you need to clean the system further and remove all changes the related adware has initiated on your system.
People disguised as Apple employees are seeking certain things:
Make sure you remove "Your Mac might be infected" virus right after it starts interrupting you.
Warning: You should never call these given numbers because people behind the "support" team have one goal - to lure your money or steal credit information, logins and passwords.
- get the remote access on the device;
- install malicious programs (like keyloggers or trojans);
- swindle the money for the invented service;
- steal financial and personal information.
From our report of Jan 2021 · not reviewed since
Prevent scams by paying attention during the installation of freeware
You can encounter fake virus scan alerts if your system is infected with an ad-supported program.
This software is designed to deliver commercial content and scam messages for malevolent purposes. Adware is distributed by employing a well-known marketing technique called bundling.
In other terms, these potentially unwanted programs (PUPs) are installed as additional components with freeware. If users rush through the installation procedure and choose Quick or Recommended settings, they are unable to detect the adware which comes together.
Therefore, it is essential to be cautious when installing freeware — pick Custom or Advanced mode of the installer and search for suspicious pre-selected elements. Make sure you uncheck those marks and run a full system scan to ensure that none of the PUPs managed to get through.
Uninstall suspicious pieces from the machine
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
From our report of Jan 2021 · not reviewed since
Stop the scam messages from showing up on your browser
The easiest way to remove adware from the device is to get a professional malware removal tool.
It will only take you several minutes before the security software identifies and adware and cleans your Mac from potentially unwanted programs or other cyber threats.
However, manual Your Mac is infected with 3 viruses removal is also an option. Elimination guidelines that can help you complete the procedure are presented below. Although, Virusi.bg team suggests uninstalling the adware automatically as it is a safer method.
Questions about Your system is infected with 3 viruses
Did the "Your system is infected with 3 viruses!" pop-up really find a virus?
It did not find anything, because a web page has no way to look at your files. The scan animation, the number of threats and the warning "Your system is infected with 3 viruses!" are part of the page and are the same for everyone who lands on it.
What the pop-up does tell you is that your browser was sent to a scam page, either through an ad, a redirect or a notification permission. That source is worth removing.
For a real answer about infections, run a scan in Windows Security or another antivirus you installed yourself, not one offered by the page. If the real scan finds nothing and the page stops after you clean up notifications and extensions, you are done.
The warning said to call +1-844-295-3111. Should I?
Do not call. A genuine problem on your PC is reported by Windows Security or your own antivirus in its own window, without a phone number. A warning that tells you to call +1-844-295-3111 is a tech support scam, and the call is where the harm happens:
- remote access
- fake repairs
- card payments
- gift card requests
Close the warning instead. If it is in a browser tab, end the browser in Task Manager.
If it is in its own window, find the program in Installed apps and uninstall it. Then run a scan in Windows Security to be sure nothing else was added.
I clicked on the "Your system is infected with 3 viruses!" pop-up. Am I infected?
Clicking a button on the page usually only opens another page or starts a download. If nothing was downloaded and you did not run any file, the PC is very likely fine, and closing the tab is enough.
If a file was downloaded, delete it from the Downloads folder without opening it. If you opened it, treat the PC as infected: uninstall anything new in Installed apps and run a full scan.
If the page that showed "Your system is infected with 3 viruses!" also led you to type a password or card number, change that password from another device and call your bank. The sections after the removal steps cover each of these cases in order.
I called +1-844-295-3111 and let them connect. What now?
Act in this order. Disconnect the PC from the internet so the session ends. Uninstall the remote-access program they asked for, and check Installed apps for anything else added during the call.
From another device, change your e-mail and banking passwords and turn on two-step verification. If you paid or gave card details, call your bank today and ask to block the card and dispute the payment.
Watch for follow-up calls offering a refund; they are part of the same scam. Finally, report +1-844-295-3111 to the authorities in your country with the date and amount.
Is Your system is infected with 3 viruses really from Microsoft support?
No. It is a web page made to look like a message from Microsoft support. Websites cannot scan your computer, see your files or know whether your antivirus is active. Real security warnings appear in Windows Security or in your antivirus program, not as browser pages with phone numbers, countdowns or prize wheels.
Close the page; nothing was installed just by seeing it. If you want to check, open Windows Security from the Start menu and run a quick scan. It shows the real status of your protection.
I called +1-844-295-3111. What should I do?
If you only talked, hang up and do not call back. The number +1-844-295-3111 belongs to the scammers behind Your system is infected with 3 viruses, not to Microsoft support. If you let them connect to your PC, disconnect from the internet, uninstall the remote access program they used and run a full and offline scan.
Change passwords you typed during the call from a clean device. If you paid or gave bank details, call your bank at once. Report the number and expect refund calls later; they are part of the same scam.
Will Your system is infected with 3 viruses come back after I close it?
It may, if the thing that opened it is still there. Closing the tab ends that one page, but a notification permission, an extension or an adware program can open A browser warning that reads "Your system is infected with 3 viruses!" again later.
Check the browser's notification settings and extensions first, then Installed apps for anything new. If the page does not return within a day or two of normal browsing, you have removed the source. If it does, reset the browser, which clears permissions and settings in one step.
Is my computer infected?
Seeing the page does not mean the PC is infected. You reached it through an ad, a redirect or a notification. Check whether something on the PC sends you there: if the page opens by itself or on every site, look for extensions and notification permissions, and run a scan.
If you downloaded or ran something the page offered, treat the PC as possibly infected and follow the plan. A full scan with Windows Security gives you a clear answer either way.
Is it safe to force-close the browser?
Yes. Ending the browser in Task Manager or restarting the PC does not damage Windows or your files, despite what pages like Your system is infected with 3 viruses say.
The warning "do not close this window" is part of the scam. At worst you lose unsaved text in other tabs. After restarting, do not let the browser restore the previous session, because that would reopen the scam page.
If it reopens anyway, open the browser's settings for startup pages and remove the address. Then remove its notification permission if it has one.
Will Fortect remove Your system is infected with 3 viruses?
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds on your Mac before you decide anything.
For Your system is infected with 3 viruses, follow the plan on this page as well: removing a launch item or an app is done in macOS itself, and a scanner cannot undo what was typed or entered on the infected Mac, such as saved passwords that were copied.
Change your passwords from another device first, and if the page tells you to erase the Mac, a scan is not a substitute. The free scan costs nothing and the full-featured product needs a license.
Sources
- WCPO: Apple users now targeted by tech support scams (read October 7, 2026)
- Wikipedia: Adware (read October 7, 2026)
- Virusi: Virusi (read October 7, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)