How to Check for Malware on Mac

A note from our experts:

 

It may be a very difficult task to detect malware or a virus on your Mac. In such a case, the best decision is to use a third-party app. MacKeeper’s Antivirus is such an app.

 

Here’s how to use MacKeeper’s Antivirus:

1. Open MacKeeper, and go to Antivirus on the left bar.
2. Click Start Scan.
3. MacKeeper’s Antivirus finishes scanning and shows you the list of detected malware. Delete it from your Mac or move it to Quarantine.

How to know if your Mac has a virus

Can Macs get viruses? Yes, and it doesn’t matter if you have a MacBook Air, Mac mini, or an iMac. It’s also vital to detect malware as soon as possible. The sooner you know you have an infection, the sooner you can check your Mac for viruses and remove them, protecting your computer and data.

There are a few ways to detect viruses on Mac:

• Look out for warning signs of an attack.
• Check system folders for suspicious files.
• Locate apps that you didn’t install.
• Run an antivirus scanner app.

Signs of malware on Mac

Be aware of the fact that while some malware infections are obvious, others aren’t. Many attackers go to great lengths to conceal their malicious software so that you’re less likely to spot it and remove it, but there are some clear signs of malware that you can look out for:

• Extremely slow performance: Many malware infections eat up a lot of processing power and memory, which makes your Mac feel sluggish and more unstable.
• A browser homepage change: Some malware infections hijack your browser and then set a malicious website as your homepage, or redirect you to different sites.
• Pop-ups and other intrusive ads: Displaying ads can be a profitable endeavor, so some adware infections place these wherever they can on your system.
• Freeze-up and restarts: Malware infections can often make your Mac unstable, which can lead to frequent freezes and restarts.
• Bogus security alerts: If you see a security alert that doesn’t look genuine, it could be malware that’s trying to steal payment information or direct you to other malicious downloads.
• Your friends receive spam from you: Do you have a friend who says they received spam or strange messages from one of your accounts? This is a common sign that malware has infected your Mac and gained access to your messages and emails.

And if your Mac gets infected with ransomware, it’ll be pretty obvious. You’ll get a demand to pay a ransom, and you’ll find your files or drives have been encrypted and can’t be opened.

The difference between malware and a virus

Malware is short for malicious software, an umbrella term for all kinds of nasty programs that can be harmful to your computer and your data. Technically, viruses are a type of malware, but there’s a difference between these and other infections.

The key aspect of a virus is that it’s usually a small program that infects other files and applications on your Mac, and then spreads throughout your system. This is unlike other malware infections that are built as standalone pieces of software, which try to look legitimate or disguise themselves as something else.

List of Mac viruses

There are many, many viruses built for Mac, and every year, thousands of new infections surface. As the macOS operating system has become more popular, this problem has only gotten worse. Some of the most recent and most common infections include XMRig, MacStealer, and RustBucket. Read our Mac viruses list for details on how each one works.

How to check for viruses on Mac

There are a few different ways to check for viruses on Mac, some of which are built right into macOS:

1. Identify malware with Activity Monitor

A great way to find out if your Mac is infected with malware is to look for suspicious processes in Activity Monitor. Here’s how:

1. In Finder, go to Applications > Utilities, then launch Activity Monitor.
2. Check the list of running processes for anything that seems suspicious with unusually high CPU or RAM usage. Click the % CPU or Memory column headers to sort them.
3. To force quit a suspicious process, select it, then click the X button.
4. Click Force Quit to confirm.
5. In Finder, search for the name of the process and delete any corresponding files.
6. Empty the Trash to remove them.

We recommend that you don’t quit anything before confirming what it does, as you may inadvertently close important system processes. If you find anything that could be malware, search its name in Google to see what it is before closing it.

2. Run a Mac virus scan using built-in tools

Every Mac comes with antivirus detection built in. macOS includes a technology called XProtect, which scans your Mac for malware using a database of virus signatures maintained by Apple. This checker is free and enabled by default, so you don’t need to do anything to use it. If you download malware and try to run it, XProtect can detect it and stop it from running.

Here’s how to check if XProtect is getting updates:

1. In System Settings, select General > Software Update.
2. Click the i icon next to Automatic Updates.
3. Make sure Install Security Responses and system files is activated.

A friendly reminder: XProtect, although better than nothing, is limited in a few key ways. Apple isn’t a security company, for a start, so XProtect doesn’t detect as many viruses as a dedicated security app, and you don’t get full control over the cleanup. XProtect is a passive solution–you can’t run a scan to check your Mac for malware, so it’s not the best way to clean viruses from your Mac.  

3. Check for unwanted applications

The Applications folder might not seem like the best place to check for Mac viruses. After all, most malware wants to remain hidden within unwanted apps, and, that’s why, is difficult to access. Still, it’s worth starting to detect a trojan virus on Mac from this folder as it can contain seemingly legitimate apps, which are actually loaded with viruses.

How to check for suspicious apps:

1. Go to the Applications folder.
2. Look for any apps you don’t recognize or don’t remember installing. Check Google to see if they’re legitimate or not. If they’re not, or if you’re suspicious, delete them and empty your trash.

Alternatively, it’s even easier to remove unwanted apps with MacKeeper’s Smart Uninstaller:

1. In MacKeeper, select Smart Uninstaller in the sidebar.
2. Click the Applications option.
3. Select the apps you want to uninstall, then click Remove Selected.

4. Check the Downloads folder

Whenever you search for malware on Mac, you should check your Downloads folder. If you’ve been tricked into downloading something malicious, there’s a good chance you’ll see it there.

Simply follow these steps to check your Mac’s downloads for malware:

1. Open a new Finder window, and select Downloads from the sidebar.
2. Look through your downloads for anything that you don’t recognize or don’t recall downloading. Right-click it, and select Move to Trash / Move to Bin.
3. Right-click your trash/bin, and select Empty Trash / Empty Bin.

5. Check suspicious login items

Malware will often load automatically when you start your Mac, and you might check your macOS login items list. Bear in mind, though, many login items like Launch Daemons, and Launchagents won’t actually appear in this list, so you may need to go further to find them and protect your Mac from malware.

Here’s how to check suspicious login items:

1. In System Settings, select General > Login Items.
2. Look through the list and select anything you think is suspicious.
3. Click the minus button to remove the login item.

Additionally, you can also manage login items using the MacKeeper app like so:

1. In MacKeeper, select Login Items in the sidebar.
2. Select the items you don’t want to run at startup, then click Remove Select Items.

6. Check browser homepage and extensions

Malicious browser extensions that monitor your online activities and steal your data have become increasingly common. Check your browser for suspicious extensions and delete any you don’t recognize or no longer need to prevent them from causing any harm.

To check your homepage and extensions in Safari:

1. Select Safari > Settings in your menu bar.
2. In the General section, check that your homepage is set properly.
3. Next, click Extensions. Select an extension to remove and click Uninstall.
4. Click Show in Finder, then send the extension to your trash.

Manage homepage and extensions in Chrome:

1. Select Chrome > Settings from your bar.
2. Click Appearance in the sidebar, under the Show Home button, check your homepage.
3. Next, select Extensions from the side. Click the Remove button on an extension you want to delete.
4. Click Remove to confirm.

7. Clear your browser cache

If your web browser has been infected by Mac malware, you need to ensure you clear its cache once the malware has been dealt with. The cache is where your browser stores files that it may need to use again in the future, and these can often become infected as well.

To clear your cache in Safari, follow these steps:

1. Open Safari, then click Safari > Settings in your Mac’s menu bar.
2. Click the Privacy tab, then select Manage Website Data.
3. Click the Remove All button, then select Remove Now to confirm.

Here’s how to clear your cache in Google Chrome:

1. Open Google Chrome.
2. Click History > Show Full History in your Mac’s menu bar.
3. Select Clear browsing data.
4. Ensure Cached images and files are selected, then click the Clear data button.

Hint from our team: 

 

If you prefer using browsers other than Chrome or Safari, there’s no need to panic. Instead, check our full guide on clearing cache on Mac and find the required instructions.

8. Boot your Mac in Safe Mode

When dealing with potential malware, Safe Mode can be very useful. It boots your Mac without any third-party drivers, helping diagnose and remove infections.

On an Apple Silicon Mac, simply do as follows:

1. Shut down your Mac.
2. Press and hold the power button until you see Loading startup options.
3. Select a volume.
4. Press and hold the Shift key, then select Continue in Safe Mode.

To start your Intel Mac in Safe Mode:

1. Power on or restart your Mac, and immediately press and hold Shift.
2. When you see the login window, release the Shift key.
3. Log in again if you’re asked. You’ll now be Safe Mode.

In both cases, you should see “Safe Mode” in your menu bar.

9. Check if your email has been compromised

Some malware infections gain access to your email to steal personal data, which attackers can then use to clone your identity and take out phone contracts, credit cards, and other things in your name. Therefore, it’s important to check if your email account is safe when you scan for malware on Mac.

Use MacKeeper’s ID Theft Guard to see if your email has been compromised:

1. In MacKeeper, select ID Theft Guard in the sidebar.
2. Check your personal data leaks, then click Review.
3. Click Send Code to receive a verification code for safety.
4. Find the code in your email inbox, then paste it into MacKeeper and click Enter.
5. Check all accounts that have been compromised and follow the steps to fix them.

10. Scan a Mac for viruses automatically

Ultimately, trying to find malware on your Mac manually is a losing game. Well-designed viruses don’t make themselves easy to find or remove. Built-in features like XProtect do help, but do Macs need antivirus too? Without a doubt. When it comes down to it, the best way to scan a Mac for viruses is to use a tool like MacKeeper, which is capable of protecting and cleaning your device.

There are two main types of protection you need to use—antivirus scans and real-time protection. Scans can be carried out on demand, searching your entire system or chosen folders for malware, so you can clear a virus from your Mac when you need to. Real-time protection is always on, and if you download or try to run a virus, it kicks in and lets you know.

Here’s how to run a virus scan in MacKeeper:

1. Open MacKeeper, and select Antivirus from the sidebar.
2. If you want to scan certain folders only, click Custom Scan. Otherwise, click Start Scan.
3. When the scan is finished, select any detected malware, and you can either delete it from your Mac or move it to Quarantine.

What to do if your Mac has a virus

If you’ve carried out the appropriate checks and discovered that your Mac has a virus, you’ll need to deal with it as quickly as possible. In addition to following the above steps, there are other precautions you can take to minimize the damage the virus can do, including:

• Stay offline: Disable the Wi-Fi on your Mac from the Control Panel, or disconnect the Ethernet cable if you use a wired connection. If possible, turn off your router temporarily. This will stop any viruses from communicating with the attackers’ servers and prevent any more of your data from being transmitted to them.
• Avoid logging into any accounts: Avoid logging into any of your accounts, or entering any passwords until you can be sure the virus is removed. If the virus is using a keylogger to record all of your keyboard inputs, this will ensure that it cannot steal any. Also, avoid opening any password managers you use to prevent the virus from taking screenshots of them.
• Change your Mac’s login password: In System Settings > Users & Groups, change all the login passwords for your Mac to ensure the virus cannot access your machine remotely using details it has already stolen.
• Change your iCloud password: If the virus has stolen your iCloud password, it’ll be able to access your saved passwords, photos and videos, messages, and all other data that is uploaded to the cloud. In System Settings > Apple ID > Sign-In & Security, change your iCloud password to prevent others from logging in.
• Cancel debit and credit cards: Call your bank and credit card providers to cancel all the cards you have saved on your Mac. This will prevent attackers from using any payment details they may have stolen.

How to remove malware from Mac

If you ever pick up an infection, you should start by disconnecting your Mac from the Internet. This isolates the malware and blocks it from connecting with the control server. Then you can learn how to remove malware from your Mac. In extreme cases, that may involve resetting your Mac or restoring from a backup, but often you can get rid of viruses on your Mac by following our pieces of advice:

• Check for suspicious background processes with Activity Monitor.
• Make sure XProtect is enabled.
• Check for unwanted applications.
• Look in your Downloads folder for suspicious files.
• See if you’re running any suspicious login items.
• Run a virus scan for Mac.

Doing so, you’ll keep your Mac clear of malware and protect your data. Using MacKeeper’s Antivirus is particularly important because it includes real-time protection. This way, you can stop viruses from ever taking hold rather than acting only when the horse has already bolted. For more information on keeping your Mac safe, check out our Mac security guide.

How to avoid malware on your Mac

Just as important as knowing how to remove Mac malware is knowing how to avoid it so that you don’t pick up more infections in the future. Fortunately, it’s not difficult to maintain a healthy Mac with a few simple steps:

• Avoid suspicious software: macOS will prevent you from opening potentially unsafe software from unregistered developers. Keep these protections enabled to prevent malware from being installed, and only download software from trusted sources.
• Be wary of fake files: Viruses are often hidden inside files that are disguised as innocent downloads, such as PDF documents, Word files, and app packages. Don’t trust files if you can’t be sure of where they came from, and be extra cautious before opening files that have been sent to you through emails. Don’t open files that suddenly appear without warning.
• Look out for fake updates and tools: Some viruses disguise themselves as software updates, system tools, or trusted applications. Only download these things from trusted sources, such as the App Store or an official developer webpage.
• Don’t trust unsolicited support: If you receive a call or message offering Mac support that you didn’t ask for, ignore it. Genuine support companies don’t cold call customers to provide help for no reason, so it’s likely a scammer trying to convince you to download a virus.
• Follow good cyber practices: Take the usual precautions to protect your Mac and your data whenever you use your machine. Avoid untrusted websites, use antivirus software, use strong passwords that you don’t share with others, and be wary of sharing personal data.

FAQ 

How do I run a malware scanner on my Mac?

To find hidden malware on your Mac, use the Antivirus utility built into MacKeeper. It trawls through your entire system to weed out malicious applications and then removes them. Also, our tool uses a real-time monitoring feature to ensure that you’re alerted to new threats as soon as they appear.

Does Mac have a built-in malware scan?

Yes, macOS has a built-in tool called XProtect that scans your system for viruses and malware. However, it doesn’t have the ability to perform on-demand scans or scan specific files and folders like a dedicated antivirus tool.

How can I clean my Mac from malware?

You can manually remove malware from your Mac by uninstalling unrecognized apps and deleting suspicious processes. However, it can be difficult to locate hidden malware programs, which is why dedicated tools like MacKeeper’s Antivirus are essential to many users.

Is it possible for a Mac to have malware?

Yes, there are tens of thousands of malware infections built for Mac, and that number only increases as the operating system becomes more popular. Although macOS is regarded as being less susceptible to malware than Windows, it’s certainly not immune, as some Mac users believe.