How to Check for Malware on Mac

Malware is a growing problem for Mac users, with close to 1 billion infections detected as of February 2024. As more people buy Macs, cybercriminals take an increased interest in targeting them with malicious software. Being careful and using antivirus software can help you avoid malware infections most of the time. But viruses, worms, ransomware, and other digital threats can sometimes get through anyway. If that happens, you need to know it’s there so that you can protect your Mac from malware.

As it's important to check for malware on Mac regularly, we'll explain to you how to do it effectively.

Before we start

 

If you suspect your Mac has a malware infection, every second counts. For that reason, we recommend running MacKeeper’s Antivirus tool.

 

Here’s how to run an on-demand scan:

1. Open MacKeeper, and select Antivirus from the sidebar.
2. Click Start Scan to run a full scan.
3. When the scan finishes, review the results.
4. Highlight what you want to remove, then click Move to Quarantine.

Using MacKeeper’s malware detector and remover is really that simple. Plus, it’s packed with other tools to keep your machine in top condition. Try MacKeeper today, and discover a safer, cleaner Mac.

How to know if your Mac has a virus

Can Macs get viruses? Yes, and it doesn’t matter if you have a MacBook Air, Mac mini, or an iMac. It’s also vital to detect malware as soon as possible. The sooner you know you have an infection, the sooner you can remove it, protecting your computer and data.

There are a few ways to detect viruses on Mac:

• Look out for warning signs of an attack.
• Check system folders for suspicious files.
• Locate apps that you didn’t install.
• Run an antivirus scanner app.

Signs of malware on Mac

Be aware of the fact that while some malware infections are obvious, others aren’t. Many attackers go to great lengths to conceal their malicious software so that you’re less likely to spot it and remove it, but there are some clear signs of malware that you can look out for:

• Extremely slow performance: Many malware infections eat up a lot of processing power and memory, which makes your Mac feel sluggish and more unstable.
• A browser homepage change: Some malware infections hijack your browser and then set a malicious website as your homepage, or redirect you to different sites.
• Pop-ups and other intrusive ads: Displaying ads can be a profitable endeavor, so some adware infections place these wherever they can on your system.
• Freeze-up and restarts: Malware infections can often make your Mac unstable, which can lead to frequent freezes and restarts.
• Bogus security alerts: If you see a security alert that doesn’t look genuine, it could be malware that’s trying to steal payment information or direct you to other malicious downloads.
• Your friends receive spam from you: Do you have a friend who says they received spam or strange messages from one of your accounts? This is a common sign that malware has infected your Mac and gained access to your messages and emails.

And if your Mac gets infected with ransomware, it’ll be pretty obvious. You’ll get a demand to pay a ransom, and you’ll find your files or drives have been encrypted and can’t be opened.

The difference between malware and a virus

Malware is short for malicious software, an umbrella term for all kinds of nasty programs that can be harmful to your computer and your data. Technically, viruses are a type of malware, but there’s a difference between these and other infections.

The key aspect of a virus is that it’s usually a small program that infects other files and applications on your Mac, and then spreads throughout your system. This is unlike other malware infections that are built as standalone pieces of software, which try to look legitimate or disguise themselves as something else.

List of Mac viruses

There are many, many viruses built for Mac, and every year, thousands of new infections surface. As the macOS operating system has become more popular, this problem has only gotten worse. Some of the most recent and most common infections include XMRig, MacStealer, and RustBucket. For a complete list and details on how each one works, see our guide to Mac viruses.

How to scan for viruses on Mac

There are a few different ways to scan for viruses on Mac, some of which are built right into macOS:

• Identify malware with Activity Monitor
• Run a Mac virus scan using built-in tools
• Check for unwanted applications
• Check the downloads folder
• Check suspicious login items
• Check browser extensions
• Clear your cache
• Check if your email has been compromised

How to identify malware with Activity Monitor

If you suspect your Mac has been infected with a virus, one of the best places to identify malware is in Activity Monitor. Here, you’ll be able to see background processes and apps that are running—including viruses, adware, and other nasties.

How to check Activity Monitor for Mac viruses:

1. Open Activity Monitor from Applications > Utilities. Go to the CPU tab if you’re not already in it.
2. Click the % CPU column to sort all processes by CPU usage, and look for anything in the list that’s eating up a lot of CPU power.
3. If you see a suspicious process, do a Google search on it. You should find information that confirms whether it’s malware or not.

Run a Mac virus scan using built-in tools

Every Mac comes with antivirus detection built in. macOS includes a technology called XProtect, which scans your Mac for malware using a database of virus signatures maintained by Apple. This is enabled by default, so you don’t need to do anything to use it. If you download malware and try to run it, XProtect can detect it and stop it from running.

Here’s how to check XProtect is getting updates:

1. In System Settings, select General > Software Update.
2. Click the i icon next to Automatic Updates.
3. Make sure Install Security Responses and system files is activated.

Note from our experts: XProtect, although better than nothing, is limited in a few key ways. Apple isn’t a security company, for a start, so XProtect doesn’t detect as many viruses as a dedicated security app, and you don’t get full control over the cleanup. XProtect is a passive solution–you can’t run a scan to check your Mac for malware, so it’s not the best way to clean viruses from your Mac.  

Check for unwanted applications

The Applications folder might not seem like the best place to check for Mac viruses. After all, most malware wants to remain hidden within unwanted apps, and, that’s why, is difficult to access. Still, it’s worth starting to detect a trojan virus on Mac from this folder as it can contain seemingly legitimate apps, which are actually loaded with viruses.

How to check for suspicious apps:

1. Go to the Applications folder.
2. Look for any apps you don’t recognize or don’t remember installing. Check Google to see if they’re legitimate or not. If they’re not, or if you’re suspicious, delete them and empty your trash.

Alternatively, it’s even easier to remove unwanted apps with MacKeeper’s Smart Uninstaller:

1. In MacKeeper, select Smart Uninstaller in the sidebar.
2. Click the Applications option.
3. Select the apps you want to uninstall, then click Remove Selected.

Check the Downloads folder

Whenever you search for malware on Mac, you should check your Downloads folder. If you’ve been tricked into downloading something malicious, there’s a good chance you’ll see it there.

Simply follow these steps to check your Mac’s downloads for malware:

1. Open a new Finder window, and select Downloads from the sidebar.
2. Look through your downloads for anything that you don’t recognize or don’t recall downloading. Right-click it, and select Move to Trash / Move to Bin.
3. Right-click your trash/bin, and select Empty Trash / Empty Bin.

Check suspicious login items

Malware will often load automatically when you start your Mac, and you might check your macOS login items list. Bear in mind, though, many login items like Launch Daemons, and Launchagents won’t actually appear in this list, so you may need to go further to find them and protect your Mac from malware.

Here’s how to check suspicious login items this way:

1. In System Settings, select General > Login Items.
2. Look through the list and select anything you think is suspicious.
3. Click the minus button to remove the login item.

Additionally, you can also manage login items using the MacKeeper app like so:

1. In MacKeeper, select Login Items in the sidebar.
2. Select the items you don’t want to run at startup, then click Remove Select Items.

Check browser extensions

Malicious browser extensions that monitor your online activities and steal your data have become increasingly common. Check your browser for suspicious extensions and delete any you don’t recognize or no longer need to prevent them from causing any harm.

Clear your cache

If your web browser has been infected by Mac malware, you need to ensure you clear its cache once the malware has been dealt with. The cache is where your browser stores files that it may need to use again in the future, and these can often become infected as well.

To clear your cache in Safari, follow these steps:

1. Open Safari, then click Safari > Settings in your Mac’s menu bar.
2. Click the Privacy tab, then select Manage Website Data.
3. Click the Remove All button, then select Remove Now to confirm.

Here’s how to clear your cache in Google Chrome:

1. Open Google Chrome.
2. Click History > Show Full History in your Mac’s menu bar.
3. Select Clear browsing data.
4. Ensure Cached images and files are selected, then click the Clear data button.

Hint from our team: 

 

If you prefer using browsers other than Chrome or Safari, there’s no need to panic. Instead, check our full guide on clearing cache on Mac and find the required instructions.

Check if your email has been compromised

Some malware infections gain access to your email to steal personal data, which attackers can then use to clone your identity and take out phone contracts, credit cards, and other things in your name. Therefore, it’s important to check if your email account is safe.

See if your email has been compromised with MacKeeper’s ID Theft Guard like so:

1. In MacKeeper, select ID Theft Guard in the sidebar.
2. Check your personal data leaks, then click Review.
3. Click Send Code to receive a verification code for safety.
4. Find the code in your email inbox, then paste it into MacKeeper and click Enter.
5. Check all accounts that have been compromised and follow the steps to fix them.

How to scan a Mac for viruses with MacKeeper

Ultimately, trying to find malware on your Mac manually is a losing game. Well-designed viruses don’t make themselves easy to find or remove. Built-in features like XProtect do help, but do Macs need antivirus too? Without a doubt. When it comes down to it, the best way to scan a Mac for viruses is to use a tool like MacKeeper, which is capable of protecting and cleaning your device.

There are two main types of protection you need to use—antivirus scans and real-time protection. Scans can be carried out on demand, searching your entire system or chosen folders for malware, so you can clear a virus from your Mac when you need to. Real-time protection is always on, and if you download or try to run a virus, it kicks in and lets you know.

Here’s how to run a virus scan in MacKeeper:

1. Open MacKeeper, and select Antivirus from the sidebar.
2. If you want to scan certain folders only, click Custom Scan. Otherwise, click Start Scan.
3. When the scan is finished, select any detected malware, and you can either delete it from your Mac or move it to Quarantine.

How to avoid malware on your Mac

Just as important as knowing how to remove Mac malware is knowing how to avoid it so that you don’t pick up more infections in the future. Fortunately, it’s not difficult to maintain a healthy Mac with a few simple steps:

• Avoid suspicious software: macOS will prevent you from opening potentially unsafe software from unregistered developers. Keep these protections enabled to prevent malware from being installed, and only download software from trusted sources.
• Be wary of fake files: Viruses are often hidden inside files that are disguised as innocent downloads, such as PDF documents, Word files, and app packages. Don’t trust files if you can’t be sure of where they came from, and be extra cautious before opening files that have been sent to you through emails. Don’t open files that suddenly appear without warning.
• Look out for fake updates and tools: Some viruses disguise themselves as software updates, system tools, or trusted applications. Only download these things from trusted sources, such as the App Store or an official developer webpage.
• Don’t trust unsolicited support: If you receive a call or message offering Mac support that you didn’t ask for, ignore it. Genuine support companies don’t cold call customers to provide help for no reason, so it’s likely a scammer trying to convince you to download a virus.
• Follow good cyber practices: Take the usual precautions to protect your Mac and your data whenever you use your machine. Avoid untrusted websites, use antivirus software, use strong passwords that you don’t share with others, and be wary of sharing personal data.

What to do if your Mac has a virus

If you’ve carried out the appropriate checks and discovered that your Mac has a virus, you’ll need to deal with it as quickly as possible. In addition to following the above steps, there are other precautions you can take to minimize the damage the virus can do, including:

• Stay offline: Disable the Wi-Fi on your Mac from the Control Panel, or disconnect the Ethernet cable if you use a wired connection. If possible, turn off your router temporarily. This will stop any viruses from communicating with the attackers’ servers and prevent any more of your data from being transmitted to them.
• Avoid logging into any accounts: Avoid logging into any of your accounts, or entering any passwords until you can be sure the virus is removed. If the virus is using a keylogger to record all of your keyboard inputs, this will ensure that it cannot steal any. Also, avoid opening any password managers you use to prevent the virus from taking screenshots of them.
• Change your Mac’s login password: In System Settings > Users & Groups, change all the login passwords for your Mac to ensure the virus cannot access your machine remotely using details it has already stolen.
• Change your iCloud password: If the virus has stolen your iCloud password, it’ll be able to access your saved passwords, photos and videos, messages, and all other data that is uploaded to the cloud. In System Settings > Apple ID > Sign-In & Security, change your iCloud password to prevent others from logging in.
• Cancel debit and credit cards: Call your bank and credit card providers to cancel all the cards you have saved on your Mac. This will prevent attackers from using any payment details they may have stolen.

How to remove malware from Mac

If you ever pick up an infection, then you need to know how to remove malware from your Mac. In extreme cases, that may involve resetting your Mac or restoring from a backup, but often you can get rid of viruses on your Mac by following our pieces of advice:

• Check for suspicious background processes with Activity Monitor.
• Make sure XProtect is enabled.
• Check for unwanted applications.
• Look in your Downloads folder for suspicious files.
• See if you’re running any suspicious login items.
• Run a virus scan with MacKeeper.

Doing so, you’ll keep your Mac clear of malware and protect your data. Using MacKeeper’s Antivirus is particularly important because it includes real-time protection. This way, you can stop viruses from ever taking hold rather than acting only when the horse has already bolted. For more information on keeping your Mac safe, check out our Mac security guide.

FAQ

How do I run a malware scanner on my Mac?

To find hidden malware on your Mac, use the Antivirus utility built into MacKeeper. It trawls through your entire system to weed out malicious applications and then removes them. Also, our tool uses a real-time monitoring feature to ensure that you’re alerted to new threats as soon as they appear.

Does Mac have a built-in malware scan?

Yes, macOS has a built-in tool called XProtect that scans your system for viruses and malware. However, it doesn’t have the ability to perform on-demand scans or scan specific files and folders like a dedicated antivirus tool.

How can I clean my Mac from malware?

You can manually remove malware from your Mac by uninstalling unrecognized apps and deleting suspicious processes. However, it can be difficult to locate hidden malware programs, which is why dedicated tools like MacKeeper’s Antivirus are essential to many users.

Is it possible for a Mac to have malware?

Yes, there are tens of thousands of malware infections built for Mac, and that number only increases as the operating system becomes more popular. Although macOS is regarded as being less susceptible to malware than Windows, it’s certainly not immune, as some Mac users believe.