Many Mac users may have come across a small window that appears on top of their browser when surfing the Web that warns them, ‘System Scan is Recommended’. So, what is this message, and what should you do if you see it?
TL;DR: Don’t panic
The first thing to learn is that this is not a Mac system message. If you ever come across this message you can be utterly certain that it is a scam. Whoever is behind the message (and it may not be the website owner, but some poorly policed ads network) wants you to agree to something that will probably cost you money, leave your data at risk, or otherwise cause you unwanted problems. While scams like these are nowhere near as widespread on Macs as they are on other platforms, they do appear sometimes.
Browser pop-up scams
These browser pop-up scams attempt to frighten you into paying money, providing personal information, or calling premium rate phone numbers that will cost you a bomb.
[Also read: Lock it down: The macOS security guide (updated)]
Other common messages that sometimes appear when Macs are infected with malware or adware include warnings that the government has seized your computer and you must pay to have it released, or that your computer has been infected, and you need to call a tech support number to resolve the problem.
What should you do?
Do not click the box to engage in any further action.
- Don’t download anything that may be recommended within the box.
- Get rid of the message by quitting your browser.
- You may need to force quit the browser (as these pop-ups do try to disable some options). If Quit is greyed out, just use Command-Option-Esc, or Force Quit from the menu bar.
- Now hold down the Shift key while you relaunch the browser. This will prevent all the windows you had open during the last session reopening (including the window causing you these problems.)
- To be on the safe side, it makes sense to download and install the free (and reputable) Malwarebytes or DetectX malware scanners.
- Once installed, update the software to the latest version and malware definitions, and run the app to check your Mac for potential malware.
- You’ll probably be safe, but do follow any instructions if an infection is found.
- Take a note of the website you were on when you experienced the fraudulaent ‘System Scan is Recommended’ message. If it is a small site you’ve never come across before, try never to visit it again. If, however, it is a reputable destination, you may want to write to the webmaster to let them know the problem occurred.
In some cases, you may have picked up a dodgy Safari Extension that is causing these warnings to appear. To check this, open Safari>Preferences>Extensions and check the extensions you may (or may not) have listed there. Delete any you do not recognise or no longer use.
What about MacKeeper?
Some Mac users may have installed MacKeeper, a virulent piece of software that promises to cure all your Mac woes, but which instead just makes things much worse. If you have installed it the software may sometimes give you pop-ups like these all over your system.
How to get rid of MacKeeper
You probably can’t quit MacKeeper when it is open. Here’show to fix that (c/o Macworld):
- Open MacKeeper Preferences, and in the General tab uncheck the Show MacKeeper icon in menu bar instruction.
- Now you should be able to quit MacKeeper. You do not need to sign anything or accept any services.
- Find MacKeeper in the Applications folder and drag it to Trash
- An Uninstaller will appear. Don’t bother adding reasons, just tap Uninstall MacKeeper.
You should also check Safari extensions (as described above) and search for and remove any MacKeeper-related cache or cookie items from inside Safari’s Privacy pane (choose Manage Website Data and search for Mackeeper in the search box item there).
I did say MacKeeper was a bit of a scourge, and I meant it.
That’s why as your final flourish you should download, install and run Malwarebytes. It should identify any remaining MacKeeper-related items as well as any malware that might have crept inside your Mac. Find them and get rid of them with this app.
One final thing: Now would be a good time to open Safari’s Security preferences and check the ‘Block Pop-up’ windows item is checked to on.
Google+? If you use social media and happen to be a Google+ user, why not join AppleHolic’s Kool Aid Corner community and get involved with the conversation as we pursue the spirit of the New Model Apple?
Got a story? Please drop me a line via Twitter and let me know. I’d like it if you chose to follow me there so I can let you know about new articles I publish and reports I find.