Menda
macOS · Mac · Security & backups
Think your Mac has malware? What to check
macOS checks for known malware by itself, so the useful work is making sure that protection is current and then looking in the four places unwanted software settles.
- DifficultyMedium
- Time20 min
- RiskMedium
- ReversibleYes
- PlatformmacOS
- Updated
What that means
Medium risk. This fix changes system settings, services, drivers, startup items or security features — reversible, but taking it back takes some effort or knowledge, and it may temporarily affect stability. This change is reversible — you can return to the previous state without professional help or data loss.
Steps
-
Update macOS, then restart
Why?
Apple updates the Mac's malware definitions automatically, separately from full macOS updates, and checks for them daily. When the built-in scanner finds known malware it blocks it, moves it to the Trash and tells you in the Finder. Staying up to date is what keeps that working.
Also see: Keep macOS updated the safe way
-
Check where apps are allowed to come from
Why?
Apple calls App Store only 'the most secure setting'. Either choice means macOS checks an app before it opens for the first time.
Also see: Open apps blocked by Gatekeeper
-
Look at Login Items & Extensions
Sequoia or later
Ventura / Sonoma
Careful: Search for a name before you remove it. Printers, backup tools and password managers all keep helpers here, and removing one stops that app working properly.
Also see: Stop apps from launching at login
-
Check for configuration profiles
Careful: On a Mac from an employer or a school, a profile is meant to be there. Ask them before touching it.
Also see: Pop-ups and hijacked search on your Mac: remove the adware
-
Check your browser extensions
How to verify the fix
macOS is up to date, Login Items & Extensions lists only things you recognise, no configuration profile is installed that you did not add, and each browser's extension list holds only extensions you chose.
If this didn't fix it
Get professional help if something you removed comes back after a restart, if the Mac still behaves oddly after every check here, or if a stranger had remote access to it. Contact Apple Support, an Apple Store or an Apple Authorised Service Provider. When nothing else settles it, erasing the Mac and reinstalling macOS, then restoring your files from a backup made before the trouble started, is the safest answer. The 'Erase and reinstall macOS' fix has the steps.
Next stop: the related fixes below, or start a guided diagnosis.