How to Check If Your Mac Has Malware and Remove It

“Macs don’t get viruses” was never quite true, and it is less true now: adware, browser hijackers, fake cleaners, and credential stealers all target Macs today. The symptoms are usually obvious once you know them — pop-ups that will not stop, a changed homepage, mystery apps, a fan that never rests. This guide shows how to check a Mac for malware using the protections already built into macOS, how to hunt down the common culprits manually, and how to clean up safely.

Quick Answer

First confirm macOS is up to date, since built-in protections (XProtect and Gatekeeper) update with it. Then check your Applications folder for apps you never installed, review login items in System Settings, and inspect Safari/Chrome extensions for strangers. Remove suspicious apps by dragging them to the Trash and emptying it, delete unknown login items and browser extensions, and clear any strange configuration profiles under Privacy & Security. A scan with a reputable free tool such as Malwarebytes confirms nothing is left behind.

Know the Signs of a Mac Infection

Most Mac malware is adware and nuisance software rather than dramatic viruses. Watch for:

• Pop-up ads appearing outside the browser, or constant in-browser ads and redirects.
• Your browser homepage or search engine changed to something you never chose.
• New toolbars, extensions, or “security” apps you do not remember installing — especially anything claiming your Mac is infected and demanding payment.
• The Mac running hot, slow, or with fans roaring during light tasks.
• Apps crashing, or new icons in the Applications folder with generic names.
• Websites warning that your “Flash” or “video player” is out of date — a classic malware delivery trick.

One slow day is not proof of infection (many things slow a Mac down), but several of these together almost always mean unwanted software is installed.

Step 1: Update macOS First

Apple’s built-in defences do heavy lifting silently:

• XProtect scans apps and files against known malware signatures and blocks or removes matches.
• Gatekeeper checks that apps come from identified developers and have not been tampered with.
• System Integrity Protection stops malware from modifying core system files.

All three are only as current as your macOS version. Open System Settings, General, Software Update, and install everything offered. Then restart — updates to the malware definitions themselves arrive silently with system updates.

Step 2: Audit Your Applications Folder

1. Open Finder, then Applications.
2. Sort by Date Added (View menu, Sort By) so the newest apps sit at the top — infections usually arrived recently.
3. Look for names you do not recognise, especially fake utilities: anything like “MacCleaner,” “Advanced Mac Cleaner,” “Search” something, or antivirus brands you never bought.
4. For a suspicious app, quit it first (right-click its Dock icon, Quit — or use Force Quit if it refuses), then drag it to the Trash and empty the Trash.
5. If an app refuses to delete because it is “open,” restart the Mac and delete it before opening anything else.

Removing the app matters because many Mac threats are ordinary (if dishonest) apps installed with your own password during a bundled download — they leave when uninstalled properly.

Step 3: Remove Rogue Login Items and Profiles

Malware survives restarts by registering itself to launch at login:

1. Open System Settings, then General, then Login Items.
2. Review “Open at Login” and the “Allow in the Background” list. Remove anything you cannot identify (select it and click the minus button, or switch its toggle off).
3. Then open Privacy & Security and scroll to Profiles (if present). Configuration profiles can force a hijacked homepage and search engine. Remove any profile you did not knowingly install — a legitimate one usually comes only from an employer or school.

Deleting a rogue profile is often the single step that finally lets you change your browser’s homepage back.

Step 4: Clean Your Browsers

1. In Safari: Settings, then Extensions — uninstall every extension you did not deliberately add. Then Settings, General: reset the homepage to your choice, and Search: reset the search engine.
2. In Chrome (if installed): the puzzle-piece menu, Manage Extensions — remove strangers. Then Settings, Reset settings, restores defaults and disables remaining extensions in one pass.
3. Clear website data if redirects persist: Safari Settings, Privacy, Manage Website Data, Remove All.

If the pop-ups are the main symptom, our dedicated guide on stopping pop-up ads and redirects in Mac Safari goes deeper on browser-specific cleanup.

Step 5: Run a Reputable Scanner

Manual cleanup plus one trusted scan is the belt-and-braces finish:

• Download Malwarebytes for Mac (the free version detects and removes adware and malware) — only from the company’s official website, never from download portals or ads.
• Install it, run a scan, and quarantine everything it flags.
• Restart the Mac, run one more quick scan to confirm a clean result, then uninstall the scanner if you do not want to keep it.

Beware of tools that advertise through pop-ups themselves — software that finds you via a scare message is usually the disease, not the cure. Apple’s guide to protecting a Mac from malware on Apple Support sets out the built-in protections and safe-download habits officially.

How Macs Get Infected (So It Does Not Happen Again)

• Fake updates: pop-ups insisting Flash, a codec, or your browser must be updated from that page. Real updates come from System Settings or the app itself.
• Bundled installers: free apps from download sites that quietly include “offers.” Use the App Store or the developer’s own site, and read installer screens before clicking Continue.
• Typing your password when you should not: a random installer asking for admin rights to play a video or open a document is a red flag — cancel it.
• Pirated software: cracked apps are the single most reliable malware delivery channel for Macs. Avoid them entirely.

Common Mistakes and Helpful Tips

• Paying the “support” number on a pop-up. A locked browser page claiming to be Apple or Microsoft is a scam. Force-quit the browser (Command + Option + Esc), then reopen it while holding Shift so the bad page does not reload.
• Deleting the app but leaving its helpers. Check Login Items and browser extensions too — leftover launch agents are how adware resurrects itself.
• Installing two “cleaners” to fight one infection. Aggressive cleaner apps often cause the very slowness people blame on malware. One reputable scanner, used briefly, is enough.
• Skipping the backup. Before major cleanup, run a Time Machine backup so any over-zealous deletion is reversible.

Conclusion

Checking a Mac for malware is a methodical sweep, not a panic: update macOS so XProtect is current, audit recent apps, clear rogue login items and profiles, strip unknown browser extensions, and confirm the result with one reputable scanner. Follow that order and the pop-ups, hijackers, and mystery apps that plague Macs are almost always gone for good — especially once you stop letting them in through fake updates and bundled installers.

Frequently Asked Questions

Do Macs really get malware, or is this overblown?

They do — mostly adware, browser hijackers, and info-stealers rather than classic self-spreading viruses. It is less common than on Windows, but “it can’t happen” is a myth that leaves Mac owners careless about installers and pop-ups.

Does macOS have a built-in antivirus I can run manually?

XProtect works automatically in the background; there is no Apple antivirus app to open and scan with. For an on-demand scan, a reputable third-party tool such as Malwarebytes fills that gap.

My browser says “Your Mac is infected, call this number.” Is it real?

No. It is a scare page. Never call the number or install what it offers. Force-quit the browser and reopen with Shift held so the tab does not reload, then run through the cleanup steps in this guide.

I removed the bad app, but my homepage is still hijacked. Why?

Usually a configuration profile or a leftover browser extension is enforcing the setting. Check Privacy & Security for Profiles and remove unknown ones, then reset the homepage again.

Will reinstalling macOS remove malware?

Yes, a clean erase and reinstall removes everything — but it is the last resort, wiping your data too. Manual cleanup plus a scanner removes the vast majority of Mac threats without that disruption.