Apple Platform Security pop-up SCAM (Virus removal guide)

What is Apple Platform Security SCAM?

Apple Platform Security refers to a group of “technical support” scams. The goal of this group of scams is to trick unsuspecting victims into believing that their computer is infected with a Trojan (Spyware, Malware, Computer Virus) and calling the provided number. Most often, victims are encouraged to pay for unnecessary services and software, or even provide remote access to their computer.

Apple Platform Security pop-ups can invade computers when users land on deceptive websites — by following a link from a spam email, or mistyping a URL. They might be served to users via Adware, PUAs (potenially unwanted apps) users can unwittingly install if they download free or pirated versions of apps.

QUICK LINKS

• What is Apple Platform Security SCAM?
• Removal
• Protection

Like most “technical support” scams aimed at MAC users, this particular scam looks similar to the Apple website. The scam site performs fake computer scans, displays various pop-ups and warnings stating that the computer is infected with a Trojan Spyware Virus and some data such as Email Credential, Banking Passwords, Facebook Logins, Pictures and Documents have been compromised.

This scam informs that users must contact technical support engineers who can help remove the detected threats. To do this, users need to immediately call +1-(888)-521-2492.

In most cases, the scammers behind this scam try to trick users into buying help in removing viruses or installing a remote control tool, which they pretend to be a tool to diagnose a computer. It is important to understand that having access to a computer, scammers can steal private information and personal files, install malware (spyware, ransomware or Trojan horses), make fraudulent purchases, as well as for other malicious purposes.

Text presented on this scam:

Apple Platform Security

** ACCESS TO THIS PC HAS BEEN BLOCKED FOR SECURITY REASONS **

Your computer has alerted us that it has been infected with a Trojan Spyware. The following data has been compromised.

> Email Credential
> Banking Passwords
> Facebook Login
> Pictures & Documents

Apple Platform Security has found potentially unwanted Adware on this device that can steal your passwords, online identity, financial information, personal files, pictures or documents.

You must contact us immediately so that our engineers can walk you through the removal process over the phone.

Call Apple Support immediately to report this threat, prevent identity theft and unlock access to this device.

Closing this window will put your personal information at risk and lead to a suspension of your Mac Registration.

Call Apple Support: +1-888-521-2492 (Toll Free)

Trojan Spyware Alert – Error Code #691a8pma7a63yc10

Don’t Allow Allow

Of course, the Apple Platform Security pop-up alert is a fake, since there are no sites that can determine that a computer has been compromised. The purpose of this scam is to make users believe that the computer is infected, and thereby force them to call the +1-(888)-521-2492 number to get technical support. In any case, scam sites cannot be trusted, their threats must be ignored and never called the specified numbers.

Another variant of “Apple Platform Security” pop-up scam:

Text presented within:

Trojan Spyware Alert – Error Code: #0x898778
Access to this PC has been blocked for security reasons.
Contact Mac Support – +1-888-705-0926
Threat Detected – Trojan Spyware
App: Ads.financetrack(1).exe

As mentioned above, the Apple Platform Security pop-ups are caused by Adware, malvertising (malicious advertisements), followed by software downloads and redirects. Adware is a term that originates from ‘ad supported’ software. In most cases, ‘adware’ is considered by many to be synonymous with ‘malicious software’. Its purpose is to earn profit for its owner by serving unwanted advertisements to a user while the user is browsing the Web. Some of these advertisements are scams or fake advertisements designed to trick users. Even harmless ads can become really irritating. In many cases, adware do not have any uninstall procedures and can use technologies that are similar to those used by trojans to penetrate MAC computers

Threat Summary

Name	Apple Platform Security
Type	tech support scam, phishing, fake alerts
Fake claims	Trojan Spyware Alert – Error Code #691a8pma7a63yc10, Trojan Spyware Alert – Error Code: #0x898778
Scammer Phone Numbers	+1-888-521-2492, +1-888-705-0926, +1-888-308-5141, +1-888-523-6758
Distribution	Free software installers, torrent downloads, fake update tools and dubious pop up advertisements
Symptoms	Every time you perform an Internet search, your web-browser is redirected to another web page, unwanted advertising links appear on web-pages that you are visiting, there is an unexpected application in the ‘Applications’ section of the Finder, unexpected internet browser extensions or toolbars keep coming back, unexpected changes in your internet browser like using a new default search provider, fast Internet but slow browsing speeds.
Removal	Apple Platform Security removal guide

 

Apple Platform Security is not the only scam on the Internet aimed at tricking Mac and Windows users. We have reported similar scams many times, some of the most recent: Trojan Spyware Alert, Your MAC might be at risk, Firewall Spyware Alert, McAfee Tollfree. Some of these scams are positioned as a legitimate Apple or Microsoft website, but in fact have nothing to do with Apple and Microsoft. The “technical support scam” sites should never be trusted, they should be closed as soon as they appear on the screen. Scammers can use some tricks to block the closing of the scam sites, in which case these sites can be closed using the Task Manager or by restarting the computer.

How does Adware get on your MAC

Usually, adware software gets into MAC computers as part of a bundle with free software, sharing files and other unsafe software which users downloaded from the Internet. The adware creators pays freeware authors for distributing adware within their software. So, optional software is often included as part of the installer. In order to avoid the installation of any adware software: choose only Manual, Custom or Advanced installation option and reject all third-party software in which you are unsure.

How to remove Apple Platform Security scam

Not all unwanted apps such as the adware related to the Apple Platform Security pop-ups are easily uninstallable. You might see fake alerts, pop-ups, deals, text links, in-text advertisements, banners and other type of ads in Chrome, Firefox and Safari and might not be able to figure out the application responsible for this activity. The reason for this is that many malicious apps neither appear in the Finder. Therefore in order to completely get rid of Apple Platform Security popup scam, you need to perform the following steps. Read it once, after doing so, please bookmark this page (or open it on your smartphone) as you may need to exit your browser or restart your machine.

To remove Apple Platform Security, use the following steps:

1. Remove profiles created by Adware
2. Check the list of installed apps
3. Remove Adware related files and folders
4. Scan your Mac with MalwareBytes
5. Remove Apple Platform Security from Safari, Chrome, Firefox
6. How to stop Apple Platform Security popup scam

Remove profiles created by Apple Platform Security

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac computer. If there is Profiles in the list, then click on it, then select a profile related to the adware.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed apps

Some browser hijackers, adware and PUPs can be removed by uninstalling the free programs they came with. If this way does not succeed, then looking them up in the list of installed software in the Finder. Use the “Move to Trash” command in order to remove them.

1. Open the Finder.
2. Click “Applications”.
3. It will show a list of all programs installed on the Apple Mac.
4. Scroll through the all list, and uninstall questionable and unknown software. Pay maximum attention to the program you installed last.
5. Drag the suspicious application from the Applications folder to the Trash.
6. Empty Trash.

Remove Adware related files and folders

Now you need to try to find Adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Some files created by Adware are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adwarey generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, search.plist, installapp.plist, com.google.defaultsearch.plist, , macsearch.plist, and com.net-preferences.plist. Most often, browser hijackers, potentially unwanted programs and adware create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.machelper.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.machelper.system.plist, com.installapp.system.plist, com.macsearch.system.plist and com.search.system.plist. In most cases, adware, PUPs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes to scan the Mac device for adware, browser hijackers and potentially unwanted programs. This free tool is an advanced malware removal program developed by (c) Malwarebytes lab. This program uses the world’s most popular anti malware technology. It is able to help you remove malicious software and other security threats from your Mac computer for free.

Download MalwareBytes Free on your machine by clicking on the link below.

Once the download is finished, close all software and windows on your MAC. Run the saved file. Follow the prompts.

The MalwareBytes Free will automatically start and you can see its main screen like below.

Now press the “Scan” button to perform a system scan with this utility for the adware related to the Apple Platform Security pop ups. This task can take quite a while, so please be patient. While the MalwareBytes program is checking, you may see count of objects it has identified as threat.

Once the system scan is complete, you will be shown the list of all detected threats on your machine. All found threats will be marked. You can remove them all by simply press the “Quarantine” button. The MalwareBytes Anti Malware (MBAM) will remove adware that causes multiple unwanted pop ups and move the selected items to the Quarantine.

Remove Apple Platform Security from Safari, Chrome, Firefox

If you are still seeing Apple Platform Security pop-up scam that won’t go away, you might have harmful addons installed on your web browser. Check your web browser for unwanted plugins using the steps below.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Google Chrome menu. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove Apple Platform Security scam by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with Apple Platform Security scam removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop Apple Platform Security popup scam

Enabling an ad-blocker application such as AdGuard is an effective way to alleviate the risks. Additionally, ad blocking applications will also protect you from malicious advertisements and websites, and, of course, stop redirection chain to the Apple Platform Security scam and similar web sites.

Installing the AdGuard is simple. First you’ll need to download AdGuard on your MAC from the following link.

After the downloading process is complete, run the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you start your MAC system, AdGuard will launch automatically and stop unwanted popup advertisements, block Apple Platform Security scam, as well as other harmful or misleading web sites.

To sum up

Now your MAC system should be clean of the adware responsible for the Apple Platform Security scam. We suggest that you keep MalwareBytes Anti-Malware (to periodically scan your MAC for new adware and other malware) and AdGuard (to help you block intrusive pop-ups and malicious webpages). Moreover, to prevent any adware, please stay clear of unknown and third party apps.

If you need more help with Apple Platform Security related issues, go to here.