YOUR APPLE COMPUTER HAS BEEN LOCKED POP-UP SCAM (Virus removal guide)

What is YOUR APPLE COMPUTER HAS BEEN LOCKED SCAM?

YOUR APPLE COMPUTER HAS BEEN LOCKED is a technical support scam. Technical support scam is a type of fraud that uses email, websites, fake security alerts and system scan results to lure victims into calling a fraudulent phone number or visiting phishing websites. Scammers try to trick people by claiming to be a professional organization (Apple, Microsoft, etc) – a technical service which helps people fix their computers. According to the FTC, technical support scams can appear as online ads, phishing pages, and pop-up messages.

In this particular case, scammers are posing as tech support specialists from Apple. They are attempting to gain control of the computer and with that, they can steal user IDs and passwords, delete or change data, infect the computer with malware, and much more nastiness.

QUICK LINKS

• What is YOUR APPLE COMPUTER HAS BEEN LOCKED SCAM?
• How to Spot Scams That Mimic the Apple Security Warning?
• Protection
• Removal
• Report a Scam

YOUR APPLE COMPUTER HAS BEEN LOCKED Scam in detail

The scam is presented as legitimate – the attackers have gone as far as to create a fake Apple Security Warning in order to add further legitimacy to the scam. It states that the computer is infected and personal data (credit card details, e-mail passwords, private & family photos, etc.) have been stolen. This warning urges users to contact Apple Support to get help from a technical troubleshooter over the phone.

Text presented in the fake Apple Support Warning (“YOUR APPLE COMPUTER HAS BEEN LOCKED” pop-up):

*YOUR APPLE COMPUTER HAS BEEN LOCKED*

Your Computer is infected with an adware or malware causing you to see this popup.

This may happen due to obsolete virus protections.

To fix, please call Apple Support at 1-877-271-8604 immediately. Please ensure you do not restart your computer to prevent data loss.

Possibility of Data & Identity theft, if not fixed immediately.

YOUR APPLE COMPUTER HAS BEEN BLOCKED*

YOUR APPLE COMPUTER HAS BEEN LOCKED !!

System has been infected due to unexpected error!
Please Contact Apple 1-877-271-8604 Immediately!
to unblock your computer.
Suspicious Activity Detected. Your Browser might have been hijacked or hacked.

ANONYMOUS ACTIVITY

Private and Financial Data is at RISK:
. Your credit card details and banking information
. Your e-mail passwords and other account passwords
. Your Facebook, Skype, AIM, ICQ and other chat logs
. Your private & family photos and other sensitive files
. Your webcam could be accessed remotely by stalkers

IMMEDIATELY CALL APPLE SUPPORT AT 1-877-271-8604

MORE ABOUT THIS INFECTION:
Seeing these pop-up’s means that you may have a virus installed on your computer which puts the security of your personal data at a serious risk.
It’s strongly advised that you call the number above and get your computer inspected before you continue using your internet, especially for Shopping or Banking.
Call immediately for assistance.

Contact Apple Support At (1-877-271-8604)

To unblock the computer, the scam encourages users to call the specified number. The scammers are trying to trick users into purchasing fake support services or installing a remote control tool, which they pretend to be a program to diagnose a computer. It is important to understand that having access to a computer, scammers can steal private information and personal files, install malware (spyware, ransomware or Trojan horses).

Technical support scams can be used to gain bank account details, or passwords to personal accounts such as social media and email. The collected data can be used to make unauthorized transfers and fraudulent purchases. Moreover, the criminals can use stolen email addresses and phone numbers to send spam and malspam (spam emails containing malware or links to malware).

In summary, “YOUR APPLE COMPUTER HAS BEEN LOCKED” pop-up is a Scam. The scam can lead to malware infection, loss of personal data, disclosure of confidential information, financial losses and other serious problems.

How to Spot Scams That Mimic the Apple Security Warning?

There are always a few details that can give away a scam. Make sure you know what to look out for.

• If something raises suspicion, it’s better not to click on any links and buttons. Fake Apple Security alerts have malicious intentions, and you should avoid clicking them at any cost. Scammers use them to trick you into installing malware or harvest your personal information.
• The most obvious way how to spot a fake Security Warning is finding inconsistencies in domain names. If the alert claims to be from Apple, but but the warning contains a domain other than apple.com, it’s probably a scam.
• Copy the Apple Security Warning and search the Internet to see what others say about it.
• If you have the slightest suspicion an alert may be a scam, do not click on the links you see.
• If a pop-up (security warning) claims that you have a virus and you need to call to get support, it’s definitely a scam. Be suspicious of alerts that claim you must call or click a link immediately.

Threat Summary

Name	YOUR APPLE COMPUTER HAS BEEN LOCKED
Type	technical support scam, phishing, fake alerts
Fake claims	Your Computer is infected with an adware or malware causing you to see this popup, System has been infected due to unexpected error, Suspicious Activity Detected, Your Browser might have been hijacked or hacked, Private and Financial Data is at RISK
Scammer’s Phone Numbers	1 800 950-472, 1 844 899-4845, 1 877 271-8604, 1 866 217-1442
Symptoms	fake system messages, fake Apple Security warnings, pop-up errors, fake Apple Defender scan
Distribution	fake alerts within visited websites, push notifications, social engineering attack, rogue ad networks, potentially unwanted apps, dubious advertisements, adware
Damage	serious privacy issues, identity theft, financial losses, additional malware infections
Removal	YOUR APPLE COMPUTER HAS BEEN LOCKED removal guide

Examples of such scams

YOUR APPLE COMPUTER HAS BEEN LOCKED is not the only scam to be aware of. We have reported similar scams many times, some of the most recent: Apple Defender Security Center, Apple Platform Security, Trojan Spyware Alert, Your MAC might be at risk, Firewall Spyware Alert. Some of these scams are positioned as a legitimate Apple or Microsoft website, but in fact have nothing to do with Apple and Microsoft.

Where Did the YOUR APPLE COMPUTER HAS BEEN LOCKED Pop-Ups Come From

As mentioned above, the YOUR APPLE COMPUTER HAS BEEN LOCKED pop-ups are caused by aggressive push notifications, software downloads, malicious redirects, shady websites, misleading advertisements, potentially unwanted programs (PUPs) and Adware. Adware is considered by many to be synonymous with ‘malicious software’. It is a harmful app which displays unwanted advertisements to computer users. Some examples include pop up advertisements, push notifications, fake alerts or unclosable windows. Adware can seriously affect your privacy, your computer’s performance and security.

Here are some examples of the scam notifications (fake alerts, messages from fake dating sites):

Adware usually comes on Apple computers with free apps. In many cases, it comes without the user’s knowledge. Therefore, many users aren’t even aware that their Mac has been affected with PUAs and adware software. Please follow the easy rules in order to protect your MAC from adware and potentially unwanted applications: don’t install any suspicious apps, read the user agreement and select only the Custom, Manual or Advanced installation mode. Also, always try to find a review of the installed application on the Internet. Be careful and attentive!

How to protect against “YOUR APPLE COMPUTER HAS BEEN LOCKED” scam

To avoid becoming a victim of scammers, it is important to always keep in mind:

• There are no websites that can detect security problems.
• Apple Security pop-up warnings will never ask you to call a phone number.
• Apple tech support will never ask you to pay for support with gift cards or cryptocurrency.
• Never install software promoted by scam sites, as it can be useless, and besides, it can be dangerous for you and your computer.
• Close “YOUR APPLE COMPUTER HAS BEEN LOCKED” as soon as it appears on your computer screen. Scammers can prevent you from closing it in various ways. In such cases, close your browser using Activity Monitor or restart your Mac. If the next time you launch the browser, it prompts you to restore the previous session, abandon it, otherwise this scam will reopen on your screen.
• Use an ad blocker when browsing the internet. It can block known scam sites and protect you from scammers.
• If you think your computer has a virus, install trusted antivirus software, or update your computer’s security software and run a system scan.

How to remove YOUR APPLE COMPUTER HAS BEEN LOCKED pop-ups (Adware removal guidance)

Fortunately, we have an effective method to help you manually and/or automatically get rid of YOUR APPLE COMPUTER HAS BEEN LOCKED pop-ups and restore your Mac/browser settings to normal. Below you will find a removal guide with all the steps you may need to successfully remove adware and its traces. Some of the steps below may require you to close this page. So please read the steps carefully and then bookmark them or open them on your smartphone for future reference.

Remove profiles created by Adware

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac computer. If there is Profiles in the list, then click on it, then select a profile related to the adware.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed apps

Some browser hijackers, adware and PUAs can be removed by uninstalling the free programs they came with. If this way does not succeed, then looking them up in the list of installed software in the Finder. Use the “Move to Trash” command in order to remove them.

1. Open the Finder.
2. Click “Applications”.
3. It will show a list of all programs installed on the Apple Mac.
4. Scroll through the all list, and uninstall questionable and unknown software. Pay maximum attention to the program you installed last.
5. Drag the suspicious application from the Applications folder to the Trash.
6. Empty Trash.

Remove Adware related files and folders

Now you need to try to find Adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Some files created by Adware are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adwarey generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, search.plist, installapp.plist, com.google.defaultsearch.plist, , macsearch.plist, and com.net-preferences.plist. Most often, browser hijackers, potentially unwanted programs and adware create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.machelper.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.machelper.system.plist, com.installapp.system.plist, com.macsearch.system.plist and com.search.system.plist. In most cases, adware, PUPs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes to scan your Mac computer for adware, browser hijackers and potentially unwanted apps. This remover is an advanced malware removal tool developed by (c) Malwarebytes lab. It uses the world’s most popular antimalware technology. MalwareBytes is able to help you remove malicious software and other security threats from your Mac computer for free.

Download MalwareBytes Free on your machine by clicking on the link below.

Once the download is finished, close all software and windows on your MAC. Run the saved file. Follow the prompts.

MalwareBytes will automatically start and you can see its main screen like below.

Now press the “Scan” button to perform a system scan with this utility for the adware related to the YOUR APPLE COMPUTER HAS BEEN LOCKED pop ups. This task can take quite a while, so please be patient. While the MalwareBytes program is checking, you may see count of objects it has identified as threat.

Once the system scan is complete, you will be shown the list of all detected threats on your Mac. All found threats will be marked. You can remove them all by simply press the “Quarantine” button. The MalwareBytes Anti Malware will move the selected threats to the Quarantine.

Remove YOUR APPLE COMPUTER HAS BEEN LOCKED from Safari, Chrome, Firefox

If you are still seeing YOUR APPLE COMPUTER HAS BEEN LOCKED pop-ups that won’t go away, you might have harmful addons installed on your web browser. Check your web browser for unwanted plugins using the steps below.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Google Chrome menu. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove YOUR APPLE COMPUTER HAS BEEN LOCKED pop-ups by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with YOUR APPLE COMPUTER HAS BEEN LOCKED removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop YOUR APPLE COMPUTER HAS BEEN LOCKED pop-ups

Enabling an ad-blocker application such as AdGuard is an effective way to alleviate the risks. Additionally, ad blocking applications will also protect you from malicious advertisements and websites, and, of course, stop redirection chain to the YOUR APPLE COMPUTER HAS BEEN LOCKED scam and similar websites.

Installing the AdGuard is simple. First you’ll need to download AdGuard on your MAC from the following link.

After the downloading process is complete, run the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you start your MAC, AdGuard will launch automatically and stop unwanted popup advertisements, block YOUR APPLE COMPUTER HAS BEEN LOCKED scam, as well as other harmful or misleading web sites.

Report a Scam

If you encounter a scam that is similar but not the same as the example above, please post it as a comment on this article. This helps us to warn users about current scams, monitor trends and disrupt scams where possible.