Access To This MAC Has Been Blocked POP-UP SCAM (Virus removal guide)

What is Access To This MAC Has Been Blocked SCAM?

Access To This MAC Has Been Blocked is a technical support scam. Technical support scam is a type of fraud that uses email, websites, fake security alerts and system scan results to lure victims into calling a fraudulent phone number or visiting phishing websites. Scammers try to trick people by claiming to be a professional organization (Apple, Microsoft, etc) – a technical service which helps people fix their computers. According to the FTC, technical support scams can appear as online ads, phishing pages, and pop-up messages.

In this particular case, scammers are posing as tech support specialists from Apple. They are attempting to gain control of the computer and with that, they can steal user IDs and passwords, delete or change data, infect the computer with malware, and much more nastiness.

Here’s an example of a technical support scam disguised as Apple System Security:

QUICK LINKS

• What is Access To This MAC Has Been Blocked SCAM?
• How to Spot Scams That Mimic the Apple Security Warning?
• Protection
• Removal
• Report a Scam

Access To This MAC Has Been Blocked Scam in detail

The scam is presented as legitimate – the attackers have gone as far as to create a fake Apple System Security Warning in order to add further legitimacy to the scam. It states that the Mac is infected with a Trojan-Spyware and personal data (email credentials, banking passwords, facebook login, pictures & documents etc.) has been compromised. This warning urges users to contact Mac Support to get help from a technical troubleshooter over the phone.

Text presented in the fake “macOS Security” warning (“Access to this MAC has been blocked for security reasons” pop-up):

macOS Security
Access to this MAC has been blocked for security reasons.
Contact Mac Support: 808-400-0297 (USA Toll Free)
Threat Detected: Trojan Spyware.
App: Ads.financetrack(1).exe
Run Anyway

** ACCESS TO THIS MAC BEEN BLOCKED FOR SECURITY REASONS **
Your computer has alerted us that it has been infected with a Trojan Spyware. The following data has been compromised.
Email Credentials
Banking Passwords
Facebook Login
Pictures & Documents

Apple Platform Security has found potentially unwanted Adware on this device that can steal your passwords, online identity, financial information, personal files, pictures or documents.
You must contact us immediately so that our engineers can walk you through the removal process over the phone.
Call Mac Support immediately to report this threat, prevent identity theft and unlock access to this device.
Closing this window will put your personal information at risk and lead to a suspension of your Mac Registration.

To unlock access to the computer, the scam encourages users to call the specified number. The scammers are trying to trick users into purchasing fake support services or installing a remote control tool, which they pretend to be a program to diagnose a computer. It is important to understand that having access to a computer, scammers can steal private information and personal files, install malware (spyware, ransomware or Trojan horses).

Technical support scams can be used to gain bank account details, or passwords to personal accounts such as social media and email. The collected data can be used to make unauthorized transfers and fraudulent purchases. Moreover, the criminals can use stolen email addresses and phone numbers to send spam and malspam (spam emails containing malware or links to malware).

In summary, “Access To This MAC Has Been Blocked” pop-up is a Scam. The scam can lead to malware infection, loss of personal data, disclosure of confidential information, financial losses and other serious problems.

How to Spot Scams That Mimic the Apple Security Warning?

There are always a few details that can give away a scam. Make sure you know what to look out for.

• If something raises suspicion, it’s better not to click on any links and buttons. Fake Apple Security alerts have malicious intentions, and you should avoid clicking them at any cost. Scammers use them to trick you into installing malware or harvest your personal information.
• The most obvious way how to spot a fake Security Warning is finding inconsistencies in domain names. If the alert claims to be from Apple, but but the warning contains a domain other than apple.com, it’s probably a scam.
• Copy the Apple Security Warning and search the Internet to see what others say about it.
• If you have the slightest suspicion an alert may be a scam, do not click on the links you see.
• If a pop-up (security warning) claims that you have a virus and you need to call to get support, it’s definitely a scam. Be suspicious of alerts that claim you must call or click a link immediately.

Threat Summary

Name	Access To This MAC Has Been Blocked
Type	technical support scam, phishing, fake alerts
Fake claims	Your computer has alerted us that it has been infected with a Trojan Spyware; Apple Platform Security has found potentially unwanted Adware on this device; Call Mac Support immediately to report this threat and unlock access to this device; Closing this window will put your personal information at risk.
Scammer’s Phone Numbers	808-400-0297
Symptoms	fake system messages, fake Apple Security warnings, pop-up errors, fake Apple Defender scan
Related phishing sites	careonline.w3spaces.com, productive-reasonably-helped.w3spaces.com, youthful-honorable-harmony.w3spaces.com, err998mac.w3spaces.com, securityservicesmac.w3spaces.com, apple-errors-pro.w3spaces.com, official-usa-supports.w3spaces.com, appleerror2100.w3spaces.com
Distribution	fake alerts within visited websites, push notifications, social engineering attack, rogue ad networks, potentially unwanted apps, dubious advertisements, adware
Damage	serious privacy issues, identity theft, financial losses, additional malware infections
Removal	Access To This MAC Has Been Blocked removal guide

Examples of such scams

Access To This MAC Has Been Blocked is not the only scam to be aware of. We have reported similar scams many times, some of the most recent: Apple Platform Security, Apple Defender Security Center, Trojan Spyware Alert, Your MAC might be at risk, Firewall Spyware Alert. Some of these scams are positioned as a legitimate Apple or Microsoft website, but in fact have nothing to do with Apple and Microsoft.

Where Did the Access To This MAC Has Been Blocked Pop-Ups Come From

As mentioned above, the Access To This MAC Has Been Blocked pop-ups are caused by aggressive push notifications, software downloads, malicious redirects, shady websites, misleading advertisements, potentially unwanted programs (PUPs) and Adware. Adware is considered by many to be synonymous with ‘malicious software’. It is a harmful app which displays unwanted advertisements to computer users. Some examples include pop up advertisements, push notifications, fake alerts or unclosable windows. Adware can seriously affect your privacy, your computer’s performance and security.

Here are some examples of the scam notifications (fake alerts, messages from fake dating sites):

Adware usually comes on Apple computers with free apps. In many cases, it comes without the user’s knowledge. Therefore, many users aren’t even aware that their Mac has been affected with PUAs and adware software. Please follow the easy rules in order to protect your MAC from adware and potentially unwanted applications: don’t install any suspicious apps, read the user agreement and select only the Custom, Manual or Advanced installation mode. Also, always try to find a review of the installed application on the Internet. Be careful and attentive!

How to protect against “Access To This MAC Has Been Blocked” scam

To avoid becoming a victim of scammers, it is important to always keep in mind:

• There are no websites that can detect security problems.
• Apple Security will never ask you to call a phone number.
• Apple tech support will never ask you to pay for support with gift cards or cryptocurrency.
• Never install software promoted by scam sites, as it can be useless, and besides, it can be dangerous for you and your computer.
• Close “Access To This MAC Has Been Blocked” as soon as it appears on your computer screen. Scammers can prevent you from closing it in various ways. In such cases, close your browser using Activity Monitor or restart your Mac. If the next time you launch the browser, it prompts you to restore the previous session, abandon it, otherwise this scam will reopen on your screen.
• Use an ad blocker when browsing the internet. It can block known scam sites and protect you from scammers.
• If you think your computer has a virus, install trusted antivirus software, or update your computer’s security software and run a system scan.

How to remove Access To This MAC Has Been Blocked pop-ups (Adware removal guidance)

Fortunately, we have an effective method to help you manually and/or automatically get rid of the “Access To This MAC Has Been Blocked” pop-ups and restore your Mac/browser settings to normal. Below you will find a removal guide with all the steps you may need to successfully remove adware and its traces. Some of the steps below may require you to close this page. So please read the steps carefully and then bookmark them or open them on your smartphone for future reference.

Remove profiles created by Adware

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac computer. If there is Profiles in the list, then click on it, then select a profile related to the adware.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed apps

Some browser hijackers, adware and PUAs can be removed by uninstalling the free programs they came with. If this way does not succeed, then looking them up in the list of installed software in the Finder. Use the “Move to Trash” command in order to remove them.

1. Open the Finder.
2. Click “Applications”.
3. It will show a list of all programs installed on the Apple Mac.
4. Scroll through the all list, and uninstall questionable and unknown software. Pay maximum attention to the program you installed last.
5. Drag the suspicious application from the Applications folder to the Trash.
6. Empty Trash.

Remove Adware related files and folders

Now you need to try to find Adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Some files created by Adware are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Adwarey generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, search.plist, installapp.plist, com.google.defaultsearch.plist, , macsearch.plist, and com.net-preferences.plist. Most often, browser hijackers, potentially unwanted programs and adware create several files with similar names.

Check for Adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.machelper.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for Adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.machelper.system.plist, com.installapp.system.plist, com.macsearch.system.plist and com.search.system.plist. In most cases, adware, PUPs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes to scan your Mac computer for adware, browser hijackers and potentially unwanted apps. This remover is an advanced malware removal tool developed by (c) Malwarebytes lab. It uses the world’s most popular antimalware technology. MalwareBytes is able to help you remove malicious software and other security threats from your Mac computer for free.

Download MalwareBytes Free on your machine by clicking on the link below.

Once the download is finished, close all software and windows on your MAC. Run the saved file. Follow the prompts.

MalwareBytes will automatically start and you can see its main screen like below.

Now press the “Scan” button to perform a system scan with this utility for the adware related to the Access To This MAC Has Been Blocked pop ups. This task can take quite a while, so please be patient. While the MalwareBytes program is checking, you may see count of objects it has identified as threat.

Once the system scan is complete, you will be shown the list of all detected threats on your Mac. All found threats will be marked. You can remove them all by simply press the “Quarantine” button. The MalwareBytes Anti Malware will move the selected threats to the Quarantine.

Remove Access To This MAC Has Been Blocked from Safari, Chrome, Firefox

If you are still seeing Access To This MAC Has Been Blocked pop-ups that won’t go away, you might have harmful addons installed on your web browser. Check your web browser for unwanted plugins using the steps below.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Google Chrome menu. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove Access To This MAC Has Been Blocked pop-ups by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with Access To This MAC Has Been Blocked removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop Access To This MAC Has Been Blocked pop-ups

Enabling an ad-blocker application such as AdGuard is an effective way to alleviate the risks. Additionally, ad blocking applications will also protect you from malicious advertisements and websites, and, of course, stop redirection chain to the Access To This MAC Has Been Blocked scam and similar websites.

Installing the AdGuard is simple. First you’ll need to download AdGuard on your MAC from the following link.

After the downloading process is complete, run the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you start your MAC, AdGuard will launch automatically and stop unwanted popup advertisements, block Access To This MAC Has Been Blocked scam, as well as other harmful or misleading web sites.

Report a Scam

If you encounter a scam that is similar but not the same as the example above, please post it as a comment on this article. This helps us to warn users about current scams, monitor trends and disrupt scams where possible.