E.tre456_worm_osx Trojan Virus - How to remove

E.tre456_worm_osx is a made-up name of a trojan virus used by scam alerts to scare and attack Mac users. This fake virus warning is displayed on websites with addresses like Apple.com-fixing.live, Apple.com-scan.live, and Apple.com-fast.live. Despite including the words “apple” and “mac”, these addresses belong to scammers.

E.tre456_worm_osx claims that it is related to the AppleCare Protection Plan, but in truth, it is operated by online criminals. Their goal is to force you to download and install a wide range of PUPs (potentially unwanted programs). For example, interacting with the alert may lead you to the installation of Mac Mechanic, Mac Cleanup Pro, CleanupMy-Mac, or other fake system optimization utilities.

About the E.tre456_worm_osx fake virus:

Classification	Scam, scareware.
The appearance of the scam	An unexpected pop-up in the browser, a warning about your Mac having viruses and the threat of permanent system damage.
The goal of the E.tre456_worm_osx trojan virus	To convince people to download bogus antivirus software and pay for the removal of nonexistent viruses.
How to remove E.tre456_worm_osx pop-ups	Check your computer for ad malware and remove it (if needed, use anti-malware tools like Combo Cleaner or Malwarebytes), block malicious websites with security software.

The E.tre456_worm_osx online scam currently attacks Macs all over the world. Its text is translated into local languages. The message given by the alert is always the same: that your Mac is infected, that your information is at risk, and that you must click on its “Scan Now” and “Remove Viruses Now” buttons to download crapware.

E.tre456_worm_osx online scam analysis

What the E.tre456_worm_osx alert looks like

The E.tre456_worm_osx fake trojan virus attacks all Mac browsers, including Safari, Google Chrome, and Mozilla Firefox. As soon as the E.tre456_worm_osx fake alert appears, the browser gets hijacked and users are not able to close the window. This is the first message displayed by the alert:

Immediate action required
We have detected a trojan virus (e.tre456_worm_osx) on your Mac. Press OK to begin the repair process.

Clicking on the “OK” as instructed by the pop-up gives another message:

Your system is infected with 3 viruses!
[date]
Your Mac is infected with 3 viruses. Our security check found traces of 2 malware and 1 phishing/spyware. System damage: 28.1% – Immediate removal required!
The immediate removal of the viruses is required to prevent further system damage, loss of Apps, Photos or other files. 
Traces of 1 phishing/spyware were found on your Mac with  [macOS version]. 
Personal and banking information is at risk.
To avoid more damage click on ‘Scan Now’ immediately. Our deep scan will provide help immediately! 
4 minute and 31 seconds remaining before damage is permanent.

The E.tre456_worm_osx fake trojan virus alert displays your Mac version, the current date, and it may even show your IP to make itself look authoritative. And it shows a countdown to the supposed doom of your Mac. (In reality, nothing happens if you let the countdown run out.)

There is a very similar scam to E.tre456_worm_osx – E.tre456_worm_Windows. This one targets Windows users instead of macOS users. Overall, the two fake virus messages are very similar and they both seek the same thing: to get their victims to send their hard-earned money to scammers.

The goal of the fake trojan virus

E.tre456_worm_osx is meant to make you click on its “Scan Now” button. This leads to a fake scan of your Mac. Very quickly, the pseudo scan is completed and the alert shows many other threats that were supposedly found, such as Tapsnake, CronDNS, and Dubfishicv.

The E.tre456_worm_osx alert then instructs you to download some software that is going to fix the made-up Mac problems and remove the E.tre456_worm_osx trojan virus. It asks you to click on the final button, “Remove Viruses Now”. Doing that downloads and installs one of the PUPs mentioned in the very first paragraph of this article.

It is strongly advised that you do not download anything suggested by the E.tre456_worm_osx online scam. This will not fix your Mac, as it likely doesn’t need any fixing. Instead, it will make it even more burdened by useless utilities that slow down the system and flood you with even more fake virus alerts. Furthermore, the programs promoted by E.tre456_worm_osx are paid, meant to scam you out of your money.

How to remove E.tre456_worm_osx pop-ups

If you see E.tre456_worm_osx and other fake trojan viruses often, if this isn’t just a one-time thing, then it is likely that your Mac is contaminated with adware or that you frequent a website that is infected with malicious redirects. It is even possible that the E.tre456_worm_osx pop-up downloaded itself to your computer.

Even when you know that the E.tre456_worm_osx alert is a scam, it still makes you waste your time closing the pop-up window, which is disruptive and annoying.

There are several steps in getting rid of the E.tre456_worm_osx scam:

• First of all, access your Mac Applications folder, check the software that looks suspicious and get rid of it right away by moving it into the Trash.
• Check your browser extensions and remove those that are suspicious.
• Scan your Mac with antivirus software (Combo Cleaner, Malwarebytes, others). It will identify potentially unwanted programs that might still remain after manual computer cleanup.
• Use anti-malware tools that can block malicious websites in your browser.

Check Apple’s tips on how to recognize and avoid scam messages. Scammers won’t quit harrassing Mac users, so it is important to be prepared.

Automatic Malware removal tools

How to remove E.tre456_worm_osx Trojan Virus from Safari:Top

Remove malicious extensions

• Click on Safari menu on the top left corner of the screen. Select Preferences.
  
• Select Extensions and uninstall E.tre456_worm_osx Trojan Virus and other suspicious extensions.
  
• If your homepage was changed, click on Safari menu on the top left corner of the screen. Select Preferences and choose General tab. Enter preferable URL to the homepage field.
  

(Optional) Reset your browser’s settings(older versions) If you are still experiencing any issues related to E.tre456_worm_osx Trojan Virus, reset the settings of your browser to its default settings.

• Click on Safari menu on the top left corner of the screen. Select Reset Safari…
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopHow to remove E.tre456_worm_osx Trojan Virus from Google Chrome on Mac:

• Open Chrome browser.
• Enter in the url field “chrome://extensions” address and hit Enter.
• Find E.tre456_worm_osx Trojan Virus on the extensions list and click on the recycle bin icon next to it.
• Click on 'Chrome' button at the top left corner. Select 'Preferences' on a drop-down menu box.
• Find 'Search' options on Settings tab. If your search engine is changed, click 'Manage Search Engines' and set your preferred search engine.
• On the same page find 'Show home button' checkbox and change your homepage.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to E.tre456_worm_osx Trojan Virus, reset the settings of your browser to its default settings.

• On the 'Preferences' menu window, scroll down to the bottom and find 'Reset settings' button. Click it.
• Confirm your selection and click 'Reset' on the following window.

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program. Top

How To remove E.tre456_worm_osx Trojan Virus from Firefox on Mac OS:

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (Or press cmd+Shift+A on your keyboard).
• Go through Extensions list, remove everything E.tre456_worm_osx Trojan Virus related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
• Enter “about:preferences” in URL bar and hit enter.
• Open Search settings tab.
• If your search engine is changed, click 'Default Search Engines' and set your preferred search engine.
• If your homepage was changed, click on the Firefox menu in the top right corner, select Preferences-> General. Enter a preferable URL to the home page field.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to E.tre456_worm_osx Trojan Virus, reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
• Choose Troubleshooting Information on the Help menu.
• Click on the Refresh Firefox button.
• Click on the Refresh Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.

If the problem persists, scan your system with an anti-malware program to identify malicious entries.