Scam - "Trojan Detected!" on macOS - How to remove

There’s another scam targeting Mac users. A fake Apple Support page shows a Quick Scan window and “Trojan detected!” alerts in the bottom right corner of the screen.

This page is used by scammers to scare people into believing that their Mac is infected. Scammers then convince their victims to pay exorbitant fees to “fix” their Mac.

If you see this “Trojan detected!” page, close it and move on. It’s nothing but a scam.

About the “Trojan detected!” scam:

Classification	Tech support scam, it is used by fraud support companies that want to sell unnecessary software to people who don’t need it,
Dangers of the “Trojan detected!” fake scan	Lost money, wasted time, exposed private information.
How to avoid scams and other malicious pages	Block malicious websites with security tools, recognize scams and don’t engage with them when they appear on your screen.
How to deal with the “Trojan detected!” scam	Remove all malware and potentially unwanted apps manually or with anti-malware tools (Combo Cleaner), protect your personal and payment information.

How the “Trojan detected!” scam attacks Mac users

Fake scans on spoofed Apple Support sites

There are many tech support scams that target Mac users. Some say that they detected viruses on your device, others show made-up errors. Nowadays, an especially popular scam is bogus robocalls about people’s iCloud being hacked.

The “Trojan detected!” scam is a webpage is a good old tech support scam. It’s made to look like an Apple Support page. On top of it is a window named “Quick Scan”. It claims to have scanned your Mac and found a few security risks that require your attention. At the bottom, this window is labeled with the name “macOS Security”.

At the same time, in the bottom right corner of this fake Apple Support page, warnings about trojans appear very quickly.

Overall, this Apple “Trojan detected!” scam looks like a version of the Error #268D3 scam, only it’s targeting Mac users this time.

Here’s what the scam page looks like:

Dangers of the scam

The people who created this webpage want to make money. They do this by offering bogus tech support services. They use pop-ups such as the “Trojan detected!” scan to scare people into calling the phone number provided by the scam page.

The scammers impersonate Apple Support and instruct victims over the phone to install remote access software. This allows the scammers to control the victims’ Macs over distance. The scammers might install some crapware, possibly even some spyware.

The scammers then tell their victims that they solved all the problems and demand payment. This is how the “Trojan detected!” scam helps them make money – by scaring people and then pressuring them.

Luckily, this stuff only happens to those who contact the scammers. If you saw the “Trojan detected!” page but did not contact anyone, you’re okay.

Signs of the scan being fake

There are so many malicious sites and scams out there that it’s hard to avoid them. But if you can tell scams apart from real warnings, you will not be hurt by them.

One thing that the Apple Support page of the “Trojan detected!” scam lacks is the correct URL. The only Apple Support that you can trust is the one on Support.apple.com. Any other address is suspicious, even if it has “Apple” or “mac” in its name.

Another is the abundance of “Win32” detections. Win32 malware refers to malicious programs that affect Windows PCs. Even if these trojans were on your system, they couldn’t hurt you if you’re using a Mac. The scanner is also apparently scanning your C:WindowsSystem32DriverState, whatever that is supposed to be.

Finally, the fact that the “Trojan detected!” warnings show up in your browser is a sure sign that this scan is fake. A webpage can’t just look at the files on your system. It can’t scan them. Online scanners exist, but they require you to upload the files yourself.

Rest easy, the “Trojan detected!” warnings were fake.

How to deal with the “Trojan detected!” scam

Protect your Mac against malware

Do you get suspicious pop-ups and redirects often? If so, then there may be a bad extension in your browser. Or you may be visiting a lot of websites that don’t take seriously the security of their visitors.

It could be helpful to protect your Mac from malicious apps and websites by using an anti-malware application, such as Combo Cleaner and others.

Familiarize yourself with tech support scams (check out these screenshots) and with security tips by Apple.  Educate the members of your household about these scams. Never ever provide your personal and payment details to unknown people.

Recover from a scam

If you did fall for the “Trojan detected!” scam, don’t delay:

1. Remove whatever apps the scammers told you to install. You can restore your Mac from a backup if you have any backups.
2. Check your computer for spyware with an anti-malware app. Then, reset your passwords.
3. If you revealed your payment details to the scammers, contact your bank.

Most importantly, don’t let scammers charge you any money. Be honest with your bank about what happened.

Once the scam has been taken care of, remain vigilant of unwanted phone calls and suspicious emails (spear phishing).

Automatic Malware removal tools