my mom's iMac "has 5 viruses"

[Yoused]

iMac i5, 2013, Catalina (latest)

She is getting scareware notifications every 60 seconds or so, "potential virus threat", " viruses found!", "<something> <something>" from McAfee, "Renew Norton AV!" (actually links to norton.com). Looks to me like some kind of script that Safari put in somewhere, I cannot figure out where or how to kill it. Seems harmless enough, but it is a little annoying seeing that banner jumping out constantly.

Anyone have any idea how to fix this?

 

[Nycturne]

My partner just got this adware payload and since there was nothing important on the system we just nuked it from orbit. (Reason being a lot of this stuff is trying to become persistent and has capabilities to grab updated payloads)

In our case it was a version of Pirrit: https://www.sentinelone.com/labs/a-...e-macs-most-prevalent-adware-infections-2022/

 

[throAU]

Nuke from orbit and stay current with macOS.

If you need the stuff off it, suggest moving docs to iCloud or backing up first. But don’t just restore an entire backup into the new image.

If you need to run older versions of macOS you really shouldn’t use them as general purpose internet/email browsing machines because we live in the day of zero click malware payloads and they aren’t exclusive to windows any more. There is plenty of malware out there for every platform.

Can’t stress that enough. If you want to be on the internet these days you MUST stay current regardless of platform. There was a zero click iMessage malware for iOS the other day. And iOS is much more locked down than older versions of macOS.

If it’s on Catalina because it won’t support later OS it’s time to retire the machine from the internet or switch to a supported platform on it, whether that’s Linux or something else.

 

[throAU]

Now... I say that^^ with my IT professional hat on.

It's a risk assessment you need to make if you want to run old stuff. But be aware it is most definitely a real risk, I can not in good faith recommend you do that. But I understand sometimes it may be unavoidable.

The risk these days is not just theoretical- and it's getting worse. This time it might just be adware, but if adware can infect your machine, so can other stuff.

 

[Yoused]

I switched her over to using Firefox rather than Safari and the notifications stopped. It seems like it was something that was originating out of Safari/WebKit, so taking away its host gave it nowhere to run. And she really does not need a new computer, as she only uses it for browsing, mail and news story reprints, never and money related stuff.