How to check for malware on Mac

Have you heard that Macs are immune to viruses? So have we. But that is not true. Even though Macs have a pretty powerful built-in security system, they can still pick up malware. So, let's find out what the symptoms of an infection are, how to scan for viruses on a Mac, and how to remove malware manually or with special tools.

What is a Mac virus?

Mac viruses are a type of malware that targets macOS. Some of them are just annoying, and some pose a real threat to your private information. For example, browser hijackers redirect you to third-party websites you didn't intend to visit, while annoying adware bombards you with banners and pop-ups. Ransomware holds your files hostage by encrypting them and demanding payment to decrypt them. And when spyware sneaks onto your computer, it monitors your actions and steals sensitive information.

Signs of a Mac virus infection

Before you learn how to find malware on a Mac, check out the key signs that your Mac is infected. The most obvious red flag is that your Mac is slow – but don't panic; your computer could have performance issues for many reasons, including low RAM, resource-hungry apps, etc. In addition to a slow Mac, viruses usually cause one of the following problems:

Symptom	Solution	Steps
Mac running slow	Check for viruses	Use CleanMyMac: Protection > Scan
Unwanted apps/extensions	Uninstall suspicious items	Finder > Applications > Sort by date > Delete suspicious apps
Browser homepage changed	Remove malicious extensions	Safari: Preferences > Extensions > Uninstall unwanted extensions
Annoying ads and pop-ups	Check browser settings	Safari: Preferences > Extensions > Uninstall adware
Receiving unusual messages	Check Activity Monitor	Open Activity Monitor > Check processes > Stop suspicious ones
Free disk space disappearing	Run Disk Utility First Aid	Open Disk Utility > Select drive > First Aid > Run
Unable to access files	Restore backups	Finder > Locations > iPhone > Manage Backups > Restore
Redirects to unwanted websites	Remove malicious extensions	Safari: Preferences > Extensions > Uninstall unwanted extensions
High CPU usage	Monitor CPU usage	Use iStat Menus and App Tamer
General virus and malware prevention	Regular maintenance	Use CleanMyMac: Run regular Smart Care scans and maintenance tasks

If your Mac has these symptoms, it's time to run a virus scan.

How to scan Mac for viruses and malware automatically

Our #1 pick for virus detection and removal is CleanMyMac, which works with all types of malware. It's a powerful, comprehensive app for all Mac situations that helps it perform at its best. The app removes everything that is harmful, junk, or slowing down your computer while keeping your important files intact.

Here's how to check for viruses on a Mac with CleanMyMac:

1. Download and open CleanMyMac.
2. Click Protection in the right pane.
3. Click Scan.

The scan will take one to several minutes. If the app finds any threats, remove them immediately by clicking the Remove button.

How to check and find malware on Mac manually

Manual threat detection takes a while longer. You'll need to run several built-in Mac tools and clean up various folders.

Check Activity Monitor

To scan for viruses manually, start with Activity Monitor, an app that tracks all the processes running on your Mac. Your goal here is to find suspicious virus-like processes. They usually consume a lot of resources, memory, power, etc.

1. Open Activity Monitor.
2. Check each tab (CPU, Memory, Energy, Disk, Network).
3. Sort processes by activity. To do this, click the heading of the first column on the right.
4. Find and Google processes that look suspicious based on their resource usage or name.
5. If you find malicious processes, stop them by clicking the X button.

Note that stopping the malicious process won't remove it, but it will at least help you buy time.

Another nuance is that viruses can mask their presence on Mac, and then Activity Monitor may not detect them.

To monitor your Mac 24/7 and receive notifications about potentially harmful processes, we recommend two helpful tools.

The first is App Tamer, which monitors CPU usage. If CPU usage exceeds a certain limit, you will receive a notification. Since malware can be resource-hungry, you'll know about suspicious processes as soon as they appear.

The second tool, iStat Menus, works similarly but monitors more indicators: Memory, Disk, Battery, Sensors, etc. You can set up notifications if the memory pressure, sensor temperature, and others go above a certain level. The app provides recommended values, but you can set your own. That way, if something goes wrong, you get an alert and can decide what to do next.

Uninstall suspicious apps

Malware often disguises itself as a regular app and may even have a familiar .dmg extension. Check if your Mac is hosting such a thief.

1. Go to Finder > Applications and sort the apps by date modified, with the newest ones at the top.

2. Look for apps you didn't install or that look suspicious, and drag them to the Trash.

3. Go back to the Finder and choose Go > Go to Folder from the app menu. Go to these locations one by one and delete the leftover files associated with the malicious app (they will probably have a similar name):

   • ~/Library/Application Support

   • ~/Library/Preferences

   • ~/Library/LaunchAgents

4. Empty the Trash.

Be careful not to delete system files or files associated with legal apps, as this may cause malfunctions. For more instructions, check out our guide on how to delete apps on Mac quickly.

Also, note that the Finder can only remove inactive apps. However, quitting a malicious app can be a problem. Malware can run undetected, and there is a risk that it will not appear in the Activity Monitor or the list of apps when you try to launch Force Quit. In this case, use CleanMyMac. Click Applications > Scan > Manage My Applications > Uninstaller. Select the app you want to delete, and click Uninstall. (Bolt AI in the screenshot is an absolutely great app — we just didn’t have any malware on the Mac to use as an example!)

Delete suspicious login items and profiles

Some viruses can change settings to run immediately when you log in to your Mac. To find out if you have any, check Login Items: Apple menu > System Settings > General > Login Items. Are there any items that you didn't add or that you find suspicious? If so, use the – button to remove them.

Again, viruses can be stealthy and not show up in this window. Moreover, virus software can also masquerade as launch agents. These are a kind of micro-apps that help manage various processes on your Mac. They usually run autonomously and do not appear in the list of Login Items.

However, CleanMyMac is quite sensitive to these types of malware. To delete them, open CleanMyMac > Performance > Scan > View All Tasks > Login Items. Select the suspicious apps and click Remove.

The next place to check while searching for viruses is Profiles. You can access them through the Apple menu > System Settings > Privacy and Security > Profiles (at the bottom).

Profiles are like general rules that define what Mac can and cannot do. They can be "good" or "bad". For example, your company might set a good rule that requires you to change your Mac password at certain intervals. A "bad" virus profile can, for example, redirect traffic from your Mac through a proxy server and collect sensitive data.

So check the installed profiles and remove the ones you are sure are dangerous.

Run an antivirus scan on Mac using the built-in tool

At this point, after the various manual settings, you may be wondering if Macs have an app that can automatically scan your computer for viruses. The short answer is no. The long answer is as follows.

Macs have a multi-layered security system and even a built-in antivirus tool called XProtect. But it has no user interface, so you cannot actually "run" a Mac built-in virus scan with this tool. It always runs in the background and doesn't need to be activated. If you launch an app that XProtect thinks is malicious, it will prompt you to uninstall it.

All you can do is follow the regular system updates. Go to System Settings > General > Software Updates > Automatic Updates and make sure the Install Security Responses and system files checkbox is enabled.

Clear downloads and temporary files

The next step in manually neutralizing malware is to clean up your Downloads (because malicious files can hide there and even have a .dmg extension) and Temporary Files.

To clean your downloads, go to Finder > Downloads and delete anything suspicious.

For temporary files, the procedure is as follows. 

1. Open Terminal (find it in Finder > Applications).
2. Type the command open $TMPDIR and press Enter. 
3. Delete the folders in the window that opens.

Temporary files are usually safe to delete, but if you're not sure, it's best to use a professional cleaner.

Check browser extensions

The last step is to check the browser extensions. Malicious ones can be responsible for bombarding you with ads, changing your homepage unexpectedly, or even collecting your personal information.

Review the extensions in each browser you use and remove those that seem suspicious, unnecessary, or that you did not install.

Safari

Open Safari and click Safari in the app menu (upper left part of the screen). Then go to Preferences > Extensions tab. To uninstall, select an extension and click Uninstall.

Chrome

Open Chrome and type chrome://extensions in the address bar.

Alternatively, click on the three dots in the upper right corner of the Chrome window and choose Extensions > Manage extensions. Delete unwanted ones by clicking Remove.

Firefox

Open Firefox and type about:addons in the address bar.

Alternatively, click the burger button in the upper right corner, choose Add-ons and themes, and select Extensions on the left.

To remove an extension, click the three dots next to it and click Remove.

How to scan your Mac for viruses online

While researching the topic of malware, you may come across an offer to scan your Mac for viruses online. We should warn you that this is a scam. Scanning your entire Mac efficiently and safely using web services is impossible. Web-based tools do not have full access to your Mac's file system and should not attempt to do so. High-quality virus scanning is only possible with reliable software installed on the Mac.

How to protect your data from Mac viruses

Now that you know how to run antivirus on Mac and remove malware, the only thing left to figure out is how to prevent infection and protect your data. Here are the key ideas.

Back up your Mac

It's a good idea to back up your entire Mac or important files. To do this, you can use the built-in Time Machine app. Here's how to back up your Mac:

1. Connect a portable hard drive.
2. Go to the Apple menu > System Settings > General > Time Machine.
3. Add a backup disk and follow the instructions.

Time Machine is a good tool if you have no other options. But its backups are not compressed enough and take up a lot of space. Also, it backs up the entire Mac by default, and you have to tinker with the settings to make copies of individual files.

If you can choose, try Get Backup Pro. It can back up individual important files, and its archives take up to 60% less space.

Here's how to back up your Mac with Get Backup Pro: 

1. Open the app and select Backup or Clone (Get Backup Pro can also create a bootable clone – a mirror of your boot drive). 
2. Click the + button in the lower left corner to create a new project.
3. Specify the backup source and destination.
4. Click File+ or Apps Data+ to add the data you want to back up.
5. Click the Backup button to start.

Wait for the process to complete, and that's it – your files are saved.

Regularly update software and operating system

The latest software versions have the latest security fixes, so they provide better protection. We recommend that you enable automatic system and app updates: System Settings > General > Software Updates > Automatic Updates. Click on the i button and turn on the switches in this window.

Use Firewall and other security measures

Sometimes, the simplest things can cause the biggest problems. Here's something you can do right now that will take less than 30 seconds for your Mac virus protection.

1. Go to the Apple Menu > System Settings > Network.
2. Click on Firewall and make sure it is on.

Stay alert to new virus threats and updates

Finally, always be curious about information about potential Mac virus threats. Subscribe to one or two trusted cybersecurity resources or newsletters to stay informed. That should be enough.

How to scan Mac for virus: Solved

So, if your Mac is infected, you have two options: find and remove the virus manually or use third-party malware scanners. Since the Mac's built-in protection is quite powerful, removing the infected app along with related files or a malicious browser extension may be enough.

For a deeper clean, or if the built-in tools can't detect the virus, use CleanMyMac, a Mac care app, and a powerful Mac malware scanner. It will fully scan your computer, detect threats, and thoroughly clean the system.

iStat menus and App Tamer are additional tools that can help you monitor the health and performance of your Mac. They'll alert you when your Mac is experiencing a high load (which is often the case when your Mac is infected) and help you find the culprit.

All of these apps are available on Setapp, along with dozens of other tools for macOS and iOS. Try them all free for 7 days with no restrictions or ads. 

FAQs