Keychain message... Virus?

[Sam E]

Doesn't work. Keychain folder automatically replaces itself after about an hour, and even when the Mac is closed and the wifi off.

Not malware, it's a Keychain problem. It's a real stupid issue on OS X. This is how you solve it.

1) Open the Library by clicking the 'Go' menu in Finder. Hold down the 'Alt' key, and Library will be visible.

2) Navigate to the folder called 'Keychains'. Open this folder.

3) Delete all folders you see in the Keychain folder. You won't be able to empty the Trash, so don't worry about trying to empty it.

4) Restart your Mac.

5) If it prompts you for a keychain at the start, click 'Create new keychain'

You'll have to re-enter saved passwords and stuff like that, but this should fix the issue.

While you're doing this, if you get the keychain error, just click 'Cancel'.

 

[keysofanxiety]

Doesn't work. Keychain folder automatically replaces itself after about an hour, and even when the Mac is closed and the wifi off.

Well... yes, the Keychain folder is part of the OS and it will always recreate itself. That's expected behaviour. But deleting the Keychain folder will delete the faulty Keychain and should solve the problem...

The problem isn't the Keychain folder exists, it's that the keychain messed up so it needs to be deleted & have a fresh one recreated.

 

[cldiaz]

Not malware, it's a Keychain problem. It's a real stupid issue on OS X. This is how you solve it.

1) Open the Library by clicking the 'Go' menu in Finder. Hold down the 'Alt' key, and Library will be visible.

2) Navigate to the folder called 'Keychains'. Open this folder.

3) Delete all folders you see in the Keychain folder. You won't be able to empty the Trash, so don't worry about trying to empty it.

4) Restart your Mac.

5) If it prompts you for a keychain at the start, click 'Create new keychain'

You'll have to re-enter saved passwords and stuff like that, but this should fix the issue.

While you're doing this, if you get the keychain error, just click 'Cancel'.

THis worked great!!! THanks

 

[rgerber85]

Well... yes, the Keychain folder is part of the OS and it will always recreate itself. That's expected behaviour. But deleting the Keychain folder will delete the faulty Keychain and should solve the problem...

The problem isn't the Keychain folder exists, it's that the keychain messed up so it needs to be deleted & have a fresh one recreated.

Hi I did follow these steps (I can't delete the folder from the trash...) and now it's giving me a new prompt to "macOS needs to repair your library to run applications"

I went through and changed the read write permissions to read & write for user and admin...

...I changed the password to log in... used the First Aid for Keychain in the OS and in the Command + R safety mode...

Nothing.

And every time I enter the new password 3-4 times, after a few minutes I get the same prompt again. Any idea? Help

Thank you!

 

[keysofanxiety]

Hi I did follow these steps (I can't delete the folder from the trash...) and now it's giving me a new prompt to "macOS needs to repair your library to run applications"

I went through and changed the read write permissions to read & write for user and admin...

...I changed the password to log in... used the First Aid for Keychain in the OS and in the Command + R safety mode...

Nothing.

And every time I enter the new password 3-4 times, after a few minutes I get the same prompt again. Any idea? Help

Thank you!

Oooer, that sounds like a different issue. OS needs to be repaired I'd imagine.

1) Hold CMD + R on startup to boot into OS X/macOS Utilities
2) Select Reinstall OS X/macOS
3) Point it to your drive (Macintosh HD)

If the drive is greyed out and cannot be selected, you'll need to open Disk Utility and right-click Macintosh HD, then select Unlock and enter your computer's password.

The reinstall will not wipe any existing applications or user data; it will just reinstall the core OS features.

Let me know if you're still having any issues from here.

 

[rgerber85]

Oooer, that sounds like a different issue. OS needs to be repaired I'd imagine.

1) Hold CMD + R on startup to boot into OS X/macOS Utilities
2) Select Reinstall OS X/macOS
3) Point it to your drive (Macintosh HD)

If the drive is greyed out and cannot be selected, you'll need to open Disk Utility and right-click Macintosh HD, then select Unlock and enter your computer's password.

The reinstall will not wipe any existing applications or user data; it will just reinstall the core OS features.

Let me know if you're still having any issues from here.

So I did that last night. I remounted the MAcintosh HD and reinstalled MacOS... still happening.

Thank you for replying so quickly!
[doublepost=1513016563][/doublepost]

So I did that last night. I remounted the MAcintosh HD and reinstalled MacOS... still happening.

Thank you for replying so quickly!

Now it won't let me reinstall macOS High Sierra...

 

[keysofanxiety]

So I did that last night. I remounted the MAcintosh HD and reinstalled MacOS... still happening.

Thank you for replying so quickly!
[doublepost=1513016563][/doublepost]
Now it won't let me reinstall macOS High Sierra...

Apologies for my belated reply. Please could you boot into the OS (if you're still able to) and run/screenshot the outcome of SMART Utility: https://cloudfront.volitans-software.com/smartutility323.zip

If it won't boot into the OS at all, could you confirm what model Mac you have?

 

[banorange_peel]

Not malware, it's a Keychain problem. It's a real stupid issue on OS X. This is how you solve it.

1) Open the Library by clicking the 'Go' menu in Finder. Hold down the 'Alt' key, and Library will be visible.

2) Navigate to the folder called 'Keychains'. Open this folder.

3) Delete all folders you see in the Keychain folder. You won't be able to empty the Trash, so don't worry about trying to empty it.

____
Is this solution still valid?
I found only ONE folder in my Keychains folder, which I deleted, then immediately restarted my Mac. But the folder is back in Keychains and the annoying popup message came back right away:
"accounts wants to use your confidential information stored in "SKype4Life-AddinToken-https//substrate.office.com/Todo-Internal.ReadWrite" in your keychain."

Coincidentally (?), now Notes won't open and having a problem opening Mail... :-(

Question:
I deleted ONLY this one folder in the Keychains folder. Was I ALSO supposed to delete the 12 files in it? Or delete the entire Keychains folder in my Library?

FYI - mine is an old MacBook Pro (2012) running OS X El Capitan)

I'm starting to panic as my Macbook is ESSENTIAL to my life...

[doublepost=1548752898][/doublepost](re-posting, as I entered my question wrong, above...)

Is this solution still valid?
I found only ONE folder in my Keychains folder, which I deleted, then immediately restarted my Mac. But the folder is back in Keychains and the annoying popup message came back right away:
"accounts wants to use your confidential information stored in "SKype4Life-AddinToken-https//substrate.office.com/Todo-Internal.ReadWrite" in your keychain."

Coincidentally (?), now Notes won't open and having a problem opening Mail... :-(

Question:
I deleted ONLY this one folder in the Keychains folder. Was I ALSO supposed to delete the 12 files in it? Or delete the entire Keychains folder in my Library?

FYI - mine is an old MacBook Pro (2012) running OS X El Capitan)

I'm starting to panic as my Macbook is ESSENTIAL to my life...

 

[Leslienmn]

Not malware, it's a Keychain problem. It's a real stupid issue on OS X. This is how you solve it.

1) Open the Library by clicking the 'Go' menu in Finder. Hold down the 'Alt' key, and Library will be visible.

2) Navigate to the folder called 'Keychains'. Open this folder.

3) Delete all folders you see in the Keychain folder. You won't be able to empty the Trash, so don't worry about trying to empty it.

4) Restart your Mac.

5) If it prompts you for a keychain at the start, click 'Create new keychain'

You'll have to re-enter saved passwords and stuff like that, but this should fix the issue.

While you're doing this, if you get the keychain error, just click 'Cancel'.

[doublepost=1565513161][/doublepost]Hi, and thank you. I want to try this remedy but, I'm worried about the 'You'll have to re-enter saved passwords and stuff'. I'm not as computer literate as most of the people on this forum. I have no clue what many of those passwords are....they've been entered automatically for so long. Will I have to go through the 'forgot password' routine for every one?

 

[hobowankenobi]

[doublepost=1565513161][/doublepost]Hi, and thank you. I want to try this remedy but, I'm worried about the 'You'll have to re-enter saved passwords and stuff'. I'm not as computer literate as most of the people on this forum. I have no clue what many of those passwords are....they've been entered automatically for so long. Will I have to go through the 'forgot password' routine for every one?

Short answer: Yes.

Keychain holds most your saved passwords....so deleting it means deleting most your saved passwords, plus other security related items, like certs.

I say "most", because some things (like FireFox and Chrome) have their own integrated function to save passwords...and don't use Keychain.

Other options to deleting Keychain:

1. The most common cause of all the popups is changing a user account password....by some method that does not update the Keychain (A Mac bound to Active Directory, or an admin account changing a different account PW, etc). In this case, logging in as the user with the chanced PW will produce all the Keychain warnings...something like 20 or 30 (depends on saved Keychain entries).

Update manually: when the keychain boxes pop up, they are asking for the old (previous) account PW, not the new (current) account PW. If you know the old PW, enter it. Done.

2. In the Utilities Folder, open KeyChain Access. This app will show you everything in your keychain as well as let you managed everything. You can manually delete items no longer wanted, and if you click on each item, you can see what the saved password is.

To see saved items: Click on Keychain item to open an info window. Check the show Password box. You will be prompted to put in your current user PW (to confirm access), often twice. In the bottom field, you can then see the saved for this event/account/location/application/server.

If neither of these options work—likely because of an unknown/changed user account PW—there is no easy way to use, view, save, or change the existing Keychain items. Similar to having a lock in your hand, but you lost key....

 

[JDAA4]

Not malware, it's a Keychain problem. It's a real stupid issue on OS X. This is how you solve it.

1) Open the Library by clicking the 'Go' menu in Finder. Hold down the 'Alt' key, and Library will be visible.

2) Navigate to the folder called 'Keychains'. Open this folder.

3) Delete all folders you see in the Keychain folder. You won't be able to empty the Trash, so don't worry about trying to empty it.

4) Restart your Mac.

5) If it prompts you for a keychain at the start, click 'Create new keychain'

You'll have to re-enter saved passwords and stuff like that, but this should fix the issue.

While you're doing this, if you get the keychain error, just click 'Cancel'.

I have performed these directions numberous times and still have the problem. Any other suggestions. I had this problem on my old Macbook Pro and I just recently used Migration Assistant to transfer info to my new Macbook Pro 2021. Still having the problem and would like to finally resolve this.

 

[hobowankenobi]

I have performed these directions numberous times and still have the problem. Any other suggestions. I had this problem on my old Macbook Pro and I just recently used Migration Assistant to transfer info to my new Macbook Pro 2021. Still having the problem and would like to finally resolve this.

If you have in fact deleted the keychain, you should not get prompts to use the login keychain...as it no longer exists.

If you get a prompt to use a keychain, then there must be a keychain to use...so your delete was incomplete or unsuccessful.

---

You will get prompted to enter passwords that were previously saved in any keychain, which is to be expected...as there would be no saved passwords, nor a keychain file to hold passwords, the same a new account would get.

Migration assistant would transfer everything, so yes, you should expect the same behavior (working or broken).


Instead of deleting, you can always try moving or renaming the login.keychain-db file. To be sure you are starting fresh, you could create a new folder inside ~/Library/Keychains and move all of the contents of ~/Library/Keychains to the new folder. both the file path (location) and the file name matter, so changing either will trigger the creation of new default files as needed within the Keychains folder.

If you really want to test, you could also create an entirely new test user, log into that user and see exactly how a fresh new keychain is behaving.

 

[JDAA4]

If you have in fact deleted the keychain, you should not get prompts to use the login keychain...as it no longer exists.

If you get a prompt to use a keychain, then there must be a keychain to use...so your delete was incomplete or unsuccessful.

---

You will get prompted to enter passwords that were previously saved in any keychain, which is to be expected...as there would be no saved passwords, nor a keychain file to hold passwords, the same a new account would get.

Migration assistant would transfer everything, so yes, you should expect the same behavior (working or broken).


Instead of deleting, you can always try moving or renaming the login.keychain-db file. To be sure you are starting fresh, you could create a new folder inside ~/Library/Keychains and move all of the contents of ~/Library/Keychains to the new folder. both the file path (location) and the file name matter, so changing either will trigger the creation of new default files as needed within the Keychains folder.

If you really want to test, you could also create an entirely new test user, log into that user and see exactly how a fresh new keychain is behaving.

I took a picture of all the "Keychain Not Found" alerts that are coming up. I could post it here if that would help. Some have locks with a magnifying glass, some with black squares, and more. As you can tell I'm a novice in Mac repair. I hesitate to try moving/renaming as now I also seem to be expanding my problems as now upon restart I always get an alert to Sign in to continue using Backup and Sync. When I scroll over the alert to click "sign in" I get a spinning beach ball. And also I get an alert about iCloud not working properly. I seem to have made a mess.

 

[JDAA4]

If you have in fact deleted the keychain, you should not get prompts to use the login keychain...as it no longer exists.

If you get a prompt to use a keychain, then there must be a keychain to use...so your delete was incomplete or unsuccessful.

---

You will get prompted to enter passwords that were previously saved in any keychain, which is to be expected...as there would be no saved passwords, nor a keychain file to hold passwords, the same a new account would get.

Migration assistant would transfer everything, so yes, you should expect the same behavior (working or broken).


Instead of deleting, you can always try moving or renaming the login.keychain-db file. To be sure you are starting fresh, you could create a new folder inside ~/Library/Keychains and move all of the contents of ~/Library/Keychains to the new folder. both the file path (location) and the file name matter, so changing either will trigger the creation of new default files as needed within the Keychains folder.

If you really want to test, you could also create an entirely new test user, log into that user and see exactly how a fresh new keychain is behaving.

So I renamed login.keychain-db to login.keychaintest-db and restarted laptop. Still getting alerts. I then went to Library and then Keychains and made a new folder called New Folder. I drug everything that was in the Keychains folder into New Folder. I restarted laptop. Still getting alerts. So just to be clear about what alert I am getting it says...... Grayed out at top says "Keychain Not Found". Then in the box alert it says "Keychain "myname-db" cannot be found". In smaller print it says "Your keychain may have been renamed, deleted, or it's on a unmounted volume". My two options to click on are "Cancel" or "Reset to Defaults"

UPDATE: and as the laptop stays on more alerts pop up. Such as "Keychain myname-db cannot be found to store "E373EAFD-0E7F-409E-BEF6-19EC41826D97" Your keychain may have been renamed, deleted, or it's on a unmounted volume" I've clicked Cancel for all the alerts and rebooted computer and the alerts persist. I've then clicked Reset to Defaults for all the alerts and rebooted computer and the alerts persist.

 

[hobowankenobi]

Hmmm...unusual.

What is in the Keychain folder now that you moved the originals...were new defaults created?

Did you try selecting Reset to Defaults?

To verify it is not a wider issue, you could try creating a new test user and see if it has any keychain issues.

Any chance there is something else going on? Any signs of user permissions problems?

You said new MBP, so is this all on MacOS 11? There could be changes to keychain...all the keychain advice in this thread is from historical experience. I have not seen keychain issues on a Big Sur Mac, but it may be time to test and see if there are new changes, problems, or fixes.