Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

SheerGold

macrumors regular
Original poster
Apr 20, 2006
112
0
Some months earlier I tried McAfee antivirus.

I did not like it.
So I removed it.

It is no longer in the Applications Folder. And A search for it finds nothing.

But it is running in the background.

Anyone know how to completely remove it?
 
But, there is no longer any McAfee software on my Mac,
So the uninstaller is no longer on my Mac
You have steps to remove the app manually there:
  1. In the Finder menu bar, click Go.
  2. Select Go to Folder from the drop-down list.
  3. Type /usr/local/ into the Go to the folder field, and click Go.
  4. Look for the McAfee folder, and drag this folder into the trash.
  5. Open the Go to Folder dialog again, and type /Library/ApplicationSupport/ into the field.
  6. Click Go, and look for the McAfee folder. Drag the McAfee folder into the trash.
  7. Open the Go to Folder dialog again, and type /Library/LaunchDaemons/ into the field.
  8. Click Go, and look for the com.mcafee.cspd.plist file. Drag this file into the trash.
No need to reinstall to uninstall again.
 
I have done this.

However it is still running in the background.

See the attached screenshots.
The first one is the notification that pops up every 30 seconds.
The second is what opens when I click on the notification.

Anyone have further ideas about how to prevent this happening?
 

Attachments

  • Screenshot 2023-05-13 at 11.39.59.png
    Screenshot 2023-05-13 at 11.39.59.png
    51.1 KB · Views: 90
  • Screenshot 2023-05-13 at 11.40.48.png
    Screenshot 2023-05-13 at 11.40.48.png
    55.9 KB · Views: 105
What apps are running when you get that notification? Please list all of them, including all web browsers.

Do you have notifications enabled in your browser? Which websites have you enabled notifications for?

Did you ever see any notifications from McAfee when you had it installed? If so, do you recall the exact wording, or even some specific terms? For example, did it say that McAfee had detected a problem?

If you have notifications enabled on your browser, it's conceivable that a website you've visited can trigger a notification and dialog. This can only happen if the browser app is running, which is why I asked about all the apps that might be running when the notification and dialog window appear. If you quit your browser(s) and the notifications stop, then they're almost certainly coming through the browser, which means they're originating at some website.

EDIT
It's also possible that a browser extension might be involved. Again, if you quit the browser and the notifications stop, then it points to the browser as origin. However, it might be an extension you've added, rather than a site you've visited.


To me, both the notification and second dialog look very generic, and quite possibly fake.

They look like some scareware is trying to get you to install something bad. This is why I asked about specific text from McAfee you might have seen. If their notifications and dialog looked different. especially the text, then that increases the likelihood that these aren't really from McAfee, but are instead from an impostor of some kind.

The messages don't actually say that it's found anything bad. Instead, it's just giving generic warnings that try to convince you that something bad might happen. "Your PC is at risk of being infected by viruses" is completely generic.

The English in the second dialog window is slightly incorrect:
You've visited illegal infected website
You have visited unsafe site with illegal content
Both of these are missing an "an". In the first one, it should be before "illegal", in the second, before "unsafe".

I also have some doubt that McAfee for Macs would say "PC", when it ought to know it's running on a Mac.


If you want to be absolutely sure that any prior McAfee has been removed, I suggest that you reinstall it, then remove it using its uninstaller. If you still get notifications and dialogs after that, then I think it's far more likely they're scareware, possibly via browser notifications, rather than an incompletely removed McAfee.
 
Last edited:
  • Like
Reactions: ignatius345
Agree with @chown33, scareware/malware that got installed from a less than legit installer or browser extension.

"illegal infected website" is just so fake a message.

And the "McAfee" screen behind it is so not McAfee for Mac: has Windows-like controls. And as @chown33 pointed out, "PC" and not "Mac" or "Computer". And the banner alert is not legit Apple like. Scammers.

Real McAfee has a support page with this exact fake screen image as an example: https://www.mcafee.com/support/?locale=en-US&articleId=TS102999&page=shell&shell=article-view

So, might want to give this a go to see if it finds anything as a starting point: https://www.malwarebytes.com/mac-download
 
  • Like
Reactions: ignatius345
I also recommend MalwareBytes.

It's a free download.
It runs for something like 30 days, then asks you to pay to continue use.
You DON'T HAVE TO DO THAT (shouting is intentional).
Just "convert it" to the free version, and you can keep using it.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.