Unofficial archive. This is a read-only, community-run archive of the Apple Support Community. It is not affiliated with or endorsed by Apple Inc.

How do I determine if a virus or worm has been added to my OS System?

My Gmail account was compromised when I mistakenly clicked on an invite link. My e-mail contacts were compromised. How do I determine if a virus or worm was imbedded into my OS system? The rest of my laptop is working well. Would this be specifically targeted at my Gmail account?

5 replies

A compromised Gmail account does not, by itself, mean that a virus or worm was installed on your MacBook Pro. 


Someone who gained access to your Gmail account could also access your contacts without your Mac being infected.


Start by securing your Google account. 


From a device you trust, change your Google password and review your account’s security activity for unfamiliar devices or activity. 


Check Gmail for unauthorized forwarding, filters, delegation, or automatic replies, and review the third-party apps and services connected to your Google account. 


Remove anything you do not recognize, and enable two-step verification or a passkey if you have not already done so.


Google Account Security


Next, think about what happened after you clicked the invitation link. In particular, determine whether you downloaded or opened a file, installed an application or browser extension, entered your Mac administrator password, or approved a macOS security or privacy request. 


Those details are important because they help determine whether there is a reason to investigate the Mac further.


On the Mac, check System Settings >> General >> Login Items & Extensions and Applications for anything you do not recognize. 


Also check your browser's extensions and website permissions. An unfamiliar item is not necessarily malicious, so it should be identified before being removed.


Keep macOS and your browser up to date. 


Apple includes built-in malware protections such as XProtect, which receives automatic security updates. 


Apple explains these protections in its Platform Security documentation.


There is no single macOS check that can conclusively prove that a Mac is free of all possible malware. 


However, based on what you have described, there is no specific indication that a virus or worm was installed. Your Mac continuing to work normally also does not, by itself, prove or disprove an infection.


The Gmail and contact compromise therefore should not be taken as evidence that your Mac was infected or specifically targeted.

As den.thed has said there is there are no known viruses, i.e. self propagating, for Macs.  There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.   no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac.  This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.  



Anti Virus developers try to group all types as viruses into their ad campaigns of fear.  They do a poor job of the detecting and isolating the adware and malware.  Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.


There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and remove it.  The free version is more than adequate for most users.  


Unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they provide false security from a privacy standpoint.  Read these two articles: Public VPN's are anything but private and Security Risks: The Dangers of Using Free VPNs (eccu.edu).  


Additionally, a new study ("Apple Offers Apps With Ties to Chinese Military”) is specifically about VPN apps in Apple’s App Store.


The bottom line is don't use any of the so-called protection apps. The only exception is Malwarebytes.


There are no known "viruses" or "worms" that can infect macOS in the wild.

Hi,

macOS is protected by Gatekeeper, and it's installed at read only area of the drive, so it's quite hard to infect virus onto macOS system.


Thank you all for the great advice! Some of the things listed I have already done or do on a regular basis. Some items were new to me and I greatly appreciate the comments and suggestions!