I get a persistent pop-up window that states:
Apple wants to make changes. (See pic below)
Before I mindlessly press OK, I'd like to know what the action is about.
Can anyone suggest how I might find out more about what is involved?
- No application appears to be involved by name.
- The icon shows a "console" window inset over the locked padlock.
- I was running Safari 11.1.2 build 12605.3.8.1 on macOS Sierra 10.12.6
- It remained onscreen after I quit Safari.
- It requires three cancels to cancel.
- has recurred maybe half-a-dozen times in the last week.
Note: I have removed the user name which appears correctly for my account.
As per a suggestion in the comments, I ran Activity Monitor. It runs okay; but, I don't know what to look for so I tried all the variations I could think of without any Eureka moment.
Not very much later, I got this pop-up window asking for password permission to make changes. My User Name was right (erased from the screen-grab). Although the window identified the Activity Monitor as the application, there was no ? in the lower left corner for any more detail.
I decided to click OK without password and it hated that. After a few tries, the window tried giving me my original password hint from the OS set-up. It took three "Cancel" clicks to go away. It hasn't recurred.
Meanwhile, the first anonymous "Apple wants… " pop-up window appears, from time to time, during Safari use. Occasionally, Safari becomes unstable and the main window closes.
UPDATE (Edit) Problem Resolved.
Today was a slow news day so I called Apple support who encouraged me to download and install Malwarebytes (Tip of the hat to them) which identified the location of suspicious files as similar to ones I found according to Apple Support discussion thread found in the answer given by Ashley.
The plist was a simple run-on-load and the other file was an executable and my unix is a bit…
The Files found were: