4

I get a persistent pop-up window that states:
Apple wants to make changes. (See pic below)

Before I mindlessly press OK, I'd like to know what the action is about.

Can anyone suggest how I might find out more about what is involved?

  • No application appears to be involved by name.
  • The icon shows a "console" window inset over the locked padlock.
  • I was running Safari 11.1.2 build 12605.3.8.1 on macOS Sierra 10.12.6
  • It remained onscreen after I quit Safari.
  • It requires three cancels to cancel.
  • has recurred maybe half-a-dozen times in the last week.

Note: I have removed the user name which appears correctly for my account.

Apple changes pop-up window

UPDATE (Edit)

As per a suggestion in the comments, I ran Activity Monitor. It runs okay; but, I don't know what to look for so I tried all the variations I could think of without any Eureka moment.

Not very much later, I got this pop-up window asking for password permission to make changes. My User Name was right (erased from the screen-grab). Although the window identified the Activity Monitor as the application, there was no ? in the lower left corner for any more detail.

Activity Monitor changes pop-up window

I decided to click OK without password and it hated that. After a few tries, the window tried giving me my original password hint from the OS set-up. It took three "Cancel" clicks to go away. It hasn't recurred.

Meanwhile, the first anonymous "Apple wants… " pop-up window appears, from time to time, during Safari use. Occasionally, Safari becomes unstable and the main window closes.

UPDATE (Edit) Problem Resolved.

Today was a slow news day so I called Apple support who encouraged me to download and install Malwarebytes (Tip of the hat to them) which identified the location of suspicious files as similar to ones I found according to Apple Support discussion thread found in the answer given by Ashley.

The plist was a simple run-on-load and the other file was an executable and my unix is a bit…
non-existent.

The Files found were:
~/Library/Application Support/com.SearchProvided
~/Library/LaunchAgents/com.SearchProvided.plist

  • 2
    Apple pop up will have the name of the app asking, and mostly only ask for Password not the user name (if you are the only user) – Ruskes Sep 20 '18 at 22:25
  • I would be tempted to use Activity Monitor to see if you can nail down what process is doing this. It sounds a little off to me... – Steve Chambers Sep 21 '18 at 13:05
  • fs_usage might be helpful as well. – user136952 Sep 21 '18 at 22:55
  • 1
    You can also try running Malwarebytes (just the free mode is required) or other malware identification software and see if anything comes up. – Ezekiel Elin Sep 24 '18 at 19:29
  • I hope my curiosity is not dooming me to unrelieved future problems. Having never had any virus or previous malware experience, I might be pulling the tail of the tiger unwittingly. – Stan Oct 6 '18 at 0:33
1

There's a mention of "Apple wants to make changes" in this Apple discussions thread. Someone there ran Malwarebytes, which found "Adware.OperatorMac", and mentions the following files:

~/Library/Application Support/com.SearchSystem
~/Library/LaunchAgents/com.SearchSystem.plist

So, if you have those files, that would seem a good place to find out more.

I don't have 10.12.6 installed at the moment, but I do have machines running 10.11.6 and 10.13.6. I don't have those files on either machine, so they aren't part of a standard install.

If you do have these files, perhaps you could post their contents as an update?

  • Thanks for the tip. I do not have these files in my user/Library folder. – Stan Oct 2 '18 at 17:39
  • I do have "SearchProvided" in those paths, which is quite similar, however, and more than a bit suspicious due to the similarity. – Stan Oct 6 '18 at 0:29
  • OK. I don't have those files on my 10.13.6 machine (I don't have time to check the other right now). They do sound suspicious (I think "SearchSystem" isn't an Apple term - they tend to use "Spotlight" in marketing, "MD" for metadata as a more technical term). Can you have a look at their contents (eg try dragging them onto TextEdit.app) and edit your question to explain your results? Then we can advise about what action to take. – Ashley Oct 6 '18 at 10:02
  • Oh - another idea - do the dates on the files give you a clue as to how they might have been introduced? (Eg do you remember downloading / installing something at that time?) The dates can be inaccurate, particularly if this software is trying to cover it's tracks, but it's worth a look... – Ashley Oct 6 '18 at 10:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .