Is My Mac Infected?
How to Check, Safely and Free

Yes, Macs Get Malware — Just Not the Kind You're Picturing

Apple's own security documentation is blunt about it: macOS includes built-in antivirus technology, and Apple keeps it updated, because malware written for the Mac exists. The old line about Macs being immune was never quite true. But the trouble I actually find on Macs is almost never a dramatic, file-stealing virus. It's adware — software that hijacks your web browser to push ads and phony search results at you — and it usually got in because someone clicked “Allow” or “Install” on a page that looked official.

That's good news twice over. Adware is noisy, so you can spot it. And it hides in places you can look at yourself: your Applications folder, your browser's extensions, your search settings, configuration profiles, and the short list of things allowed to start themselves. Everything below visits one of those places. None of it costs money, none of it requires handing your Mac to a stranger, and the one rule underneath all of it is simple — a message telling you you're infected is not evidence that you are. A website cannot scan your Mac. Not one of them, not ever.

Real Warning Signs — and the Ones That Are Nothing

• Worth checking: your search engine changed by itself — results come from a name you never picked.
• Worth checking: your homepage or new-tab page changed without you doing it, or keeps changing back.
• Worth checking: ads where ads never were, or ordinary words on a page turned into links.
• Worth checking: pop-up windows that keep coming back after you close them — especially with a countdown or a phone number.
• Worth checking: a toolbar, a browser button, or an app you never installed, in the browser, the Dock, or the menu bar.
• Worth checking: a profile under System Settings > General > Device Management on a personal Mac nobody manages.
• Not malware: it's slower than it used to be. Age, a full startup disk, and a pile of self-starting apps all do that on their own.
• Not malware: the spinning beach ball. That's one app being busy or stuck — a traffic light, not a diagnosis.
• Not malware: banners in the top-right corner selling things. Those are website notifications you once clicked “Allow” on.
• Not malware: ads that follow you between websites, or a brand-new Mac running warm for a day or two while it indexes.
• One warning sign is a nudge. Three together — especially three browser ones — means something moved in.

What's Already Protecting You (You Don't Need to Buy Antivirus)

Your Mac came with security software, it's already running, and it updates itself without ever asking for a credit card. Apple describes three layers. Gatekeeper and notarization are the front door: apps from the internet are supposed to be sent to Apple, scanned, and stamped before macOS will run them — and Apple can revoke that stamp later if an app turns out to be malicious. XProtect is the built-in scanner: signature-based detection and removal of known malware, with signatures Apple updates quietly and often, separately from the big macOS updates. Apple's documentation notes XProtect also includes technology to remove infections once it knows about them — which is exactly why Apple's own first advice for a Mac plagued by pop-ups is to update macOS, and if it's already up to date, simply restart. It sounds too simple. It's genuinely step one.

The Check, One Screen at a Time

1. Update and restart. Apple menu > System Settings > General > Software Update. Install anything waiting, then restart on purpose — macOS removes known malware as part of starting up.
2. Walk your Applications folder. Finder > Go > Applications. Read every name. Anything with Cleaner, Optimizer, Booster, Doctor or Tune in the name that you didn't choose deserves a hard look. Drag strangers to the Trash and empty it.
3. Check browser extensions. In Safari: Safari menu > Settings > Extensions. Select anything unfamiliar and click Uninstall. Not sure? Untick it instead. Do this in every browser on the Mac, not just your usual one.
4. Put your search engine back. Safari > Settings > Search, and pick the one you want. Then the General tab for your homepage and new-tab page.
5. Shut off pop-ups and notifications. Safari > Settings > Websites > Pop-up Windows: set other websites to Block and Notify. Then Notifications: remove sites you don't want banners from. In the Security tab, tick “Warn when visiting a fraudulent website.”
6. Look for a rogue profile. System Settings > General > Device Management (see below).
7. Check what starts itself. System Settings > General > Login Items & Extensions. Remove leftovers from anything you just deleted — the minus sign takes it off the list without deleting the app.
8. Restart once more, and write down the date you did all this.

The Hiding Place Almost Nobody Checks: Configuration Profiles

A configuration profile is a settings file that employers and schools use to manage Macs. It can set a homepage, force a search engine, install extensions — and lock those choices so you can't change them back. Junk software learned to install profiles too, which is why a hijacked homepage sometimes reappears no matter how many times you fix it. To look: Apple menu > System Settings > General, scroll down, and find Device Management (older versions of macOS call the same item Profiles). Here's the reassuring part — Apple's documentation says that pane only appears when a profile is actually installed. If it isn't listed at all, you're clear. If it is there, read what's listed, and remove anything you don't recognize with the minus sign. One caution first: if this Mac is managed by an employer or a school, removing a legitimate profile deletes everything it set up — Apple gives the example of an email account vanishing along with the profile that created it. Personal Mac, unrecognized profile? Remove it. Any chance it's official? Ask first.

A Free Second Opinion — and the Scanners to Skip

If you've done the checks and still feel uneasy, a second opinion is fair. Malwarebytes offers a genuinely free Mac scanner from a real company with a long track record. The download matters more than the app: type malwarebytes.com into the address bar yourself, and never click a download link from an ad or a pop-up. Open it, click Scan, review what it finds, restart — then quit it. You don't need a second always-on guard layered over the one Apple already runs. What you should skip is the whole “cleaner” and “optimizer” category — MacKeeper is the name most folks know, but the pattern matters more than any single brand: a frightening count of “issues found” that are mostly cache and log files your Mac keeps on purpose, an auto-renewing subscription, and a program that must run constantly in order to nag you. That business model isn't just my gripe, either. In 2024 two “PC repair” operations agreed to pay $26 million to settle FTC charges over fake pop-up warnings and cleanup software sold with scare tactics — and the FTC said plainly that older consumers were hit hardest. If one is already installed, use its own Uninstaller, check profiles and login items for leftovers, and then cancel the subscription separately. Deleting the app does not stop the billing.

If the Screen Is Yelling at You Right Now

• Don't call the number. Apple does not put phone numbers in warning messages, and does not cold-call customers. That page is an advertisement with sound effects — it knows nothing about your Mac.
• Try Command + W to close the tab. If it won't close, quit the browser outright: Apple menu > Force Quit… > select Safari or Chrome > Force Quit.
• Hold Shift while reopening the browser so it doesn't restore that page.
• Never allow remote access to anyone who contacted you. That request is the entire scam in one sentence.
• Never pay by gift card, wire, or cryptocurrency. Nobody legitimate, ever, no exceptions.
• Already called or paid? Disconnect from Wi-Fi if someone is connected, call your bank, change your Apple Account password, and tell one person the same day. You're not the first and you're not foolish — these are built by professionals.

If Something Was Found, Close the Door Behind It

Removing the software is the first half. The second half is assuming, calmly, that whatever was on there may have watched you type for a while — the same reflex as changing the locks after losing a key. Restart and run one more scan to confirm it comes back clean. Change your Apple Account password (System Settings > your name > Sign-In & Security), then your email password, because email is the master key that resets everything else. Then your bank and anything with a card on file. Turn on two-factor authentication wherever it's offered. Watch your statements for two months. And don't do six passwords in one evening — that's how people lock themselves out of everything at once. Apple Account and email tonight; the rest over the week.

What's in the 27-page PDF

• The honest picture — what Mac malware really is, and why adware is what you'll actually meet
• The whole check in six checkboxes, plus the two things never to do
• Real warning signs vs. the “symptoms” that are just a Mac being a Mac
• How adware gets in: fake updates, bundled installers, and the password prompt that deserves a pause
• Gatekeeper, notarization and XProtect explained in plain English — and why Apple's first advice is “restart”
• The Applications folder walk-through, with the app names that deserve a hard look
• Browser extensions in Safari, Chrome, Edge and Firefox — and what to do when one won't uninstall
• Putting your search engine, homepage, pop-up blocking and notifications back the way you like
• Configuration profiles: the hiding place almost nobody checks, and when NOT to remove one
• Login items and background items — catching the leftovers safely
• The free Malwarebytes second opinion, done safely, and the “cleaner” trap with the FTC's $26M case
• A symptom reference table, a refrigerator checklist, kitchen-table Q&A, a glossary, and a fill-in cheat sheet

Why I wrote this

“I thought Macs couldn't get viruses” has started more of my house calls than any other sentence. The honest answer is that Macs get less of it, come with real protection built in, and still get plenty of the junk that matters — and that most of the people who call me worried turn out to be fine. That's why I'd rather you had this in writing than paid a “cleaner” app rent for worry it created itself. I write these guides as printable handouts so the checklist can sit next to the Mac. If you'd rather do it with company, that's a flat $99 visit with a 30-day follow-up included. — Bill