Member Avatar for rossdungey

Hi all, last night I had a pop up pop up to ask me if I wanted to download something to scan my computer for spyware. I said no, and the windo closed but noticed later that a file had been downloaded to my desktop. It was a GoLive file. I checked the download manager and it had downloaded about the time I closed the pop up window. I didn't click on it and deleted it immediately. Is this enough? I googled the name and its amaena securityworm666. Does anyone know what it is, and how I can get ride of it?

Ross.

  • 2 Contributors
  • 4 Replies
  • 114 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rossdungey

Dani AI

Generated

Useful follow-up for that builds on the points raised.

This kind of "scan your PC" popup is usually scareware that tries to drop something and trick you into running it. Because you deleted the file without opening it the immediate risk is low, but do a quick verification so nothing was left behind. In Finder select the file (or check ~/Downloads) and use Get Info to confirm the filename and extension. If it is a Windows binary (.exe, .scr, .pif) it will not run natively on macOS; if it is a disk image (.dmg) or an application bundle (.app) treat it as executable and remove it and any mounted images, then empty the Trash.

Do these system checks next: clear the browser Downloads list and cache, remove any unfamiliar browser extensions, and enable the popup blocker. Open Activity Monitor to look for strange CPU or network activity. Inspect Login Items (System Preferences -> Accounts/Users & Groups) and the common startup folders (~/Library/LaunchAgents, /Library/LaunchDaemons, /Library/StartupItems) for recently added items — if you find something you do not recognize, move it to a safe quarantine folder (external drive) rather than deleting immediately so you can restore if needed. Run an up-to-date Mac-aware scanner (ClamXav, Sophos Home or another reputable tool) to be thorough.

Preventive notes: disable Javascript or use script-blocking extensions on untrusted sites, keep macOS and browsers patched, and avoid interacting with popup buttons (use Force Quit or quit the browser if a window is unresponsive). Because you mentioned a GoLive icon, check the extension not the icon — file associations can be misleading. If unusual behavior persists after these steps (new login items, unexplained network traffic, or high CPU), collect logs and contact Apple or a trusted Mac security vendor for targeted help.

Recommended Answers

All 4 Replies

Member Avatar for John A

Hi all, last night I had a pop up pop up to ask me if I wanted to download something to scan my computer for spyware. I said no

Never click a "no" button on a popup, just close the window... the "no" button was probably linked the file.

As for the file, I'd say if you never opened it up, you're fine. The fact that you're on OS X means it probably can't even run, as I believe this worm is written only for Windows.

Member Avatar for rossdungey

Thanks. I tried first to close the window, but the 'red button' to close the window was grey (not able to be selected) so didn't allow that option. Crafty people!

Member Avatar for John A

I tried first to close the window, but the 'red button' to close the window was grey (not able to be selected) so didn't allow that option. Crafty people!

It's a little Javascript trick. Safari doesn't, but many other browsers have the option of disabling the use of graying out the close button on a window. If it ever happens again, you can try choosing File->Close Window, or just save your work and quit the web browser to close the window.

Member Avatar for rossdungey

Thanks again Joe. That's very helpful. Have a good one, Ross.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.