October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
Cupertino desk4 min

How to Remove Malware from a Mac: A Safe, Step-by-Step Guide

Learn how to respond to suspected Mac malware, remove an unwanted app, troubleshoot startup behavior in Safe Mode, and avoid an unnecessary wipe.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If you suspect malware on your Mac, don’t open the suspicious item again. Update macOS, remove any app you can identify as unwanted using its own uninstaller when available, and use Safe Mode to investigate problems that recur at startup. Reserve erasing the Mac for a severe, persistent case: it deletes information and requires a backup and instructions for your specific Mac.

What macOS can do—and what it cannot guarantee

Apple says macOS includes XProtect, built-in antivirus technology for signature-based malware detection and removal. XProtect is part of several protections: Gatekeeper and notarization help prevent untrusted software from launching, and XProtect can block known malware and remediate some malware that has run. These safeguards are substantial, but Apple does not promise that they detect every threat. Apple Platform Security: Protecting against malware in macOS

As an Amazon Associate I earn from qualifying purchases.

On macOS 10.15 and later, XProtect checks for known malicious content when an app launches for the first time, when the app changes in the file system, and when its signatures update. Apple says signature updates are independent of macOS system updates and that macOS checks for them daily by default; that means a daily check, not necessarily a new signature set every day. When XProtect detects known malware, Apple says it blocks it, moves it to the Bin, and alerts the user in Finder. XProtect can also receive updated threat information and perform later remediation checks; it does not automatically restart the Mac.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Follow a safe removal sequence

1. Don’t launch the suspicious item again

If the concern is an unexpected app attached to a message or file, don’t open it. Apple advises deleting unexpected app attachments. Avoid downloading unlicensed or pirated software, and use trusted sources for apps. Apple Support: Protect your Mac from malware

#1 Best Overall
Sale
McAfee Total Protection 2027 Antivirus Software for 3 Devices | Auto-Renews
  • THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
  • PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
  • SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
  • GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
  • MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.

2. Check for macOS updates

Open the Apple menu, choose System Settings, then General > Software Update, and install any update offered for your Mac. The exact screen can vary by macOS release. Keeping macOS updated is one of Apple’s recommended precautions. System updates and XProtect signature updates are distinct: XProtect signatures can update independently.

3. Uninstall an app you have identified as unwanted

  1. Quit the app. If it will not close, restart the Mac before trying again.
  2. Look for its uninstaller. In Finder, check the app’s folder—often in Applications—or look within the app for an uninstall or removal feature. For a non-Apple app, Apple recommends using its own uninstaller when available because related login items, extensions, or other files may be stored elsewhere.
  3. If there is no uninstaller, move the app to the Trash. Find it in Finder, usually in Applications or your user’s Applications folder, and drag it to the Trash. Provide an administrator password if prompted. Do not try to remove software required by macOS or items in the System folder.
  4. Empty the Trash only when you are sure. Check that you have selected the unwanted app rather than documents or other files you need.

Deleting an app does not remove documents you created with it or cancel a subscription. If Finder says the app is in use, make sure it is closed; if needed, restart or try Safe Mode before removing it. Apple Support: Delete or uninstall apps on Mac

Rank #2
Sale
McAfee Total Protection 2027 Antivirus Software for 5 Devices | Auto-Renews
  • THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
  • PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
  • SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
  • GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
  • MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.

Use Safe Mode for problems that return at startup

Safe Mode is a troubleshooting aid for problems that may be caused by software loaded when the Mac starts. It is not a malware scanner. First identify your processor: open the Apple menu and choose About This Mac. If it says Chip, the Mac has Apple silicon; if it says Processor, it has an Intel processor. Labels and steps may differ slightly by macOS release and hardware. Apple Support: Start your Mac in safe mode

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Apple silicon Mac

  1. Shut down the Mac.
  2. Press and hold the power button until the startup options appear.
  3. Select a startup volume.
  4. Hold Shift, then choose Continue in Safe Mode.

Intel Mac

  1. Start or restart the Mac.
  2. Immediately press and hold Shift until the login window appears.

Apple says “Safe Boot” should appear at login. You can also open System Information and check whether Boot Mode is listed as Safe. If the unwanted behavior stops in Safe Mode, that is useful diagnostic evidence, but it does not by itself identify which software caused the problem.

Rank #3
Sale
Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]
  • ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
  • TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
  • ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
  • REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
  • DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.

Review login items and extensions without guessing

If an app or behavior returns when you log in, open System Settings > General > Login Items & Extensions. Review the items and disable or remove one only if you recognize it as unwanted or can verify that it is related to the problem. An unfamiliar login item or third-party extension is not proof of malware. If a known unwanted app installed an item or extension, its uninstaller may remove associated components more completely. Apple Support: Change Login Items & Extensions settings on Mac

When an erase and reinstall may be justified

Erasing is a high-impact recovery step, not the first response to a vague symptom or a browser pop-up. Consider it only for a severe or persistent problem when less destructive steps have not resolved the issue. Erasing deletes information, so back up important data first and follow instructions that match the Mac’s hardware and macOS release.

Rank #4
Sale
Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]
  • ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
  • TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
  • ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
  • REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
  • DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.

Apple’s cited erase-and-reinstall procedure applies to Intel Macs without the Apple T2 Security Chip; it does not cover Apple silicon Macs or Intel Macs with a T2 chip. Identify your Mac model before proceeding and use the applicable Apple instructions rather than applying that procedure to a different Mac. Apple Support: Erase and reinstall macOS

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Reduce the chance of another infection

  • Install available macOS updates.
  • Download apps only from sources you know and trust; avoid unlicensed or pirated software.
  • Delete unexpected app attachments rather than opening them.
  • Where practical, limit administrator accounts and use a standard account for everyday work.

These steps reduce risk; they cannot guarantee that malware will never reach a Mac.

Best Value
Sale
Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]
  • ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
  • TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
  • ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
  • REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
  • DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.