You can make a difference in the Apple Support Community!

When you sign up with your Apple ID, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

I have a virus on my MacBook, but I couldn't find it anywhere.

I have a virus on my MacBook, but I couldn't find it anywhere. There is no information about when and where this virus was downloaded.

Posted on Nov 18, 2023 6:14 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 19, 2023 5:34 AM

I have exactly the same issue for the past week. Can't find the culprit file. Can't remove the pop-up window that never disappears. Can't find any fix in the net with the similar issue until now.

35 replies

Nov 18, 2023 8:26 AM in response to John Galt

You're right, I'll explain it from the beginning.


There is a file, the name of the file is "ElemntStatefld", so it is clear that it is a fake file. A pop-up appears on my screen every 5-6 seconds and it says ""ElemntStatefld" will damage your computer." The download date is also unknown. It can't be found when I search in Finder.

Nov 18, 2023 9:26 AM in response to kyld

Maybe this isn't a scam, but from Apple's own built-in anti-malware facility (Gatekeeper):

https://malwaretips.com/blogs/will-damage-your-computer-mac/


Gatekeeper will apparently display this dialog either

  • If a file has a signature that matches a signature on Apple's malware list. (In this case, you're almost certain to be dealing with malware)

or

  • If a file is not signed by a trusted developer. That doesn't prove that the file is malware, but it might be a program from a malware developer, or it might be a legitimate program, that, unknown to its developer, has been modified by some malicious third party to infest it with malware.


Safely open apps on your Mac - Apple Support


"Alert that the app will damage your computer or the app is damaged


  • If macOS detects that software has malicious content or its authorization has been revoked for any reason, your Mac notifies you that the app will damage your computer.
  • If macOS detects that software has been modified or damaged, your Mac notifies you that the app can't be opened. The app might be broken or corrupted, or it might have been tampered with.
  • You should move this app to the Trash and, if available, check "Report malware to Apple to protect other users.""


Nov 18, 2023 11:55 AM in response to kyld

You will not find a file bearing that name anywhere on your Mac.


EtreCheck is likely to identify the cause. To learn how to post its report in a reply to this Discussion, please read How to use the Add Text Feature When Posting Large Amounts of Text, i.e. an Etrecheck Report - Apple Community. Actually removing the cause will require more assistance, so post that report and wait for an answer.


For some potentially helpful background information the following Discussion may be of interest to you:


A670DE6A-4EA5-4A65-B0E1-2077C9927B5E” will damage your computer. You should move it to the Trash. - Apple Community

Nov 18, 2023 9:15 AM in response to kyld

So do you actually have a file named "ElemntStatefld" on your computer? Or are you getting pop-up messages, in the upper-right hand corner of the screen saying "ElemntStatefld wlll damage your computer"?


If the latter, those are scam pop-up notifications sent by Web sites. The danger is from clicking on them - or from doing anything that the scammers who sent them are trying to get you to do.


"ElemntStatefld will damage your computer: seems a bit abstract compared to the more usual scam messages like "Your iCloud is being hacked!" or "Your computer is infected with 69 Trojan viruses!", but if the messages show up in this form, it may be a variation on the same scam.


See this User Tip by John Galt to settle their hash:

Stop unwanted Notifications - Apple Community


Dec 22, 2023 11:45 PM in response to ruquanda

ruquanda wrote:

have a virus on my MacBook, but I couldn't find it anywhere.
It suggests I contact Apple Support. No response


A message popped up and told you that you had a "virus" and to contact "Apple Support"?


You may have been lucky that you got "no response" when you called the alleged support number. Maybe the scammers were out on lunch break, or you called them "after hours" in their part of the world.


Stop unwanted Notifications - Apple Community

Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

Nov 18, 2023 6:51 AM in response to kyld

I have a virus on my MacBook, ...


There is no virus on your MacBook. There are no viruses that affect macOS. There have never been any viruses that affect macOS. There will never be a virus that affects macOS. Repeat as required.


Now, please start from the beginning and tell us how you came to draw that conclusion.

Nov 19, 2023 1:04 PM in response to kyld

But I think this isn't a scam. ...


If you are unwilling or unable to follow my instructions (quoted below) at least get rid of "Bitdefender". Rule 1 of Macs is don't install junk.


John Galt wrote:

You will not find a file bearing that name anywhere on your Mac.

EtreCheck is likely to identify the cause. To learn how to post its report in a reply to this Discussion, please read How to use the Add Text Feature When Posting Large Amounts of Text, i.e. an Etrecheck Report - Apple Community. Actually removing the cause will require more assistance, so post that report and wait for an answer.

For some potentially helpful background information the following Discussion may be of interest to you:

A670DE6A-4EA5-4A65-B0E1-2077C9927B5E” will damage your computer. You should move it to the Trash. - Apple Community


Following those instructions would have revealed the presence of "Bitdefender" as well as other potential causes.

Mar 12, 2024 2:43 PM in response to krystalyn7304

krystalyn7304 wrote:

I had the same thing pop up on my computer! I had 3 pop ups... creativemanager, litra, and something else... I was freaking out thinking it had to be a virus. Did you ever get this resolved?? My macbook is super old and I can't replace it. Any help would be great!


Please read the following, and post the three screenshots requested:


About those "<app> will damage your computer" messages - Apple Community.

Jul 15, 2024 9:23 AM in response to RandomStick

RandomStick wrote:

do you now what pin manager.incard is?


In what context? Some app or tool installed on your Mac? Something found when researching the “will damage” dialog that indicates that some janky malware is trying to get going on this Mac?


incard provide financial services, and do use PINs. For assistance with incard, contact incard support.


CAC and more recently PIV cards and other authentication tokens can involve related apps, when the authentication system is not using the built-in smart card authentication support within macOS. How those add-on apps might identify themselves and their related support wherever you’re finding this particular incard detail?


Use a smart card on Mac - Apple Support



If this is the “will damage” dialog from the rest of this thread and a seven-word query from some other context, please post the three screenshots requested in the following:


About those "<app> will damage your computer” messages - Apple Community




I have a virus on my MacBook, but I couldn&#39;t find it anywhere.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.