How to Scan for Viruses and Malware on a Mac

Concerned about an unfamiliar app, repeated pop-ups, or a suspicious download? Start with a malware scan, then use the checks below to investigate the app and its permissions.

MacKeeper Antivirus lets you scan your Home folder or select files for a closer check. Review any detection before removing it; a performance symptom alone does not prove infection.

Choose the Check That Matches Your Concern

A “virus scan” can mean two different things on a Mac. macOS checks apps and known threats automatically through Gatekeeper, notarization, and XProtect.

A separate antivirus app can run an on-demand scan of selected files or folders. Neither option guarantees that every possible threat will be found.

If you only saw an alarming message in a browser tab, close the tab without calling its number or installing its software. If you downloaded a suspicious file, don’t open it.

Check its source and use a trusted scanner if needed. If you entered a password on a suspicious site, change it from a separate trusted device and review the account’s active sessions.

The checks below help you investigate permissions and resource use. They don’t replace a file scan. See Apple’s built-in malware protections for the role of each security layer.

How to Check Your Mac for Malware

These three checks can help you investigate activity and permissions, but none is a full malware scan on its own. Apple explains how Gatekeeper, notarization, and XProtect protect against malware.

1. Use Activity Monitor to Investigate Resource Use

Activity Monitor shows which processes are running and how much of your Mac’s resources they use. It doesn’t scan files or tell you whether a process is malware.

Use it when an app is slow, the fan is loud, or one process keeps using resources after the related task ends.

1. Press Command ⌘ + Space, search for Activity Monitor, then open it. You can also find it in Applications > Utilities.
2. Choose CPU, then click the % CPU column to sort by processor use. Click again if the highest values aren’t at the top.
3. Look for sustained activity that matches the symptom you noticed. Short spikes can be normal during updates, video calls, indexing, and exports.
4. If you need more context, select the process and use the information button. Verify the related app and its developer before changing anything.

12

Don’t force-quit an unfamiliar process just because it appears near the top. Closing a process doesn’t uninstall its app or remove malware, and stopping a system process can interrupt your work.

If a trusted security alert names a file or app, follow the alert and the developer’s removal instructions instead.

For a performance problem without a security alert, follow our slow Mac troubleshooting steps. Apple’s Activity Monitor guide explains the CPU and memory views.

2. Review Full Disk Access Permissions

Full Disk Access lets an app read a broad range of files, including data from other apps and Time Machine backups. This list is a permissions review, not a malware scan.

A legitimate backup or security app may need this access. Revoke it only when you do not recognize or trust the app.

1. Click the Apple logo and select System Settings.

2. In System Settings, click the Privacy & Security tab and in the Privacy section, click Full Disk Access.

3. Review the list against apps you intentionally installed. An unfamiliar entry deserves investigation, but does not by itself prove that the app is malicious.

4. If you confirm an app should not have this access, turn off its switch. This limits future access; it does not uninstall the app or reverse access it already had.

3. Review Login Items You Do Not Recognize

A login item starts or runs in the background when you sign in. Review one if an unwanted app keeps returning, but remember that many login items belong to apps you use.

Removing one can disable that app’s background features. See how to manage login items on your Mac.

1. Click the Apple icon and select System Settings.

2. Select General > Login Items & Extensions (called Login Items on some older versions). Check the app or developer before changing background activity.

3. If you recognize an app you no longer want to open at login, select it and use the remove button under “Open at Login.” For an unexplained background item, verify its source before turning it off.

4. Restart only if needed to confirm a change. Removing a login item does not scan for or remove malware.

Scan Your Mac With MacKeeper Antivirus

Check suspicious files with MacKeeper Antivirus. Its Home-folder scan helps you review common file locations, while a custom scan targets a file or folder you want to investigate.

1. Get MacKeeper from its official offer page, install it, and open Antivirus.
2. Start a scan of your Home folder, or choose a custom scan for the file or folder that concerns you.
3. Review each detected item and follow MacKeeper’s removal or quarantine instructions.

MacKeeper may request Full Disk Access to check additional locations. Confirm that you installed the genuine app before granting access; keep macOS updated and review detections carefully.

See the MacKeeper Antivirus instructions for the controls in your installed version.

How Can You Tell Whether Your Mac Has Malware?

These symptoms can have causes unrelated to malware. Treat them as reasons to investigate, not as proof of infection:

• Unexplained disk activity has many possible causes. Check which app is using the disk before treating it as a malware clue.
• A slow Mac can have many causes, such as a busy app, low storage, or an update. Slowness alone does not indicate malware.
• Unexpected pop-ups can come from websites, notifications, or unwanted software. Identify which app or site shows them before deciding what to remove.
• Unexpected behavior can result from software bugs or settings as well as malware. Note what changed and which app is involved.
• Read the alert and verify that it comes from macOS or a security app you installed. Do not click links in a browser pop-up claiming your Mac is infected.

Keep Your Mac Protected

macOS’s built-in protections update and check in the background. If a scan identifies a threat, follow the scanner’s remediation steps and the alert’s guidance; do not assume a clean scan proves that no threat exists.

Keep macOS and your apps updated. Review any detected item before removing it, and get help from Apple Support or the software developer if you are unsure.

Clearing caches or deleting unrelated files is not a malware scan.

Frequently Asked Questions

Affiliate disclosure: MacBook Journal may earn a commission when you buy through links on this page, at no extra cost to you.