Skip to main content

Remove “MacPerformance” can’t be opened..." virus from Mac


Learn how to treat the “MacPerformance wants access …” popup alerts, what their origin is, and how to prevent these dialogs from being displayed on Mac.

Update: October 2019

Given Apple’s well-orchestrated control over the software that can reach Mac desktop computers and laptops, cybercriminals are bound to look for intricate workarounds to lay their hands on Macs. One of these techniques that splashed onto the scene just recently involves several layers of attack. First, the malefactors employ app bundling to deposit common adware onto the host. This potentially unwanted program isn’t particularly harmful and cannot obtain any significant permissions on the infected Mac, with its impact being restricted to triggering popup alerts that say, “MacPerformance wants access to control Safari / Google Chrome”. Now, these dialogs are the ones that attempt to expand the attack surface beyond the annoyance effect only.

“MacPerformance wants access …” popup requesting control over Chrome on Mac

At this point, the right question to ask is: what is MacPerformance? It sounds both trustworthy and fishy at the same time. Once you dig a bit deeper in the affected macOS, it turns out to be an application that sits under the Library path in home folder. The subdirectories where its components can be found include LaunchAgents and UpdateMac, and Preferences. With the name being kind of appealing, the behavior of this item raises a few red flags and is a giveaway. Regular applications don’t need and won’t ask for the scope of privileges that MacPerformance is after. Here are the details on the requested access expressed in the noxious popups: “Allowing control will provide access to documents and data in Google Chrome / Safari, and to perform actions within that app.” Note the editorial slash in the above citations – the MacPerformance malware can poison either web browser. Furthermore, it’s most likely to support Firefox, too.

MacPerformance app in infected Mac’s home folder

Ultimately, the malicious code tries to get its privileges escalated to the extent where it can spy on and literally steal all of the victim’s web browsing data, including visited sites, bookmarked pages, as well as authentication information (usernames and passwords). With such an unrestricted access at their disposal, the crooks behind the MacPerformance virus can pull off identify theft, compromise one’s online banking account, and conduct phishing campaigns.

In addition to the info-stealing foul play, MacPerformance abuses the obtrusively obtained permissions to deploy annoying popup activity in the affected browser. It redirects the victim’s web sessions to rogue websites hosting deceptive popup ads. A common type of these faux alerts is about an alleged infestation of the computer with malicious programs. It says, “Your Mac is infected with 3 viruses”, urging the victim to scan their system immediately. If the pseudo online scan is launched, it returns scary-looking results about severe threats running in the background. The goal of this brainwash is to promote a scareware application which, if installed, will be getting on the unsuspecting user’s nerves until they purchase the worthless product license.

Yet another obnoxious shade of the MacPerformance virus started manifesting itself since late October 2019. Lots of users have been getting popup notifications that say, “MacPerformance” can’t be opened because Apple cannot check it for malicious software.” The dialog also reads, “This software needs to be updated. Contact the developer for more information”. Obviously, since the app is malicious and comes from an uncertified source, the victims can neither run the requested update nor reach out to the publisher for troubleshooting. This also means that the notifications will continue to appear, only to repeatedly interrupt the perplexed users’ computing and make a mess of their Mac experience overall.

'MacPerformance can’t be opened’ popup alert

The most likely cause of these alerts is that the recent macOS update has changed the way the system treats third-party apps. In particular, the entities that cannot be verified or checked for malicious behavior end up being blocked, with the Mac notifying the user about this. As commendable as it is, this policy turns out to have a flip side: it drags many people into a loop of irksome splash screens that won’t go away until the MacPerformance threat is removed.

Zooming out, one of the interesting things about these irritating popups is that although they contain the “Don’t Allow” and “OK” buttons, selecting the former won’t stop the adverse activity in its tracks. The alerts will continue to appear regardless. In order to get them out of your sight, you need to get rid of the MacPerformance virus. The problem might be that its fragments are dispersed across macOS, and it may be quite challenging to find them all. The walkthrough below can help thoroughly locate the traces of this culprit and eradicate them to fix the issue.


MacPerformance virus manual removal for Mac

The steps listed below will walk you through the removal of this malicious application. Be sure to follow the instructions in the order specified.

• Open up the Utilities folder as shown below

Open up the Utilities

• Locate the Activity Monitor icon on the screen and double-click on it

Locate the Activity Monitor

• Under Activity Monitor, find the entry for MacPerformance or other suspicious one, select it and click Quit Process

• A dialog should pop up, asking if you are sure you would like to quit the troublemaking process. Select the Force Quit option

• Click the Go button again, but this time select Applications on the list. Find the entry for MacPerformance on the interface, right-click on it and select Move to Trash. If user password is required, go ahead and enter it

Malicious app icon under Applications

• Now go to Apple Menu and pick the System Preferences option

Pick the System Preferences

• Select Accounts and click the Login Items button. The system will come up with the list of the items that launch when the computer is started up. Locate MacPerformance or other potentially unwanted app there and click on the “-“ button


Get rid of “MacPerformance wants access …” popups in web browser

To begin with, settings for the web browser that got hit by the MacPerformance virus should be restored to their default values. The overview of steps for this procedure is as follows:

1. Reset Safari

• Open the browser and go to Safari menu. Select Preferences in the drop-down list

Go to Preferences in Safari

• Once the Preferences screen appears, hit the Privacy tab at the top. Find the option that says Remove All Website Data and click on it

Remove All Website Data option under Privacy

• The system will display a confirmation dialog that also includes a brief description of what the reset does. Specifically, you may be logged out of some services and encounter other changes of website behavior after the procedure. If you’re okay with that, go ahead and click the Remove Now button

Confirmation dialog

• In order to selectively clear data generated by certain websites only, not all of them, hit the Details button under the Privacy section of Safari Preferences

Clear data for specific websites in Safari

• This feature will list all websites that have stored potentially sensitive data, including cache and cookies. Select the one, or ones, that might be causing trouble and click the appropriate button at the bottom (Remove or Remove All). Click the Done button to exit.

2. Reset Google Chrome

• Open Chrome and click the Customize and Control Google Chrome menu icon

• Select Options for a new window to appear

• Select Under the Hood tab, then click Reset to defaults button

Reset Chrome

3. Reset Mozilla Firefox

• Open Firefox and select HelpTroubleshooting Information

• On the page that opened, click the Reset Firefox button

Reset Firefox


Get rid of MacPerformance malware using Combo Cleaner removal tool

The Mac maintenance and security app called Combo Cleaner is a one-stop tool to detect and remove “MacPerformance” can’t be opened..." virus virus. This technique has substantial benefits over manual cleanup, because the utility gets hourly virus definition updates and can accurately spot even the newest Mac infections.

Furthermore, the automatic solution will find the core files of the malware deep down the system structure, which might otherwise be a challenge to locate. Here’s a walkthrough to sort out the “MacPerformance” can’t be opened..." virus issue using Combo Cleaner:

  1. Download Combo Cleaner installer. When done, double-click the combocleaner.dmg file and follow the prompts to install the tool onto your Mac.

    Download Combo Cleaner

    By downloading any applications recommended on this website you agree to our Terms and Conditions and Privacy Policy. The free scanner checks whether your Mac is infected. To get rid of malware, you need to purchase the Premium version of Combo Cleaner.

  2. Open the app from your Launchpad and let it run the update of malware signature database to make sure it can identify the latest threats.
  3. Click the Start Combo Scan button to check your Mac for malicious activity as well as performance issues.

    Combo Cleaner Mac scan progress

  4. Examine the scan results. If the report says “No Threats”, then you are on the right track with the manual cleaning and can safely proceed to tidy up the web browser that may continue to act up due to the after-effects of the malware attack (see instructions above).

    Combo Cleaner scan report – no threats found

  5. In case Combo Cleaner has detected malicious code, click the Remove Selected Items button and have the utility remove “MacPerformance” can’t be opened..." virus threat along with any other viruses, PUPs (potentially unwanted programs), or junk files that don’t belong on your Mac.

    Combo Cleaner – threats found

  6. Once you have made doubly sure that the malicious app is uninstalled, the browser-level troubleshooting might still be on your to-do list. If your preferred browser is affected, resort to the previous section of this tutorial to revert to hassle-free web surfing.

FAQ

11

Was this article helpful? Please, rate this.

There are no comments yet.
Authentication required

You must log in to post a comment.

Log in