Learn how to treat the “MacPerformance wants access …” popup alerts, what their origin is, and how to prevent these dialogs from being displayed on Mac.
Update: October 2019
Given Apple’s well-orchestrated control over the software that can reach Mac desktop computers and laptops, cybercriminals are bound to look for intricate workarounds to lay their hands on Macs. One of these techniques that splashed onto the scene just recently involves several layers of attack. First, the malefactors employ app bundling to deposit common adware onto the host. This potentially unwanted program isn’t particularly harmful and cannot obtain any significant permissions on the infected Mac, with its impact being restricted to triggering popup alerts that say, “MacPerformance wants access to control Safari / Google Chrome”. Now, these dialogs are the ones that attempt to expand the attack surface beyond the annoyance effect only.
At this point, the right question to ask is: what is MacPerformance? It sounds both trustworthy and fishy at the same time. Once you dig a bit deeper in the affected macOS, it turns out to be an application that sits under the Library path in home folder. The subdirectories where its components can be found include LaunchAgents and UpdateMac, and Preferences. With the name being kind of appealing, the behavior of this item raises a few red flags and is a giveaway. Regular applications don’t need and won’t ask for the scope of privileges that MacPerformance is after. Here are the details on the requested access expressed in the noxious popups: “Allowing control will provide access to documents and data in Google Chrome / Safari, and to perform actions within that app.” Note the editorial slash in the above citations – the MacPerformance malware can poison either web browser. Furthermore, it’s most likely to support Firefox, too.
Ultimately, the malicious code tries to get its privileges escalated to the extent where it can spy on and literally steal all of the victim’s web browsing data, including visited sites, bookmarked pages, as well as authentication information (usernames and passwords). With such an unrestricted access at their disposal, the crooks behind the MacPerformance virus can pull off identify theft, compromise one’s online banking account, and conduct phishing campaigns.
In addition to the info-stealing foul play, MacPerformance abuses the obtrusively obtained permissions to deploy annoying popup activity in the affected browser. It redirects the victim’s web sessions to rogue websites hosting deceptive popup ads. A common type of these faux alerts is about an alleged infestation of the computer with malicious programs. It says, “Your Mac is infected with 3 viruses”, urging the victim to scan their system immediately. If the pseudo online scan is launched, it returns scary-looking results about severe threats running in the background. The goal of this brainwash is to promote a scareware application which, if installed, will be getting on the unsuspecting user’s nerves until they purchase the worthless product license.
Yet another obnoxious shade of the MacPerformance virus started manifesting itself since late October 2019. Lots of users have been getting popup notifications that say, “MacPerformance” can’t be opened because Apple cannot check it for malicious software.” The dialog also reads, “This software needs to be updated. Contact the developer for more information”. Obviously, since the app is malicious and comes from an uncertified source, the victims can neither run the requested update nor reach out to the publisher for troubleshooting. This also means that the notifications will continue to appear, only to repeatedly interrupt the perplexed users’ computing and make a mess of their Mac experience overall.
The most likely cause of these alerts is that the recent macOS update has changed the way the system treats third-party apps. In particular, the entities that cannot be verified or checked for malicious behavior end up being blocked, with the Mac notifying the user about this. As commendable as it is, this policy turns out to have a flip side: it drags many people into a loop of irksome splash screens that won’t go away until the MacPerformance threat is removed.
Zooming out, one of the interesting things about these irritating popups is that although they contain the “Don’t Allow” and “OK” buttons, selecting the former won’t stop the adverse activity in its tracks. The alerts will continue to appear regardless. In order to get them out of your sight, you need to get rid of the MacPerformance virus. The problem might be that its fragments are dispersed across macOS, and it may be quite challenging to find them all. The walkthrough below can help thoroughly locate the traces of this culprit and eradicate them to fix the issue.
MacPerformance virus manual removal for Mac
The steps listed below will walk you through the removal of this malicious application. Be sure to follow the instructions in the order specified.
• Open up the Utilities folder as shown below
• Locate the Activity Monitor icon on the screen and double-click on it
• Under Activity Monitor, find the entry for MacPerformance or other suspicious one, select it and click Quit Process
• A dialog should pop up, asking if you are sure you would like to quit the troublemaking process. Select the Force Quit option
• Click the Go button again, but this time select Applications on the list. Find the entry for MacPerformance on the interface, right-click on it and select Move to Trash. If user password is required, go ahead and enter it
• Now go to Apple Menu and pick the System Preferences option
• Select Accounts and click the Login Items button. The system will come up with the list of the items that launch when the computer is started up. Locate MacPerformance or other potentially unwanted app there and click on the “-“ button
Get rid of “MacPerformance wants access …” popups in web browser
To begin with, settings for the web browser that got hit by the MacPerformance virus should be restored to their default values. The overview of steps for this procedure is as follows:
1. Reset Safari
• Open the browser and go to Safari menu. Select Preferences in the drop-down list
• Once the Preferences screen appears, hit the Privacy tab at the top. Find the option that says Remove All Website Data and click on it
• The system will display a confirmation dialog that also includes a brief description of what the reset does. Specifically, you may be logged out of some services and encounter other changes of website behavior after the procedure. If you’re okay with that, go ahead and click the Remove Now button
• In order to selectively clear data generated by certain websites only, not all of them, hit the Details button under the Privacy section of Safari Preferences
• This feature will list all websites that have stored potentially sensitive data, including cache and cookies. Select the one, or ones, that might be causing trouble and click the appropriate button at the bottom (Remove or Remove All). Click the Done button to exit.
2. Reset Google Chrome
• Open Chrome and click the Customize and Control Google Chrome menu icon
• Select Options for a new window to appear
• Select Under the Hood tab, then click Reset to defaults button
3. Reset Mozilla Firefox
• Open Firefox and select Help – Troubleshooting Information
• On the page that opened, click the Reset Firefox button
Get rid of MacPerformance malware using Freshmac removal tool
When confronted with malicious code like the MacPerformance virus on Mac, you can neutralize its toxic impact by leveraging a specially crafted system utility. The Freshmac application (read review) is a perfect match for this purpose as it delivers essential security features along with must-have modules for Mac optimization.
This tool cleans unneeded applications and persistent malware in one click. It also protects your privacy by eliminating tracking cookies, frees up disk space, and manages startup apps to decrease boot time. On top of that, it boasts 24/7 tech support. The following steps will walk you through automatic removal of the MacPerformance infection from Mac.
1. Download Freshmac installer onto your machine. Double-click the Freshmac.pkg file to trigger the installer window, select the destination disk and click Continue. The system will display a dialog asking for your password to authorize the setup. Type the password and click Install Software.
2. Once the installation has been completed, Freshmac will automatically start a scan consisting of 5 steps. It scans cache, logs, unused languages, trash, and checks the Mac for privacy issues.
3. The scan report will then display your current system health status and the number of issues detected for each of the above categories. Click the Fix Safely button to remove junk files and address privacy issues spotted during the scan.
4. Check whether the “MacPerformance wants access …” popups problem has been fixed. If it perseveres, go to the Uninstaller option on Freshmac GUI. Locate an entry that appears suspicious, select it and click Fix Safely button to force-uninstall the unwanted application.
5. Go to Temp and Startup Apps panes on the interface and have all redundant or suspicious items eliminated as well. The MacPerformance malware shouldn’t be causing any further trouble.
“MacPerformance can’t be opened” is a system alert that recurrently pops up on computers infected with the MacPerformance virus. The message is most likely the new macOS Catalina version’s response to the activity of applications whose source and developer cannot be verified. According to this popup dialog, Apple cannot check the service for malicious software.
As a way to address the issue, the system recommends the user to update the app. However, there is a serious obstacle to doing so – the vendor behind MacPerformance isn’t an official party, to put it mildly (see the infection summary above); furthermore, the only updates the program may get are intended to enhance its malicious functionality rather than to add benign features to its toolkit.
To recap, “MacPerformance can’t be opened” is a legit macOS alert. However, this is a cold comfort for those affected because these messages won’t stop unless the virus is completely removed from Mac.
Putting aside the nuances of categorization, MacPerformance is definitely not safe to use and should be removed from Mac as soon as possible. Strictly speaking, malware is a term spanning numerous forms of malicious code. Based on this app’s behavior and objectives, it can also be labeled as a PUA (potentially unwanted application), adware, or virus.
MacPerformance bypasses user consent when infiltrating systems. To this end, it adheres to an unethical software bundling practice that makes the installation an uninformed decision. When inside a Mac, the app repeatedly displays requests asking for access to control the victim’s default web browser (Safari or Chrome). If granted, these privileges allow the culprit to unleash its malvertising capacity. In particular, it disrupts the infected user’s web surfing routine by displaying popups about viruses purportedly found on the Mac. This is a way to dupe the person into installing and buying a fake system utility, such as Mac Cleanup Pro or Mac Auto Fixer.
To top it off, the victims have been reporting system-generated alerts that say, “MacPerformance can’t be opened because Apple cannot check it for malicious software”. Meanwhile, macOS doesn’t provide an effective workaround to address this issue. Under the circumstances, the only way to stop these error messages boils down to removing the malware proper (see tutorial above for cleaning steps).
Although Macs boast a great self-optimization capability triggered by regular updates and other automated routines, periodic maintenance is an important element of ensuring a smooth system performance. Here are a few worthwhile and easy tips to keep your Mac’s performance at its peak at all times:
- Free up disk storage space by deleting unused and old files.
- Remove redundant apps from your startup items.
- Check the Activity Monitor for processes that consume too much CPU. Disable the memory hogs where possible.
- Tidy up your widgets: get rid of the ones you don’t use.
- Clear caches in your default web browser once in a while.
- Store large files in the cloud.
- Uninstall unnecessary old apps.
- Keep macOS up to date.
Also, consider installing a reputable optimization app to automate this routine. Be sure to stick with the official Mac App Store when choosing the cleaner.
The utility called iLife Media Browser is supposed to help organize and browse your favorite multimedia content. Whereas it’s part of the legit iLife software suite for macOS and isn’t considered to be malicious as such, it may cause a number of adverse effects in terms of Mac performance. For instance, one of the past updates (version 2.0 release) turned out buggy and resulted in the app crashing and error messages being shown to users. The program is quite resource-heavy, too. Therefore, your Mac may slow down to a crawl and lack CPU power to process other tasks. All in all, unless you really need the features delivered by iLife Media Browser, you are better off uninstalling it.
Another facet of the issue is that Mac users run the risk of installing a booby-trapped variant of this solution distributed on dodgy app portals. In this scenario, the software may be bundled with a potentially unwanted browser extension that displays annoying ads on the visited websites. Considering the possible downsides of iLife Media Browser, you should treat this app with caution.