Mac virus removal "Your computer is low on memory" - MacSecurity (2023)

Examine the malicious facet of the "Your computer is low on memory" Mac pop-up alert and make sure it isn't being displayed by a virus as part of its shady tactics.

Update: March 2023

What is "Your computer is low on memory" Mac pop-up alert?

When it comes to electronic devices in general and computers in particular, one of the inevitable things is that they become obsolete over time. Macs are not on the sidelines of this "aging" phenomenon. While the operating system and third-party software will be updated later, the hardware does not. Ultimately, this means that at some point the machine will become unable to smoothly handle increasingly resource-intensive apps. In this scenario, the user's options are not extensive and are usually limited to upgrading memory or replacing the MacBook or desktop computer with a new model powerful enough to support modern programs, including memory hogs like graphics editing tools. But what if iterative alerts go, "Your computer is low on memory' appearing on a Mac equipped with resources beyond what is required to process all current workflows? This could be one way Mac malware signals its presence.

In fact, pop-up warnings stating that a Mac is running out of available memory have been a telltale sign of adware and scareware activity for quite some time. Also known as potentially unwanted applications (PUAs), these malefactors scatter host system by displaying various types of sponsored information and deceptive pop-up dialogs. The goal of generating ads on victims' web browser is to generate revenue through pay-per-click and other commission-based marketing methods. However, low memory is not necessarily the main cause of these warning messages popping up. There may be implications for malware that should be checked before taking further action.

special offer
"Your computer is low on memory" virus can reinfect your Mac several times unless you delete all its fragments, including hidden ones. Hence, it is recommended to download Combo Cleaner and scan your system for those stubborn files.This allows you to reduce cleaning time from hours to minutes. Download now _{Learnhow ComboCleaner works. If the utility detects malicious code, you need to buy a license to get rid of it.}

Adware as a source of fake low memory alerts

Meanwhile, cyber criminals' motivation behind displaying fake system maintenance alerts may seem vague at first glance. It becomes clearer when considering a few additional characteristics of mainstream rogue optimization software and adware. One of them revolves around cross-promotion of related threats where the unsuspecting victim is tricked into consenting to the shady installation by clicking on a button disguised as something else. The only button the user can press on the spoof alert under review is "Close", but they can actually invoke arbitrary commands, e.g. B. to turn on another PUA behind the scenes.

Adware programs known to trigger the "Your computer is low on memory" Mac notifications include the following types:

• Rooms.app;
• ScreenSaver.app;
• ScreenCapture.app;
• Be careful.

The fake storage warning can also be a telltale sign of a notorious browser hijacking using thesearchbaron.comorsearchmarquis.comURL as an intermediate instance in the redirection loop. In this scenario, all search queries entered into the web browser return bing.com, even though this is not the default service specified by the user. This is a sophisticated revenue-driven traffic reorganization attack that uses a legitimate search provider to obfuscate the malicious activity.

The role of fake low-memory pop-ups in this scheme is to get permission to control Safari and other web browsers. This scam involves a very peculiar double-dialogue trick where one warning hides another. By clicking "Close" on the visible notification, the user unknowingly interacts with a disguised request only to give the adware the green light to perform actions within the browser. This explains how the unwanted app modifies the victim's default web browsing settings without consent. As if this facet of effects weren't disturbing enough, the fake program can abuse its ill-granted privileges to collect any information that the victim types into the browser, including passwords and payment details.

Mac scarware follows suit

Fake maintenance software is another form of malicious code that exploits memory anxiety on Macs. This is intended to draw the victim's attention to the supposedly unsatisfactory performance of the host computer. Apart from the annoying "Your computer is low on memory" message, the pop-up also says "To free up disk space, please close some applications". The average Mac user's natural response to such a dialog is to take a look at the current CPU and memory usage to see what's eating up most of it. Strangely, however, the Activity Monitor doesn't show anything out of the ordinary and memory usage doesn't seem to exceed any reasonable thresholds.

This inconsistency has a name - scareware. Such an application is calledMac Security Plus. After infiltrating a system unnoticed, this parasite deploys malicious brainwashing activities, manifesting itself as fake reports of low memory, misleading virus detection warnings, and untrustworthy claims of one-click Mac productivity boosts. This foul play involves tricking the user into buying the scam app's license to supposedly unlock its repair and optimization features. All in all, the pseudo system utility attempts to add pressure to its repertoire by displaying fake "Your computer is low on memory" notifications. The range of fake system maintenance tools that intentionally distort a Mac's actual RAM health has expanded recently. Advanced Mac Cleaner is another "big name" in the scareware ecosystem that uses this trick to trick victims into activating the full version. A clear symptom of this attack is a series of processes named "hlpramc", "helperamc", "hlprnwamc" or similar running in Activity Monitor.

privacy risks

An additional caveat is that the rogue application that spoofs "Your computer is low on memory" alerts might collect the victim's sensitive data behind the scenes. Adware and fake optimization tools do this to increase monetization of their attacks when the other tricks fail. Victim's personal information targeted by this threat includes browsing habits, macOS build and hardware specs. While each piece of this data, when analyzed in isolation from the rest, doesn't tell much to would-be identity thieves, things change when the details are compiled into a user profile database. Because the aggregated information is literally "fingerprintable," crooks can sell it via hacker forums or misuse it to run phishing campaigns with a potentially high success rate.

How does this virus infect Macs?

The flood of "Your computer is low on memory" pop-up alerts on a Mac occurs after a dubious software installation with a touch of social engineering. The malware is attached to a package that appears to contain only a seemingly normal application, but actually also promotes unwanted programs. As a result, the malicious extra is hidden from plain sight, allowing the unsuspecting potential victim to keep clicking through the installer's screens, only to catch the bad guy later. One of the common distribution techniques employed by malware operators is Adobe Flash Player update scam, which is supported by deceptive online pop-up alerts. As such, recommendations like these should be treated with a fair dose of skepticism as they often spread Mac infections instead of improving user experience. No matter what kind of malware is causing this fake alert activity, it should be deleted without any concerns.

"Your computer is low on memory" virus manual removal for Mac

The steps below will guide you through the removal of this rogue application. Be sure to follow the instructions in the order presented.

1. Expand thatGomenu in your Mac's Finder bar and selectUtilitiesAs shown below.

   

2. Find themactivity monitoricon on the Utilities screen and double-click it.

   

   (Video) How To Remove All Mac Viruses, Malware, Adware, & Spyware | Full Deep Clean & Maintenance 2022

3. Search in the activity monitor appMacSecurityPlus,spaces,screen capture,screensaver,Be careful, or another process that seems suspicious. To narrow your search, focus on unfamiliar, resource-intensive entries in the list. Keep in mind that the name isn't necessarily related to how the threat manifests, so you'll have to trust your own judgment. When you locate the culprit, select it and click on itFusesicon in the top left corner of the screen.

   

4. If a follow-up dialog appears asking if you're sure you want to exit the troubleshooting process, select theForce quitPossibility.
   

   

5. Click on thatGomenu icon again in Finder and selectGo to folder. You can also use theCommand-Shift-Gkeyboard shortcuts.
   

   

6. Typ/Library/LaunchAgentsin the folder browse dialog and click theGoTaste.
   

   

7. Examine the contents of the LaunchAgents folder for suspicious looking items. Note that the names of files generated by malware may not provide clear indications that they are malicious. So look for recently added entities that seem to deviate from the norm.

   To illustrate, here are some examples of LaunchAgents related to mainstream Mac infections:com.pcv.hlpramc.plist, com.updater.mcy.plist, com.avickUpd.plist,Andcom.msp.agent.plist. If you discover files that don't belong in the list, go ahead and drag them to the Trash.

   

   See Also

   How to fix your computer is low on memory in Windows 10

8. Use theGo to folderSearch function again to navigate to the specified folder~/Library/Application Support(Note the tilde symbol preceding the path).
   

   

9. When the Application Support directory opens, identify any recently created suspicious folders in it and move them to the trash. A quick tip is to look for items whose names are unrelated to Apple products or apps that you knowingly have installed. Some examples of known malicious folder names areProgressMatch,SystemSpecial, Andfrom IdeeGete.

   

10. Input~/Library/LaunchAgentsstring (don't forget to include the tilde character) in theGo to foldersearch area.
    

    

11. The system displays LaunchAgents located in the current user's home directory. Look for shady items related to Your computer is low on memory virus (see logic highlighted in subsections above) and drag suspects to Trash.

    

12. Typ/Library/LaunchDaemonsimGo to foldersearch box.
    

    

13. In the LaunchDaemons path, try to locate the files that the malware uses for persistence. Some examples of such items truncated by Mac infections arecom.pplauncher.plist,com.startup.plist, Andcom.ExpertModuleSearchDaemon.plist. Delete the sketchy files immediately.
    

    

14. Click on thatGoMenu icon in your Mac's Finder and selectapplicationson the list.
    

    

15. Find the entry forMacSecurityPlus,spaces,screen capture,screensaver,Be careful, or any other app that clearly doesn't belong there, and move it to the Trash. If this action requires your admin password for confirmation, go ahead and enter it.

    

16. Expand the Apple menu and selectsystem settings.

    

    

17. Further toUsers & Groupsand click theLogin-ElementeTab.

    

    The system displays the list of started items when the computer starts. From there, locate the potentially unwanted app and click the “-” (minus) button.

    

18. Now chooseProfileunder system settings. Look for a malicious item in the left sidebar. Several examples of configuration profiles created by Mac adware includeTechSignalSearch,main search platform,Admin Settings, AndChrome settings. Select the entity in question and click the minus sign below to eliminate it.
    

    

    

    If your Mac has been infiltrated by adware, the infection will most likely continue to dominate your default web browser even after you remove the underlying application along with its components scattered throughout the system. Use the browser cleanup instructions below to fix the remaining effects of this attack.

Remove Your computer is low on memory virus in web browser on Mac

First of all, the web browser settings taken over by "Your computer is low on memory" virus should be restored to their default values. Although this will wipe most of your customizations, web browsing history and any temporary data stored by websites, the malicious interference should also be terminated. The outline of the steps to complete this procedure is as follows:

1. Remove "Your computer is low on memory" virus from Safari
   • Open the browser and go toSafari-Menü. ChooseIdeasin the drop-down list.

     

   • Once the Settings screen appears, clickProgressivetab and enable the option "Show the Develop menu in the menu bar“.

     

     (Video) How to Remove Malware or Virus on Mac

   • After the Develop entry is added to the Safari menu, expand it and clickEmpty caches.

     

   • Now chooseStoryin the Safari menu and clickdelete historyin the drop-down list.

     

   • Safari will display a dialog asking you to specify the time period for which this action should apply. Chooseall historyto ensure maximum effect. Click on thatdelete historyConfirm and exit button.

     

   • Go back to Safari Preferences and press thePrivacy tababove. Look for the option that saysManage Website Dataand click on it.

     

   • The browser displays a follow-up screen listing the websites that have stored data about your internet activity. This dialog box also provides a brief description of what the removal will do: You may be logged out of some services and will encounter other website behavior changes after the operation. If you agree, go ahead and click theRemove allTaste.

     

   • Restart Safari
2. Remove "Your computer is low on memory" in Google Chrome
   • Open Chrome, click theCustomize and control Google Chrome (⁝)icon at the top right of the window and selectIdeasin the drop-down list

     

   • Select in the "Settings" areaProgressive
   • Scroll down toreset settingsSection.

     

   • Confirm the Chrome reset in a dialog box that appears. When the process is complete, restart the browser and check for malware activity.

     

3. Remove "Your computer is low on memory" from Mozilla Firefox
   • Open Firefox and go toHelp - Troubleshooting information(or typeAbout: supportin the URL bar and press Enter).

     

     

   • On the Troubleshooting Information screen, clickUpdate FirefoxTaste.

     

   • Confirm the intended changes and restart Firefox.

The Mac maintenance and security app calledCombo Cleaneris a one-stop tool to detect and remove Your computer is low on memory virus. This technique has significant advantages over manual cleaning, as the utility receives hourly virus definition updates and can accurately detect even the latest Mac infections.

In addition, the automatic solution finds the malware's core files deep in the system tree, which might otherwise be a challenge to locate. Here is a walkthrough to solve your computer is low on memory issue with Combo Cleaner:

1. Download the Combo Cleaner installer. When you're done, double-click thecombocleaner.dmgfile and follow the instructions to install the tool on your Mac.

   Download Combo Cleaner

   By downloading applications recommended on this site, you agree to ourTerms and ConditionsAndPrivacy Policy. The free scanner checks if your Mac is infected. To get rid of malware, you need to buy the premium version of Combo Cleaner.

2. Open the app from your launchpad and let it update the malware signature database to ensure it can detect the latest threats.
3. press theCombo-Scan startenButton to scan your Mac for malicious activity and performance issues.

   

4. Examine the scan results. If the report says "No Threats" then you are on the right track with manual cleaning and can safely proceed to clean the web browser which may still be operating due to the aftermath of the malware attack (see instructions above ).

   

5. If Combo Cleaner found any malicious code, click theDelete selected itemsand let the utility remove Your Computer Is Low On Memory threat along with any other viruses, PUPs (Potentially Unwanted Programs) or junk files that don't belong on your Mac.

   

6. After double-checking that the malicious app is uninstalled, browser-level troubleshooting might still be on your to-do list. If your browser of choice is affected, refer to the previous section of this tutorial to get back to surfing the web with ease.

FAQ