A new Mac Scam?

[yellowtriumph]

Thank you again.

[Background Noise]

Her indoors has just picked up Advanced Mac Cleaner somehow - she has no idea how or when. I think I have removed it now, but will she have had to followed a link to install it? She says she was not asked for her admin password at any stage.

[Jhieminga]

Most likely, yes. There are some tips here: https://discussions.apple.com/thread/7135825?tstart=0 but perhaps you found those already.

I often find that people don't recollect giving their admin password because when they did so, they thought it was related to something else entirely.

[Background Noise]

My other concern is that continual automatic backups, such as Time Machine, could inadvertently backup the malware.

[ExXB]

Malware is rare for the Mac. When it happens, and it does, the media usually have a feeding frenzy and everyone sooon knows about. All malware so far has taken the form of trojans or phishing.

I'd deactivate admin privledges for all users on the machine, and have a seperate admin account that can be used when appropriate.

[Background Noise]

Yes, but presumably any unwanted stuff can get itself into your time machine backup as well?

[ExXB]

Of course, but you just go back in time to a point before infection. You will lose all the interim stuff, but's that's often still better than the alternative.

I have an emergency (applescript) button that turns off all by backup processes (Time Machine; Carbon Copy cloner; Backblaze). As they are all scheduled for different times of the day I should be able to get back to a clean version.