I think I have a malware problem?

[nonameworks]

I think I have a malware problem. I'm running Mac OS 10.9.5 I know it's old, but that's what I have.  I had a malware problem a few years ago and this forum helped me out.

I downloaded version 1.2.6 of your malware.  I don't know what to do next. I think it's Malware?  What happens is when I try to go to certain websites a drop down menu appears and asks me if I want to continue or cancel or show certificate. If I click on show certificate it shows up and wants me to enter my administration password to my hard drive. I am paranoid about doing this.  I do not know much about computers. I am an advanced senior citizen. Sometimes it's Fox News and others sites I've never heard of.  Also, I sometimes get popups for Mac Repair. I know that what they really want is me credit card number.

 If my download of version 1.2.6 malware was incorrect please correct it.

Thank you in advance for whatever you can help me with.

 

Please notify me of any replies.

Ed.

[alvarnell]

None of this sounds like any type of malware. What you are seeing is relatively normal. It simply means that there is something wrong with the credentials certifying the web site you are visiting. It could be one of several things, but if you "show certificate" it should tell you exactly what the issue is. The certificate could have expired, been revoked or simply doesn't match the name of the site. The reason it's 

I checked https://www.foxnews.com and everything appears to be in order there.

By Mac Repair, I'm guessing you mean IFIXIT? https://www.ifixit.com/Device/Mac. That too appears to be OK.

It's also normal to ask for your password when you choose to ignore the warning and override the certificate.

So I think the only question is why your computer doesn't consider these certificates to be valid.

One possibility would be if your computer lost track of the date and believes these are either not yet in effect or expired, so check System Preferences->Date & Time.

A more likely explanation is that your OS doesn't have the latest information of what root certificates are current, so your DigiCert Global Root CA & COMODO RSA Certification Authority certificates may have expired. Here is a list of the ones that should be good OS X Mavericks: List of available trusted root certificates. Is your OS fully up-to-date with all available Security Updates? When you click on the  menu and select "About This Mac" then click on "Version 10.9.5" does it say the build number is "(13F1911)"?

[nonameworks]

Thank you, Alvarnell,

The version  10.9.5 does read: 13F1911. What I think I understand from your great explanation, graphics and all, that it is okay for me to go ahead and show certificate and then put in my administrator password for the hard drive.  You write very clearly and it's a great help to me.  The system preferences are also correct. I have been attempting to deal with this problem on my own and have checked the date and time. It has been fine all along.

You wrote: "It's also normal to ask for your password when you choose to ignore the warning and override the certificate." I know I'm sounding apprehensive here, but I want to be assured that it should be okay to enter my password and tell it to go ahead. I have been trying to get up the nerve to do just that but stop, as I'm afraid of the negative impact. My computer is 16 years old and I can't replace it.

 

Thanks again for all of your help. This is a great forum.

 

Ed.

Edited May 17, 2018 by nonameworks
Added another sentence.

[alvarnell]

Yes, I did choose my words carefully as I don't know exactly what you are seeing. In my experience, it doesn't ask for an admin password until I decide that the certificate is OK and I want to proceed on to the web site. You seem to be saying that it''s asking when you first choose to Show the Certificate. I don't understand why it would ask you at that point and I don't really have the time right now to reboot into Mavericks to see if I can replicate what you have described.

You should not enter an admin password unless you are certain that you agree with whatever it's asking to do. At this point, you haven't been able to tell us what is wrong with the certificate, so I can't offer anything additional until we know more. Perhaps some screenshots of what all you are seeing will help.

[7adityaraj]

Hi Ed, 

For macOS 10.9.5 , there is version 1.3.1 available.

https://support.malwarebytes.com/docs/DOC-2438 

 

[nonameworks]

Alvarnel,

I don't think I explained about the certificate correctly.  The graphics you pasted in look like the one's I'm viewing on my computer. I will paste them into this e-mail. I am not asked for the administrator password until I click on the "Show Certificate." 

I greatly appreciate your patience.

Ed.

 

 

 

[treed]

Note that 10.9 has been having problems with this sort of thing lately. We've seen a number of certificate issues showing up on 10.9 that can't be reproduced on any other system. We are not clear at this point what the cause of the problem is, but we have been able to confirm this behavior on a freshly-installed, clean 10.9 system.

Unfortunately, there are only two options available to you. One is to upgrade or downgrade your system. Mac OS X 10.10 and higher do not suffer from this problem, and strangely, for whatever reason, Mac OS X 10.8 is also not affected.

The other option is to stop using Safari and switch to Chrome or Firefox.