How to avoid falling for scams like "Virus Alert 027341"
Written by Tomas Meskauskas on
What kind of scam is "Virus Alert 027341"?
We have examined the scam and determined that it falls into the technical support scam category. These types of scams typically involve fraudsters posing as legitimate tech support representatives. Their goal is to trick individuals into paying for unnecessary services or software, disclosing personal information, or providing remote access to computers.
"Virus Alert 027341" scan overview
This scam involves multiple fake warnings/alerts. The messages claim that the system has been locked due to "unusual activity" or infection with "Trojan-type spyware". These fake warnings urge the user to contact a number (+1-888-844-9392) for "MacOS Support".
It also contains a fake warning about a failed virus scan and an error code ("Ox800VDS"). This warning suggests the need for immediate action to remove "infected files" due to "group policies permissions". The message also prompts the user to call the provided phone number for support.
In reality, these messages are deceptive tactics used by scammers to lure users into calling scammers. Upon contacting scammers, users could be pressured into paying for unnecessary services or providing personal information (e.g., credit card details, login credentials, or ID card information).
Users could also be urged to download harmful files or software, or provide remote access to computers through certain remote administration tools. A couple of examples of scams in which fraudsters aim to remotely access computers through legitimate tools are UltraViewer and TeamViewer scams.
Falling for technical support scams can lead to financial loss, identity theft, malware infiltration, and other issues. Thus, it is important to recognize such scams and avoid engaging with them (e.g., calling the provided numbers or downloading software).
| Name | Virus Alert 027341 technical support scam |
| Threat Type | Phishing, Scam, Mac malware, Mac virus |
| Fake Claim | A computer is infected, the system has been locked |
| Related Domain | windows[.]net |
| Detection Names | ESET (Phishing), Google Safebrowsing (Phishing), Netcraft (Malicious), Trustwave (Phishing), Full List (VirusTotal) |
| Serving IP Address | 57.150.87.132 |
| Fake Tech Support Number | +1-888-844-9392 |
| Symptoms | Unofficial domain, urgent language, fake warnings/alerts. |
| Distribution methods | Rogue advertising networks, deceptive pop-ups, fraudulent emails, unwanted apps, search engine poisoning. |
| Damage | Internet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites, loss of private information. |
| Malware Removal (Mac) | To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Similar scams in general
Most technical support scams use fear tactics to deceive victims into taking certain actions. They often involve fake warnings and urge users to call the provided numbers. Typically, scammers behind these schemes aim to extract money or personal information or deliver malware.
Some examples of similar scams are "Norton - This Mac Is Infected With Viruses", "Your Device Is At Risk", and "Access To This Apple Device Has Been Blocked".
How did I open a scam website?
Users can end up on scam websites through rogue advertising networks often used by torrent websites, sites offering illegal movie streaming services, and similar platforms. Scammers also use search engine poisoning techniques to make scam sites appear at the top of results and trick users into opening them.
Additionally, deceptive sites can be accessed through links in fraudulent emails, fake buttons and links on dubious web pages, notifications from unreliable sites, misleading poo-ups, advertisements, and similar channels. Sometimes, scammers use adware to promote fraudulent sites.
How to avoid visiting scam websites?
Use reputable search engines like Google and always check the URLs of websites to ensure they are legitimate/official. Do not agree to receive notifications from shady websites (and remove such permissions if already granted). Avoid clicking ads, pop-ups, buttons, and links on questionable pages.
Download applications from official websites or app stores. Keep the operating system and installed software up to date. Regularly scan your computer for threats using a reliable security tool. If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate all threats.
Appearance of "Virus Alert 027341" scam (GIF):
Text in one of the fake warnings in this scam:
Virus Alert 027341 !!
Apple_MacOS locked due to unusual activity.
Your system has been reported to be infected with Trojan-type spyware.
For assistance, contact MacOS Support
+1-888-844-9392
Instant automatic Mac malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is "Virus Alert 027341"?
- STEP 1. Remove PUA related files and folders from OSX.
- STEP 2. Remove rogue extensions from Safari.
- STEP 3. Remove rogue add-ons from Google Chrome.
- STEP 4. Remove potentially unwanted plug-ins from Mozilla Firefox.
Video showing how to remove adware and browser hijackers from a Mac computer:
Potentially unwanted applications removal:
Remove potentially unwanted applications from your "Applications" folder:
Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX","NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.
Remove adware-related files and folders
Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...
Check for adware generated files in the /Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: /Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the ~/Library/Application Support/ folder:
In the Go to Folder... bar, type: ~/Library/Application Support/
In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.
Check for adware generated files in the ~/Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: ~/Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the /Library/LaunchDaemons/ folder:
In the "Go to Folder..." bar, type: /Library/LaunchDaemons/
In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.
Scan your Mac with Combo Cleaner:
If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.
Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.
After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.
Remove malicious extensions from Internet browsers
Remove malicious Safari extensions:
Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".
In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.
Remove malicious extensions from Google Chrome:
Click the Chrome menu icon 
(at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.
Remove malicious extensions from Mozilla Firefox:
Click the Firefox menu 
(at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.
Frequently Asked Questions (FAQ)
What is a pop-up scam?
A pop-up scam often involves a fake warning or message that appears on a fake website. It claims that a device is infected or at risk to trick the user into calling a fake support number or taking other action.
What is the purpose of a pop-up scam?
Scammers use these scams to steal money or personal information, or deliver malicious software.
Why do I encounter fake pop-ups?
Users can land on scam websites through rogue advertising networks (by visiting torrent sites and similar platforms), search engine poisoning, deceptive emails, fraudulent links, misleading pop-ups, adware, and similar channels.
Will Combo Cleaner protect me from online scams?
Combo Cleaner scans websites users visit and detects malicious ones, including those delivering pop-up scams. If a site is flagged as dangerous, you will receive an immediate warning, and access will be blocked for your protection.
Outstanding!
▼ Show Discussion