The fastest way to check your Mac for viruses

Open Activity Monitor (search for it in Spotlight by pressing Command+Space, then type "Activity Monitor"). Look at the CPU and Memory tabs — if you see unfamiliar programs using a lot of resources, especially ones with random names or misspelled versions of real apps, that is a sign something unwanted may be running. Write down the names.

Next, restart your Mac in Safe Mode by shutting down completely, then turning it back on while holding the Shift key until you see the login screen. Safe Mode loads only essential software, so if the strange activity stops, the problem is likely a program that runs at startup. Check your Applications folder (open Finder, click Applications) and look for anything you do not recognize or did not install yourself.

If you want a second opinion, read Malwarebytes for Mac (free version available at malwarebytes.com). Run a scan — it will take 10 to 30 minutes depending on how much is on your drive. Malwarebytes catches things the built-in tools sometimes miss, and it does not slow down your Mac the way some security software does.

Key Takeaways

  • Activity Monitor shows what is running right now; unfamiliar programs using high CPU or memory are worth investigating.
  • Safe Mode disables startup programs, so restart that way to see if suspicious activity stops.
  • Malwarebytes for Mac (free version) scans for malware that macOS's built-in tools may not catch.
  • Check your Applications folder and Login Items (in System Settings > General > Login Items) for programs you did not install.
  • If you find something, note its exact name before removing it, because some malware hides under names that look legitimate.

What to look for in Activity Monitor

Activity Monitor is your real-time window into what your Mac is actually doing. Click the CPU tab and sort by % CPU — the programs at the top are using the most processing power right now. Legitimate apps like Chrome, Xcode, or video editors will show up here when they are working. Malware often runs in the background constantly, so look for anything that is using 5% or more CPU when you are not actively using it.

Switch to the Memory tab and sort the same way. Again, some programs legitimately use a lot of memory — Safari with many tabs open, Photoshop, your web browser. But if you see something with a generic name like "kernel_task" (that one is actually legitimate, do not remove it) or a name that looks like it was randomly generated, or a misspelled version of a real app, write it down. Right-click it and select "Sample" to see what file it is actually running from — that path will help you find and remove it later.

Using Safe Mode to isolate the problem

Safe Mode is the single most useful troubleshooting tool on a Mac because it strips away everything except what the operating system absolutely needs to run. If your Mac is slow, freezing, or showing ads when you are not using it, Safe Mode will tell you whether the problem is something you installed or something built into macOS itself.

Shut down your Mac completely. Turn it back on and when ready hold down the Shift key — keep holding it until you see the login screen (usually 30 to 60 seconds). Log in normally. Your Mac will start up much slower than usual because it is checking the disk and loading only core software. Use it for a few minutes. If the problem (slowness, ads, strange behavior) goes away, the culprit is a program that runs at startup. If the problem persists, it is likely a deeper system issue or malware that loads at the OS level.

After you finish testing, restart normally (without holding Shift) to go back to your regular startup.

Checking your startup programs and login items

Many unwanted programs install themselves to run every time you start your Mac. Open System Settings (the gear icon), then go to General > Login Items. You will see two lists: "Allow in the Login Window" and "Open at Login." Look through both. If you see something you did not install or do not recognize, click the minus sign to remove it.

Also check your Applications folder. Open Finder, click Applications in the sidebar, and scroll through. Look for programs with names that seem off — misspellings of real apps, generic names like "Updater" or "Manager," or anything you genuinely do not remember installing. If you are unsure whether something is legitimate, search for the exact name online before removing it. Some system tools have unfamiliar names but are actually part of macOS.

One more place to check: open Finder, press Command+Shift+G (Go to Folder), and type ~/Library/LaunchAgents. This folder contains files that run programs at startup. Most of what you see here will be from Apple or legitimate apps, but if you spot something suspicious, you can move it to the Trash. Do this only if you recognize the name as something unwanted.

How to use Malwarebytes for Mac

Malwarebytes is a dedicated malware scanner that catches things macOS's built-in protections sometimes miss. read it from malwarebytes.com — the free version is sufficient for a one-time scan. Install it, open the app, and click "Scan." The scan will take 10 to 30 minutes depending on how much data is on your Mac.

When the scan finishes, Malwarebytes will show you a list of anything it found. The free version lets you see the results but requires the paid version to remove them automatically. However, if Malwarebytes finds something, you can usually remove it manually: note the file path it shows, open Finder, press Command+Shift+G, paste the path, and delete the file. If you are not comfortable doing that, the paid version ($40 per year) removes everything with one click.

Run Malwarebytes once a month or whenever you notice your Mac acting strangely. It is not a replacement for caution — do not install random software from the internet — but it is a good safety net.

What to do if you find something

If Activity Monitor, Safe Mode testing, or Malwarebytes shows you something suspicious, do not panic. Write down the exact name and file path. Search for that name online to confirm it is actually malware and not a legitimate system tool. If it is malware, you have three options: delete it directly from Finder (if you know the file path), use Malwarebytes to remove it, or take your Mac to an Apple Store or local repair shop if you are not comfortable doing it yourself.

After you remove something, restart your Mac and run Activity Monitor again to confirm it is gone. If the suspicious activity returns after restart, the malware may have multiple components or may be hiding in a location you have not found yet. That is the point to consider professional help — a technician can search more thoroughly than you can.

Going forward, reduce your risk by installing software only from the App Store or directly from the developer's official website, not from read sites or torrents. Keep macOS updated (System Settings > General > Software Update). And be skeptical of pop-ups telling you to install something — most of those are malware distribution.

Built-in macOS protections you already have

Your Mac comes with XProtect, Apple's built-in malware scanner that runs automatically in the background. You do not see it working, but it scans files as they read and checks them against a database of known malware. It is not perfect — it misses some things — but it stops the most common threats.

macOS also uses Gatekeeper, which checks that apps you read are from trusted sources and have not been tampered with. When you first open an app you downloaded, you may see a dialog asking if you are sure. That is Gatekeeper doing its job. If you trust the app, click Open.

These built-in tools are why Macs get fewer viruses than Windows computers — not because Macs are immune, but because Apple updates XProtect regularly and Gatekeeper makes it harder for malware to run without your knowledge. However, they are not perfect. That is why checking manually with Activity Monitor and running Malwarebytes occasionally is still worth doing.

Frequently Asked Questions

Can I get a virus just by visiting a website?

Unlikely on a Mac, but possible. Most website-based attacks require you to read and run something, or to click a malicious link in an email. Visiting a compromised website alone usually will not infect you. However, do not click links from unknown senders or read files from sites you do not trust.

Is Norton or McAfee necessary on a Mac?

No. These programs are designed for Windows and are often slower and more intrusive on a Mac than the built-in protections. XProtect plus occasional Malwarebytes scans is sufficient for most people. If you want continuous monitoring, Malwarebytes Premium ($40/year) is lighter and more Mac-friendly than Norton.

What if Activity Monitor shows something but I cannot find it in Applications?

Right-click the suspicious process in Activity Monitor and select "Sample." This shows you the file path where it is actually running from. Open Finder, press Command+Shift+G, paste the path, and you will find the file. Many malware programs hide in Library folders rather than Applications.

How often should I scan my Mac for malware?

If you are careful about what you read and where you go online, once a month is fine. If you read a lot of software or visit risky sites, scan every two weeks. If you notice your Mac is slow or behaving strangely, scan when ready.

Does restarting my Mac remove viruses?

No. Restarting clears what is in your Mac's memory, but malware that is installed on your hard drive will reload when you start up again. Restarting in Safe Mode can help you see whether something is a startup program, but it does not remove the malware itself.