MacOS – Apple wants to make changes

macospasswordsafari

I get a persistent pop-up window that states:
Apple wants to make changes. (See pic below)

Before I mindlessly press OK, I'd like to know what the action is about.

Can anyone suggest how I might find out more about what is involved?

  • No application appears to be involved by name.
  • The icon shows a "console" window inset over the locked padlock.
  • I was running Safari 11.1.2 build 12605.3.8.1 on macOS Sierra 10.12.6
  • It remained onscreen after I quit Safari.
  • It requires three cancels to cancel.
  • has recurred maybe half-a-dozen times in the last week.

Note: I have removed the user name which appears correctly for my account.

Apple changes pop-up window

UPDATE (Edit)

As per a suggestion in the comments, I ran Activity Monitor. It runs okay; but, I don't know what to look for so I tried all the variations I could think of without any Eureka moment.

Not very much later, I got this pop-up window asking for password permission to make changes. My User Name was right (erased from the screen-grab). Although the window identified the Activity Monitor as the application, there was no ? in the lower left corner for any more detail.

Activity Monitor changes pop-up window

I decided to click OK without password and it hated that. After a few tries, the window tried giving me my original password hint from the OS set-up. It took three "Cancel" clicks to go away. It hasn't recurred.

Meanwhile, the first anonymous "Apple wants… " pop-up window appears, from time to time, during Safari use. Occasionally, Safari becomes unstable and the main window closes.

UPDATE (Edit) Problem Resolved.

Today was a slow news day so I called Apple support who encouraged me to download and install Malwarebytes (Tip of the hat to them) which identified the location of suspicious files as similar to ones I found according to Apple Support discussion thread found in the answer given by Ashley.

The plist was a simple run-on-load and the other file was an executable and my unix is a bit…
non-existent.

The Files found were:
~/Library/Application Support/com.SearchProvided
~/Library/LaunchAgents/com.SearchProvided.plist

Best Answer

There's a mention of "Apple wants to make changes" in this Apple discussions thread. Someone there ran Malwarebytes, which found "Adware.OperatorMac", and mentions the following files:

~/Library/Application Support/com.SearchSystem
~/Library/LaunchAgents/com.SearchSystem.plist

So, if you have those files, that would seem a good place to find out more.

I don't have 10.12.6 installed at the moment, but I do have machines running 10.11.6 and 10.13.6. I don't have those files on either machine, so they aren't part of a standard install.

If you do have these files, perhaps you could post their contents as an update?

Related Question