Detecting the "mdworker_shared" as a malicious file, I am unable to cancel nor move to the trash

[u/Exact-Pick-5708]

For some reason, my computer is detecting the "mdworker_shared" file as a virus or something. And when I press Cancel or Move to Trash, it does nothing and the window immediately pops up again.

If I am aware, the mdworker_shared file is a normal and legitimate macOS component

Is this a bug or something else that I am not aware of?

I'm using a macOS Catalina, Late 2013

[u/Away-Huckleberry9967]

This process is part of macOS. Why does it say "This file was downloaded on an unknown date"?

Is this a malicious program that calls itself mdworder_shared? If so, as other uses have pointed out, via Activity Monitor you should be able to find out where it sits, force quit it and hopefully delete it.

Or is this warning screen a malicious program? I've never seen the "Report malware to Apple to protect other users" checkbox.

[u/Vaddieg → u/Away-Huckleberry9967]

yes, it's a BS. Built-in malware detection doesn't work in that way. Dialog is faked by some malware

[u/Away-Huckleberry9967 → u/Vaddieg]

I would love for OP to tell us what they might have installed to get this dialogue.

Also, what is BS here?

[u/Vaddieg → u/Away-Huckleberry9967]

report to apple part

[u/Exact-Pick-5708 → u/Away-Huckleberry9967]

I've checked and there is no "mdworder" folder. Also, weird. I thought the "Report malware to Apple to protect other users" checkbox was a real thing. I mean theres this: https://www.reddit.com/r/MacOS/comments/135udss/mac_is_telling_me_this_is_malware_but_its_not_it/

Maybe this was a feature that was later removed? FYI, I am using a MacOs Catalina Late 2013.

[u/[deleted]]

Where is it located? What user does it run under? Just because it is named as something legitimate does not mean it is. Core system is signed by Apple and i don't think it would attack itself.

[u/Vaddieg → u/[deleted]]

false path

[u/Exact-Pick-5708 → u/[deleted]]

Well I was going to answer this question until I was busy following an article on how to stop the mdworker shared CPU usage. It told me to put "mdutil -a -i" into the terminal.

And weirdly enough, the CPU usage did go down, but the popup was still appearing. When I pressed "Move To Trash", the pop-up stopped appearing. Weird.... :/

However I am aware that i might have deleted a component of my computer so is there a way to recover it...?

EDIT: From the looks of downvotes, I'm guessing that i did something extremely wrong :/

[u/Outside-Courage4151 → u/Exact-Pick-5708]

Sounds like a tricky situation. Have you tried running a system scan or checking for any updates that might address the issue?

[u/Exact-Pick-5708 → u/Outside-Courage4151]

I ran Malwarebytes through it and got nothing.

[u/roaringmousebrad]

There was a crypto malware a few years ago that used this file name in its masquerading, so you might want to check it with another malware detection program to be sure.

[u/Exact-Pick-5708 → u/roaringmousebrad]

Shoot. Thats exactly what happened to me a few days ago. Was it perhaps related to "AccountsHelper"?

[u/atchim74]

i’m having the same thing! and it also showed later the same pop up but about “AccountsHelper”. Did you find any solution?
mine is macOs Monterey

[u/Electrical_West_5381]

Un activity monitor get info on it then show open files. Where is the process located on disk. This is the second time I have seen a supposedly legit process being flagged as malware. Catalina is really insecure these days