If there is an item with the same name as in Step 3, or any of the other names listed in Step 2, drag it to the Trash. Open this folder in the same way as above:Īnd move to the Trash any subfolders named with the same something you found in Step 2.ĭon't move the Application Support folder or anything else inside it.Ĥ. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.ģ. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.) There may not be any other files in the LaunchAgents folder in that case, you can delete the folder, but otherwise don't delete it. You could have more than one copy of the malware, with different values of something. The point is that the same string will appear in the name of three files. Where something is usually a meaningless string, such as any of the following: Inside the folder you just opened, there may files with a name of the form A folder named "LaunchAgents" will open.Ģ. You won't see what you pasted because a line break is included. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:įrom the menu bar and paste into the box that opens by pressing command-V. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.ġ. This procedure works as of now, as far as I know. The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. You may also have installed one or more variants of the "InstallMac" trojan. In the Finder, selectįrom the menu bar and paste into the box that opens by pressing command-V. *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. Log out or restart the computer and empty the Trash. In the folder, there may be one or more files with a name beginning as follows: Right-click or control-click the highlighted line and selectįrom the contextual menu.* A folder named "LaunchAgents" should open. Triple-click anywhere in the line below on this page to select it: Quit the "ZipCloud" or "JustCloud" application, if it's running, and drag it from the Applications folder to the Trash. To remove ZipCloud, start by backing up all data (not with ZipCloud itself, of course.) Although ZipCloud may not be malicious itself, it should be suspected by virtue of the company it keeps. The OS X client is sometimes distributed along with malware. "ZipCloud," sometimes named "JustCloud," is a cloud-storage service with a doubtful reputation. ☞ Don't try to remove MacKeeper while running in safe mode. ☞ Don't try to drag MacKeeper from the Dock or the Launchpad to the Trash. ☞ Let MacKeeper delete its other components before you empty the Trash. ☞ Quit MacKeeper before dragging it to the Trash. Restart the computer and empty the Trash. All the other functional components of the software will be deleted. Click the Uninstall MacKeeper button in the dialog that appears. You'll be prompted for your login password. Quit it if it's running, then drag it to the Trash. The "MacKeeper" application is in the folder that opens. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.įrom the menu bar, or press the key combination shift-command-A. In my tests, I didn't try to verify what this feature really does. IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. If you have incompletely removed MacKeeper-for example, by dragging the application to the Trash and immediately emptying-then you'll have to reinstall it and start over. I can't be sure that they apply to other versions. Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. "MacKeeper" is a scam with only one useful feature: it deletes itself.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |