shreemo

Q: remove megabackup app

Hi,

I am a different user than the original poster, but seem to be having the same problems.  The screenshots you requested are below, along with some others.

 

I am having the same problem as all of the posters from this thread (https://discussions.apple.com/message/29033126#29033126 ) who have not been able to remove the MegaBackup program.  Namely, the MegaBackupAgent process will not allow me to "Force Quit".

 

I was able to kill the process for "MegaBackup," and once I did that, I was finally able to put the application in the trash (prior to that it just told me that I had to quit the MegaBackup program even though I had done so and it did not show up in the Force Quit Window--see screenshot).  Despite this, Safari still pops up notification windows and still seems to hijack my internet browser with notifications that my system has not been backed up. I have tried multiple methods of removing this program completely over the past several days, and things are still popping up.

 

I believe my children downloaded the program either through a bogus Flashplayer update (see screenshot of Chrome History) or through the program "Roblox" on October 23 or 24.  I am not sure exactly, but based on when the problems started and when they started complaining about popups, I went through the history and activity monitor to see what they had been doing.  And my best guess is that they managed to download the adware somewhere in that timeframe and via one of those programs.

 

Also, I went through the tutorials on reedcorner.net/arg to remove adware, and found Bundlore and others (Advanced Mac Cleaner and "installer.mac" or something like that) and removed them manaully.  But those tutorials are from 2013 as near as I can tell, and using their methods to try to find MegaBackup has not helped me find it.

 

Also about 15 minutes ago, I downloaded MalwareBytes, which found something, but it was not called "MegaBackup" and did not seem associated with it that I could tell.  I also just uninstalled MalwareBytes because I am not 100% sure it is trustworthy.  Reasonably sure, but not completely sure.  So I took it off.  You can see a LaunchDaemon for it below.  Should I remove that in addition to having put the application in the trash?

 

I am running a late 2012 iMac with OSX 10.9.5.

 

Thanks in advance!

Screen Shot 2015-10-26 at 12.15.56 PM.pngScreen Shot 2015-10-24 at 4.22.06 PM.png

Screen Shot 2015-10-26 at 12.32.49 PM.pngScreen Shot 2015-10-26 at 12.33.36 PM.png

Posted on Oct 26, 2015 12:02 PM

Close

Q: remove megabackup app

  • All replies
  • Helpful answers

  • by shreemo,

    shreemo shreemo Oct 26, 2015 12:01 PM in response to shreemo
    Level 1 (0 points)
    Oct 26, 2015 12:01 PM in response to shreemo

    Oh, here is the Chrome Extension Screenshot

    Screen Shot 2015-10-26 at 1.00.07 PM.png

  • by Linc Davis,

    Linc Davis Linc Davis Oct 26, 2015 8:38 PM in response to shreemo
    Level 10 (208,000 points)
    Applications
    Oct 26, 2015 8:38 PM in response to shreemo
    I also just uninstalled MalwareBytes because I am not 100% sure it is trustworthy.

    No "anti-virus" or "anti-malware" software is trustworthy, and you should never install any software, trustworthy or not, unless it serves some useful purpose, which that doesn't.

     

    The screenshots that you posted don't show any malware, but you may have left out the LaunchAgents folder inside your home library folder.

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

  • by John Galt,

    John Galt John Galt Oct 27, 2015 10:31 AM in response to shreemo
    Level 8 (49,522 points)
    Mac OS X
    Oct 27, 2015 10:31 AM in response to shreemo

    ... I also just uninstalled MalwareBytes because I am not 100% sure it is trustworthy.  Reasonably sure, but not completely sure.  So I took it off.  You can see a LaunchDaemon for it below.

     

    LaunchDaemons are processes called by launchd and operate without any graphical user interface, or what might be described as "in the background". As such it can be difficult or impossible for a user to be aware of what they are doing or to even know they are present. For example, installing Google products such as Google Chrome litters a Mac with a plethora of "helpers" as well as a service that automatically checks for updates and pushes them to your Mac without your knowledge or intervention. Since those processes run at a privileged level, it is capable of performing other tasks known only to Google. Given that Google's sole reason for existence is to harvest personal information from all the Internet-connected devices you use, for purposes known only to it, one can assume that is at least one of its LaunchAgent and LaunchDaemon purposes.

     

    As a rule I do not install those things for several reasons, not the least of which is that they can cause unexpected behavior. The onset of that behavior can appear to be spontaneous, due to the way LaunchDaemons are designed to work. Google Chrome for example remains a notorious, directly attributable cause of poor Mac performance, many years after having first released it for OS X.

     

    You wrote that you uninstalled "MalwareBytes" but as long as a "helper tool" remains installed in LaunchDaemons you cannot be certain of its effects on your Mac or the information it contains. A properly implemented uninstallation utility should remove all components of the program it was designed to remove. For example, Adobe's Flash Player uninstaller does that and will remove those components from your system. As far as I know Google's uninstallation instructions work also. I do not know what "examsoft" does but I assume you know its purpose, that you are certain you need it, and know how to get rid of it when you don't want it any more. You should not install something unless you know the answers to those questions in advance. Not knowing is how adware gets installed to begin with, a subject I address in How to install adware. Recognition and avoidance is the only reliable way to avoid being affected by it.

     

    Another significant concern exists: your Time Machine icon indicates a problem with it that needs to be addressed. If you have a reliable backup created prior to installing "Megabackup" or "Malwarebytes" the easiest way to undo their effects is to restore your entire system, but only you can determine if you have that backup.

     

    I won't address removing "Megabackup" in your case because I do not use Chrome, for the reasons stated above. If you were to ask my opinion it would be a better idea to remove Chrome.

     

    Lastly if you allow others to use your Mac they should at least have their own User accounts, and should not be allowed to administer your Mac unless you want someone else to be able to alter it in the same manner as you. Never share your login password with anyone. Consider using a "managed account" for minor children. Otherwise, you will continue to leave your Mac vulnerable to this sort of problem, or worse. If you want help with any of that write back.