Q: Downloaded something called InKeepr and it is impossible to remove from my Mac, please help. There is nothing out there about this!

Question

ychirea1

Level 1 (5 points)

Q: Downloaded something called InKeepr and it is impossible to remove from my Mac, please help. There is nothing out there about this!

I downloaded something by mistake from a site called InKeepr and now I can't get it off of my Mac. I am afraid to go back to the site for help uninstalling it because it is obviously malicious. What is odd is that I can't find anything about this. Please check this out for me. It has infected all of my browsers when I open them it opens to InKeeper browser. Please help. thanks!

MacBook Pro, OS X Yosemite (10.10.3)

Posted on Jun 3, 2015 10:46 AM

I have this question too

Solved

Linc Davis

Level 10 (207,963 points)

Applications

A:

You installed a new variant of the "Genieo" trojan. DO NOT follow the attacker's uninstallation directions.

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Another indication that the test is safe can be found in this thread, and this one, for example, where the comment in which I suggested it was recommended by one of the Apple Community Specialists, as explained here.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy a particular line of text to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.

You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") The title of the page is "Diagnostic Test." Below the title is a text box headed by three small icons. The one on the right represents a clipboard. Click that icon to select the text, then copy it to the Clipboard on your computer by pressing the key combination command-C.

If the text doesn't highlight when you click the icon, select it by triple-clicking anywhere inside the box. Don't select the whole page, just the text in the box.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

[Process started]

        Part 1 of 8 done at … sec
        …
        Part 8 of 8 done at … sec

        The test results are on the Clipboard.

        Please close this window.

[Process completed]

The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.

12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you're told to do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

______________________________________________________________

Copyright © 2014, 2015 by Linc Davis. As the sole author of this work (including the referenced "Diagnostic Test"), I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Posted on Jun 3, 2015 1:34 PM

Q: Downloaded something called InKeepr and it is impossible to remove from my Mac, please help. There is nothing out there about this ... more

All replies

Helpful answers

first Page 7 of 7

by amcq,

amcq Aug 18, 2015 6:47 PM in response to Linc Davis
Level 1 (5 points)

Aug 18, 2015 6:47 PM in response to Linc Davis

It worked. Thanks
Reply options

Link to this post

by ASilberkleit,

ASilberkleit Aug 22, 2015 11:15 AM in response to ychirea1
Level 1 (0 points)

Aug 22, 2015 11:15 AM in response to ychirea1

   1 Start time: 13:42:20 08/22/15
   2
   3 Revision: 1333
   4
   5 Model Identifier: iMac10,1
   6 Memory: 4 GB
   7 System Version: Mac OS X 10.7.5 (11G63b)
   8 Kernel Version: Darwin 11.4.2
   9 64-bit Kernel and Extensions: Yes
10 Time since boot: 2 days 19:59
11
12 SerialATA
13
14      ST31000528ASQ
15
16 USB
17
18      Rugged FW USB3 (LaCie)
19
20 Bluetooth
21
22      Apple Wireless Keyboard
23      Apple Wireless Mouse
24
25 Activity
26
27      CPU: user 25%, system 9%
28
29 CPU usage (%)
30
31      WebProcess (UID 501): 21.7
32
33 System errors (per sec)
34
35      Creative Cloud (UID 501, error 60): 169
36
37 Font issues: 20
38
39 DNS: 75.75.75.75
40
41 Wi-Fi
42
43      Security: None
44
45 Diagnostic reports
46
47      2015-07-31 AppDS crash
48      2015-07-31 AppYM crash x3
49      2015-07-31 System Preferences crash
50      2015-07-31 launchd crash x7
51      2015-08-12 WebProcess crash
52      2015-08-21 crsud crash x2
53
54 Kernel log
55
56      Aug 19 17:44:29 SMC::smcInitHelper ERROR: MMIO regMap == NULL - fall back to old SMC mode
57      Aug 19 17:44:30 SMC::smcReadKeyAction ERROR: smcReadData8 failed for key BEMB (kSMCKeyNotFound)
58      Aug 19 17:44:43 hfs_mountfs: hfs_early_journal_init failed, erroring out
59      Aug 20 20:10:41 SMC::smcGetKeyInfoAction ERROR CLWK kSMCKeyNotFound(0x84) fKeyHashTable=0x0xffffff800b08f000
60      Aug 21 17:43:08 SMC::smcGetKeyInfoAction ERROR CLWK kSMCKeyNotFound(0x84) fKeyHashTable=0x0xffffff800b08f000
61
62 System log
63
64      Aug 19 17:44:51 airportd: _doAutoJoin: Already associated to “xfinitywifi”. Bailing on auto-join.
65      Aug 19 17:44:55 SecurityAgent: User info context values set for admin
66      Aug 19 17:44:55 SecurityAgent: Login Window login proceeding
67      Aug 19 17:47:58 mdworker32: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
68      Aug 19 17:48:01 mdworker32: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
69      Aug 19 18:13:18 mDNSResponder: 48: Could not write data to client because of error - aborting connection
70      Aug 19 18:23:48 airportd: _doAutoJoin: Already associated to “HOME-6AE2_EXT”. Bailing on auto-join.
71      Aug 19 18:23:48 airportd: _doAutoJoin: Already associated to “HOME-6AE2_EXT”. Bailing on auto-join.
72      Aug 19 18:23:50 ntpd: bind(26) AF_INET6 2601:14d:4100:e3b4:d69a:20ff:fe5d:e9ef#123 flags 0x11 failed: Can't assign requested address
73      Aug 19 18:23:50 ntpd: unable to create socket on en1 (8) for 2601:14d:4100:e3b4:d69a:20ff:fe5d:e9ef#123
74      Aug 19 18:32:17 mDNSResponder: send_msg ERROR: failed to write 76 of 76 bytes to fd 12 errno 57 (Socket is not connected)
75      Aug 19 18:32:17 mDNSResponder: 12: Could not write data to client because of error - aborting connection
76      Aug 19 19:01:06 mDNSResponder: 12: Could not write data to client because of error - aborting connection
77      Aug 19 19:49:26 mDNSResponder: 12: Could not write data to client because of error - aborting connection
78      Aug 20 20:10:58 airportd: _doAutoJoin: Already associated to “xfinitywifi”. Bailing on auto-join.
79      Aug 20 20:10:59 ntpd: bind(25) AF_INET6 fe80::d69a:20ff:fe5d:e9ef%5#123 flags 0x11 failed: Can't assign requested address
80      Aug 20 20:10:59 ntpd: unable to create socket on en1 (13) for fe80::d69a:20ff:fe5d:e9ef#123
81      Aug 21 22:02:32 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD
82      Aug 21 22:03:44 installd: PackageKit: ----- Begin stage -----
83      Aug 21 22:04:25 installd: PackageKit: ----- End stage -----
84      Aug 21 22:09:49 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD
85      Aug 22 04:54:37 Dock: kCGErrorIllegalArgument: CGSReleaseWindow: Invalid window 223
86      Aug 22 04:54:37 Dock: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
87      Aug 22 04:54:37 Dock: kCGErrorIllegalArgument: CGSReleaseWindow: Invalid window 224
88      Aug 22 04:54:37 Dock: kCGErrorIllegalArgument: CGSReleaseWindow: Invalid window 226
89
90 launchd log
91
92      Aug 16 11:29:49 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
93      Aug 16 14:29:43 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
94      Aug 16 17:29:38 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
95      Aug 16 20:29:33 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
96      Aug 16 23:29:27 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
97      Aug 17 02:29:22 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
98      Aug 17 05:29:17 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
99      Aug 17 08:29:11 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
100      Aug 17 11:29:06 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
101      Aug 17 14:29:00 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
102      Aug 19 17:44:11 com.apple.powerd: Unknown value for key POSIXSpawnType: Interactive
103      Aug 19 17:44:11 com.apple.sandboxd: Unknown value for key POSIXSpawnType: Interactive
104      Aug 19 17:44:11 com.apple.usbmuxd: Unknown value for key POSIXSpawnType: Interactive
105      Aug 19 17:44:39 : FAILURE: Could not send MIG reply: 0x10000003
106      Aug 19 17:44:56 com.apple.AirPortBaseStationAgent: Unknown value for key POSIXSpawnType: Background
107      Aug 19 17:45:56 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
108      Aug 19 20:44:50 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
109      Aug 20 20:40:54 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
110      Aug 21 19:02:54 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
111      Aug 21 22:02:55 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
112      Aug 22 01:02:50 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
113      Aug 22 04:02:51 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
114      Aug 22 07:02:47 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
115      Aug 22 10:02:47 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
116      Aug 22 13:02:45 com.facebook.videochat.NAME.updater: Tried to setup shared memory more than once
117
118 Console log
119
120      Aug 16 01:30:07 SubmitDiagInfo: Cleaning up expired diagnostic messages database at path: /var/log/DiagnosticMessages/2015.07.17.asl
121      Aug 17 01:29:24 SubmitDiagInfo: Cleaning up expired diagnostic messages database at path: /var/log/DiagnosticMessages/2015.07.18.asl
122      Aug 19 21:44:54 SubmitDiagInfo: Cleaning up expired diagnostic messages database at path: /var/log/DiagnosticMessages/2015.07.20.asl
123      Aug 19 21:44:54 SubmitDiagInfo: Cleaning up expired diagnostic messages database at path: /var/log/DiagnosticMessages/2015.07.19.asl
124      Aug 22 02:02:48 SubmitDiagInfo: Cleaning up expired diagnostic messages database at path: /var/log/DiagnosticMessages/2015.07.22.asl
125
126 System services loaded
127
128      com.adobe.fpsaud
129      com.apple.xprotectupdater
130      - status: 252
131      com.microsoft.office.licensing.helper
132
133 Agent services loaded
134
135      Epolife.download
136      Epolife.ltvbit
137      Epolife.update
138      Kuklorest.download
139      Kuklorest.ltvbit
140      Kuklorest.update
141      com.adobe.AAM.Scheduler-1.0
142      com.adobe.AdobeCreativeCloud
143      com.apple.launchctl.Aqua
144      - status: 1
145      com.apple.mrt.uiagent
146      - status: 255
147      com.facebook.videochat.NAME.updater
148
149 Global login items
150
151      /Library/Application Support/ArcSoft/Connect Service/ConnectService.app
152
153 User login items
154
155      iTunesHelper
156      - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
157      Spotify
158      - /Applications/Spotify.app
159      Dropbox
160      - /Applications/Dropbox.app
161      InKeepr
162      - /Applications/InKeepr.app
163      ConnectService
164      - /Library/Application Support/ArcSoft/Connect Service/ConnectService.app
165
166 Safari extensions
167
168      Cuevana Stream
169      - com.cuevana.cuevanastream
170      Kuklorest
171      - com.kuklorest.safari
172      Yontoo
173      - com.yontoo
174
175 Widgets
176
177      FlipClock
178
179 Restricted files: 122
180
181 Lockfiles: 1
182
183 High file counts
184
185      Desktop: 228
186
187 Global prefs (user)
188
189      AppleAntiAliasingThreshold = 4
190      AppleAquaColorVariant = 6
191      AppleCollationOrder = root
192      AppleHighlightColor = "0.357294 0.710407 0.625770"
193      AppleLocale = "en_US"
194      AppleMiniaturizeOnDoubleClick = 1
195      AppleScrollAnimationEnabled = 1
196      AppleScrollerPagingBehavior = 1
197      NSAutomaticSpellingCorrectionEnabled = 1
198      NSNavPanelFileLastListModeForOpenModeKey = 3
199      NSNavPanelFileLastListModeForSaveModeKey = 1
200      NSNavPanelFileListModeForOpenMode2 = 3
201      NSNavPanelFileListModeForSaveMode2 = 1
202      NavPanelFileListModeForOpenMode = 1
203      NavPanelFileListModeForSaveMode = 1
204      WebAutomaticSpellingCorrectionEnabled = 1
205      "com.apple.sound.beep.feedback" = 0
206      "com.apple.springing.delay" = "0.5"
207      "com.apple.springing.enabled" = 1
208      "com.apple.swipescrolldirection" = 0
209
210 Universal Access
211
212      Zoom: On
213
214 Contents of /System/Library/LaunchAgents/com.apple.iCalPush.plist
215      - mod date: Nov 16 16:36:00 2011
216      - size (B): 690
217      - checksum: 2684394709
218
219      <?xml version="1.0" encoding="UTF-8"?>
220      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
221      <plist version="1.0">
222          <dict>
223              <key>Label</key>
224              <string>com.apple.iCalPush</string>
225              <key>LimitLoadToSessionType</key>
226              <array>
227                  <string>LoginWindow</string>
228                  <string>Aqua</string>
229              </array>
230              <key>MachServices</key>
231              <dict>
232                  <key>com.apple.iCalPush</key>
233                  <true/>
234              </dict>
235              <key>ProgramArguments</key>
236              <array>
237                  <string>/Applications/iCal.app/Contents/Resources/iCalPush</string>
238              </array>
239          </dict>
240      </plist>
241
242 Contents of /System/Library/LaunchAgents/org.x.startx.plist
243      - mod date: Nov 16 16:38:08 2011
244      - size (B): 562
245      - checksum: 355348819
246
247      <?xml version="1.0" encoding="UTF-8"?>
248      <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
249      <plist version="1.0">
250      <dict>
251       <key>Label</key>
252       <string>org.x.startx</string>
253       <key>ProgramArguments</key>
254       <array>
255       <string>/usr/X11/bin/startx</string>
256       </array>
257       <key>Sockets</key>
258       <dict>
259       <key>org.x:0</key>
260       <dict>
261       <key>SecureSocketWithKey</key>
262       <string>DISPLAY</string>
263       </dict>
264       </dict>
265       <key>ServiceIPC</key>
266       <true/>
267       <key>EnableTransactions</key>
268       <true/>
269      </dict>
270      </plist>
271
272 Contents of /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist
273      - mod date: Sep 9 12:44:10 2013
274      - size (B): 512
275      - checksum: 118890852
276
277      <?xml version="1.0" encoding="UTF-8"?>
278      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
279      <plist version="1.0">
280      <dict>
281       <key>Label</key>
282       <string>com.apple.xprotectupdater</string>
283       <key>ProgramArguments</key>
284       <array>
285       <string>/usr/libexec/XProtectUpdater</string>
286       </array>
287       <key>RunAtLoad</key>
288       <true/>
289       <key>StartCalendarInterval</key>
290       <dict>
291       <key>Hour</key>
292       <integer>5</integer>
293       <key>Minute</key>
294       <integer>3</integer>
295       </dict>
296      </dict>
297      </plist>
298
299 Contents of Library/LaunchAgents/Epolife.download.plist
300      - mod date: Aug 13 22:02:17 2015
301      - size (B): 813
302      - checksum: 3056726556
303
304      <?xml version="1.0" encoding="UTF-8"?>
305      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
306      <plist version="1.0">
307      <dict>
308       <key>Label</key>
309       <string>Epolife.download</string>
310       <key>ProgramArguments</key>
311       <array>
312       <string>/Users/USER/Library/Application Support/Epolife/Epolife.app/Contents/MacOS/AppYM</string>
313       <string>-trigger</string>
314       <string>download</string>
315       <string>-isDev</string>
316       <string>0</string>
317       <string>-installVersion</string>
318       <string>18723</string>
319       <string>-firstAppId</string>
320       <string>1433244704078568</string>
321       <string>-identity</string>
322       <string>Epolife</string>
323       </array>
324       <key>WatchPaths</key>
325       <array>
326       <string>/Users/USER/Downloads</string>
327       </array>
328       <key>isAllowToSuggest</key>
329
330      ...and 3 more line(s)
331
332 Contents of Library/LaunchAgents/Epolife.ltvbit.plist
333      - mod date: Aug 13 22:02:17 2015
334      - size (B): 808
335      - checksum: 982947526
336
337      <?xml version="1.0" encoding="UTF-8"?>
338      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
339      <plist version="1.0">
340      <dict>
341       <key>Label</key>
342       <string>Epolife.ltvbit</string>
343       <key>ProgramArguments</key>
344       <array>
345       <string>/Users/USER/Library/Application Support/Epolife/Epolife.app/Contents/MacOS/AppYM</string>
346       <string>-trigger</string>
347       <string>ltvbit</string>
348       <string>-isDev</string>
349       <string>0</string>
350       <string>-installVersion</string>
351       <string>18723</string>
352       <string>-firstAppId</string>
353       <string>1433244704078568</string>
354       <string>-identity</string>
355       <string>Epolife</string>
356       </array>
357       <key>StartCalendarInterval</key>
358       <dict>
359       <key>Hour</key>
360       <integer>4</integer>
361       <key>Minute</key>
362
363      ...and 4 more line(s)
364
365 Contents of Library/LaunchAgents/Epolife.update.plist
366      - mod date: Aug 13 22:02:17 2015
367      - size (B): 950
368      - checksum: 1340172332
369
370      <?xml version="1.0" encoding="UTF-8"?>
371      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
372      <plist version="1.0">
373      <dict>
374       <key>Label</key>
375       <string>Epolife.update</string>
376       <key>ProgramArguments</key>
377       <array>
378       <string>/Users/USER/Library/Application Support/Epolife/Epolife.app/Contents/MacOS/AppYM</string>
379       <string>-trigger</string>
380       <string>update</string>
381       <string>-isDev</string>
382       <string>0</string>
383       <string>-installVersion</string>
384       <string>18723</string>
385       <string>-firstAppId</string>
386       <string>1433244704078568</string>
387       <string>-identity</string>
388       <string>Epolife</string>
389       <string>-sig</string>
390       <string>YAIR_SIGNATURE</string>
391       <string>-agentUpdate</string>
392       <string>0</string>
393       </array>
394       <key>RunAtLoad</key>
395
396      ...and 10 more line(s)
397
398 Contents of Library/LaunchAgents/Kuklorest.download.plist
399      - mod date: Jul 31 18:47:54 2015
400      - size (B): 821
401      - checksum: 1272821516
402
403      <?xml version="1.0" encoding="UTF-8"?>
404      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
405      <plist version="1.0">
406      <dict>
407       <key>Label</key>
408       <string>Kuklorest.download</string>
409       <key>ProgramArguments</key>
410       <array>
411       <string>/Users/USER/Library/Application Support/Kuklorest/Kuklorest.app/Contents/MacOS/AppDS</string>
412       <string>-trigger</string>
413       <string>download</string>
414       <string>-isDev</string>
415       <string>0</string>
416       <string>-installVersion</string>
417       <string>18723</string>
418       <string>-firstAppId</string>
419       <string>1436194824910598</string>
420       <string>-identity</string>
421       <string>Kuklorest</string>
422       </array>
423       <key>WatchPaths</key>
424       <array>
425       <string>/Users/USER/Downloads</string>
426       </array>
427       <key>isAllowToSuggest</key>
428
429      ...and 3 more line(s)
430
431 Contents of Library/LaunchAgents/Kuklorest.ltvbit.plist
432      - mod date: Jul 31 18:47:54 2015
433      - size (B): 816
434      - checksum: 3374335082
435
436      <?xml version="1.0" encoding="UTF-8"?>
437      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
438      <plist version="1.0">
439      <dict>
440       <key>Label</key>
441       <string>Kuklorest.ltvbit</string>
442       <key>ProgramArguments</key>
443       <array>
444       <string>/Users/USER/Library/Application Support/Kuklorest/Kuklorest.app/Contents/MacOS/AppDS</string>
445       <string>-trigger</string>
446       <string>ltvbit</string>
447       <string>-isDev</string>
448       <string>0</string>
449       <string>-installVersion</string>
450       <string>18723</string>
451       <string>-firstAppId</string>
452       <string>1436194824910598</string>
453       <string>-identity</string>
454       <string>Kuklorest</string>
455       </array>
456       <key>StartCalendarInterval</key>
457       <dict>
458       <key>Hour</key>
459       <integer>4</integer>
460       <key>Minute</key>
461
462      ...and 4 more line(s)
463
464 Contents of Library/LaunchAgents/Kuklorest.update.plist
465      - mod date: Jul 31 18:47:54 2015
466      - size (B): 959
467      - checksum: 1674085839
468
469      <?xml version="1.0" encoding="UTF-8"?>
470      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
471      <plist version="1.0">
472      <dict>
473       <key>Label</key>
474       <string>Kuklorest.update</string>
475       <key>ProgramArguments</key>
476       <array>
477       <string>/Users/USER/Library/Application Support/Kuklorest/Kuklorest.app/Contents/MacOS/AppDS</string>
478       <string>-trigger</string>
479       <string>update</string>
480       <string>-isDev</string>
481       <string>0</string>
482       <string>-installVersion</string>
483       <string>18723</string>
484       <string>-firstAppId</string>
485       <string>1436194824910598</string>
486       <string>-identity</string>
487       <string>Kuklorest</string>
488       <string>-sig</string>
489       <string>DANI_SIGNATURE</string>
490       <string>-agentUpdate</string>
491       <string>0</string>
492       </array>
493       <key>RunAtLoad</key>
494
495      ...and 10 more line(s)
496
497 Contents of Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
498      - mod date: Mar 18 13:46:05 2014
499      - size (B): 618
500      - checksum: 196709553
501
502      <?xml version="1.0" encoding="UTF-8"?>
503      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
504      <plist version="1.0">
505      <dict>
506       <key>Label</key>
507       <string>com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID</string>
508       <key>ProgramArguments</key>
509       <array>
510       <string>/System/Library/Frameworks/AddressBook.framework/Resources/AddressBookS ourceSyncScheduleHelper</string>
511       <string>-scheduleSync</string>
512       <string>UUID</string>
513       </array>
514       <key>StartInterval</key>
515       <integer>120000</integer>
516      </dict>
517      </plist>
518
519 Contents of Library/LaunchAgents/com.facebook.videochat.NAME.plist
520      - mod date: Aug 10 09:24:53 2014
521      - size (B): 796
522      - checksum: 3199381270
523
524      <?xml version="1.0" encoding="UTF-8"?>
525      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
526      <plist version="1.0">
527      <dict>
528        <key>Label</key>
529        <string>com.facebook.videochat.NAME.updater</string>
530        <key>ProgramArguments</key>
531        <array>
532          <string>/usr/bin/java</string>
533          <string>-cp</string>
534          <string>/Users/USER/Library/Application Support/Facebook/video/3.1.0.522/FacebookUpdate.jar</string>
535          <string>FacebookUpdate</string>
536          <string>com.facebook.peep</string>
537          <string>3.1.0.522</string>
538        </array>
539        <key>RunAtLoad</key>
540        <true/>
541        <key>StartInterval</key>
542        <integer>10800</integer>
543        <key>StandardErrorPath</key>
544        <string>/dev/null</string>
545        <key>StandardOutPath</key>
546        <string>/dev/null</string>
547      </dict>
548      </plist>
549
550 Bad plists
551
552      Library/Preferences/com.solidstatenetworks.awkhost.plist
553
554 Applications
555
556      /Applications/Address Book.app
557      - com.apple.AddressBook
558      /Applications/Adobe Illustrator CC/Adobe Illustrator.app
559      - com.adobe.illustrator
560      /Applications/Adobe Illustrator CC/Scripting.localized/Sample Scripts.localized/AppleScript.localized/Analyze Documents.localized/Analyze Documents.app
561      - N/A
562      /Applications/Adobe Illustrator CC/Scripting.localized/Sample Scripts.localized/AppleScript.localized/Calendar.localized/Make Calendar.app
563      - N/A
564      /Applications/Adobe Illustrator CC/Scripting.localized/Sample Scripts.localized/AppleScript.localized/Contact Sheet Demo.localized/Contact Sheets.app
565      - N/A
566      /Applications/Adobe Illustrator CC/Scripting.localized/Sample Scripts.localized/AppleScript.localized/Export Flash Animation.localized/Export Flash Animation.app
567      - N/A
568      /Applications/Adobe Illustrator CC/Scripting.localized/Sample Scripts.localized/AppleScript.localized/Web Gallery.localized/Web Gallery.app
569      - N/A
570      /Applications/Adobe InDesign CC/Adobe InDesign CC.app
571      - com.adobe.InDesign
572      /Applications/Adobe Lightroom 3.app
573      - com.adobe.Lightroom3
574      /Applications/Adobe Media Encoder CC/Adobe Media Encoder CC.app
575      - com.adobe.ame.application
576      /Applications/Adobe Photoshop CC/Adobe Photoshop CC.app
577      - com.adobe.Photoshop
578      /Applications/Adobe/Adobe Content Viewer.app
579      - com.adobe.dmp.contentviewer
580      /Applications/App Store.app
581      - com.apple.appstore
582      /Applications/ArcSoft Connect Suite/Start ArcSoft Connect.app
583      - com.arcsoft.StartService
584      /Applications/ArcSoft Connect Suite/View My ArcSoft Info.app
585      - com.arcsoft.DataViewer
586      /Applications/Automator.app
587      - com.apple.Automator
588      /Applications/Calculator.app
589      - com.apple.calculator
590      /Applications/Chess.app
591      - com.apple.Chess
592      /Applications/DPS App Builder.app
593      - com.adobe.ViewerBuilder
594      /Applications/DVD Player.app
595      - com.apple.DVDPlayer
596      /Applications/Dashboard.app
597      - com.apple.dashboardlauncher
598      /Applications/Dictionary.app
599      - com.apple.Dictionary
600      /Applications/Dropbox.app
601      - com.getdropbox.dropbox
602      /Applications/Epolife/Uninstall Epolife.app
603      - com.ymeshul.AppYM
604      /Applications/FaceTime.app
605      - com.apple.FaceTime
606      /Applications/Font Book.app
607      - com.apple.FontBook
608      /Applications/GarageBand.app
609      - com.apple.garageband
610      /Applications/GoToMeeting (1132).app
611      - com.citrixonline.GoToMeeting
612      /Applications/Google SketchUp 8/SketchUp.app
613      - com.google.sketchupfree8
614      /Applications/Image Capture.app
615      - com.apple.Image_Capture
616      /Applications/InKeepr.app
617      - com.inkeepr.InKeepr
618      /Applications/Instant.app
619      - com.thinktimecreations.Instant
620      /Applications/Kuklorest/Uninstall Kuklorest.app
621      - com.dshovev.AppDS
622      /Applications/Launchpad.app
623      - com.apple.launchpad.launcher
624      /Applications/Mail.app
625      - com.apple.mail
626      /Applications/Microsoft Communicator.app
627      - com.microsoft.Communicator
628      /Applications/Microsoft Messenger.app
629      - com.microsoft.Messenger
630      /Applications/Microsoft Office 2004/Additional Tools/Handheld Sync Installer
631      - com.MindVision.VISEX
632      /Applications/Microsoft Office 2004/Additional Tools/Handheld Sync Installer/Contents/MacOSClassic/Handheld Sync Installer
633      - N/A
634      /Applications/Microsoft Office 2004/Additional Tools/Microsoft Language Register/Microsoft Language Register
635      - N/A
636      /Applications/Microsoft Office 2004/Additional Tools/Remote Desktop Connection/Remote Desktop Connection
637      - N/A
638      /Applications/Microsoft Office 2004/Additional Tools/Remove Office/Remove Office
639      - N/A
640      /Applications/Microsoft Office 2004/Additional Tools/Windows Media Installer
641      - N/A
642      /Applications/Microsoft Office 2004/Additional Tools/Windows Media Installer/Contents/MacOS/Windows Media Installer
643      - N/A
644      /Applications/Microsoft Office 2004/MSN Messenger.app
645      - Microsoft/com.microsoft.Messenger
646      /Applications/Microsoft Office 2004/Microsoft Entourage
647      - N/A
648      /Applications/Microsoft Office 2004/Microsoft Excel
649      - N/A
650      /Applications/Microsoft Office 2004/Microsoft PowerPoint
651      - N/A
652      /Applications/Microsoft Office 2004/Microsoft Word
653      - N/A
654      /Applications/Microsoft Office 2004/Office/Alerts Daemon.app
655      - Microsoft/com.microsoft.AlertsDaemon
656      /Applications/Microsoft Office 2004/Office/Database Utility
657      - N/A
658      /Applications/Microsoft Office 2004/Office/Equation Editor
659      - N/A
660      /Applications/Microsoft Office 2004/Office/Microsoft Cert Manager.app
661      - com.microsoft.certmgr
662      /Applications/Microsoft Office 2004/Office/Microsoft Clip Gallery
663      - N/A
664      /Applications/Microsoft Office 2004/Office/Microsoft Database Daemon
665      - N/A
666      /Applications/Microsoft Office 2004/Office/Microsoft Error Reporting.app
667      - com.microsoft.error_reporting
668      /Applications/Microsoft Office 2004/Office/Microsoft Graph
669      - N/A
670      /Applications/Microsoft Office 2004/Office/Microsoft Office Notifications
671      - N/A
672      /Applications/Microsoft Office 2004/Office/Microsoft Query
673      - N/A
674      /Applications/Microsoft Office 2004/Office/Organization Chart
675      - N/A
676      /Applications/Microsoft Office 2004/Office/Project Gallery Launcher
677      - N/A
678      /Applications/Microsoft Office 2011/Additional Tools/Microsoft Language Register/Microsoft Language Register.app
679      - com.microsoft.languageregister
680      /Applications/Microsoft Office 2011/Microsoft Document Connection.app
681      - com.microsoft.DocumentConnection
682      /Applications/Microsoft Office 2011/Microsoft Excel.app
683      - com.microsoft.Excel
684      /Applications/Microsoft Office 2011/Microsoft Outlook.app
685      - com.microsoft.Outlook
686      /Applications/Microsoft Office 2011/Microsoft PowerPoint.app
687      - com.microsoft.Powerpoint
688      /Applications/Microsoft Office 2011/Microsoft Word.app
689      - com.microsoft.Word
690      /Applications/Microsoft Office 2011/Office/Add-Ins/Solver.app
691      - com.microsoft.ASApplication
692      /Applications/Microsoft Office 2011/Office/Equation Editor.app
693      - com.microsoft.EquationEditor
694      /Applications/Microsoft Office 2011/Office/Microsoft Alerts Daemon.app
695      - com.microsoft.alerts.daemon
696      /Applications/Microsoft Office 2011/Office/Microsoft Chart Converter.app
697      - com.microsoft.openxml.chart.app
698      /Applications/Microsoft Office 2011/Office/Microsoft Clip Gallery.app
699      - com.microsoft.ClipGallery
700      /Applications/Microsoft Office 2011/Office/Microsoft Database Daemon.app
701      - com.microsoft.outlook.databasedaemon
702      /Applications/Microsoft Office 2011/Office/Microsoft Database Utility.app
703      - com.microsoft.outlook.databaseutility
704      /Applications/Microsoft Office 2011/Office/Microsoft Graph.app
705      - com.microsoft.Graph
706      /Applications/Microsoft Office 2011/Office/Microsoft Office Reminders.app
707      - com.microsoft.outlook.officereminders
708      /Applications/Microsoft Office 2011/Office/Microsoft Office Setup Assistant.app
709      - com.microsoft.office.setupassistant
710      /Applications/Microsoft Office 2011/Office/Microsoft Query.app
711      - com.microsoft.Query
712      /Applications/Microsoft Office 2011/Office/Microsoft Upload Center.app
713      - com.microsoft.office.uploadcenter
714      /Applications/Microsoft Office 2011/Office/My Day.app
715      - com.microsoft.myday
716      /Applications/Microsoft Office 2011/Office/Office365Service.app
717      - com.microsoft.Office365Service
718      /Applications/Microsoft Office 2011/Office/Open XML for Excel.app
719      - com.microsoft.openxml.excel.app
720      /Applications/Microsoft Office 2011/Office/SyncServicesAgent.app
721      - com.microsoft.SyncServicesAgent
722      /Applications/Mission Control.app
723      - com.apple.exposelauncher
724      /Applications/Photo Booth.app
725      - com.apple.PhotoBooth
726      /Applications/Preview.app
727      - com.apple.Preview
728      /Applications/Print Creations.app
729      - com.ArcSoft.PrintCreations
730      /Applications/QuickTime Player.app
731      - com.apple.QuickTimePlayerX
732      /Applications/Remote Desktop Connection.app
733      - com.microsoft.rdc
734      /Applications/Safari.app
735      - com.apple.Safari
736      /Applications/SketchUp 2015/LayOut.app
737      - com.sketchup.LayOut.2015
738      /Applications/SketchUp 2015/SketchUp.app
739      - com.sketchup.SketchUp.2015
740      /Applications/SketchUp 2015/Style Builder.app
741      - com.sketchup.StyleBuilder.2015
742      /Applications/Skype.app
743      - com.skype.skype
744      /Applications/Spotify.app
745      - com.spotify.client
746      /Applications/Spotify.tmp.app
747      - com.spotify.client
748      /Applications/Stickies.app
749      - com.apple.Stickies
750      /Applications/System Preferences.app
751      - com.apple.systempreferences
752      /Applications/TextEdit.app
753      - com.apple.TextEdit
754      /Applications/Time Machine.app
755      - com.apple.backup.launcher
756      /Applications/Utilities/Activity Monitor.app
757      - com.apple.ActivityMonitor
758      /Applications/Utilities/Adobe AIR Application Installer.app
759      - com.adobe.air.ApplicationInstaller
760      /Applications/Utilities/Adobe AIR Uninstaller.app
761      - com.adobe.air.Installer
762      /Applications/Utilities/Adobe Application Manager/D6/Setup.app
763      - com.adobe.Installers.Redirector
764      /Applications/Utilities/Adobe Application Manager/DECore/DE5/resources/uninstall/Uninstall Product.app
765      - com.Adobe.Uninstall Product
766      /Applications/Utilities/Adobe Application Manager/DECore/DE6/resources/uninstall/Uninstall Product.app
767      - com.Adobe.Uninstall Product
768      /Applications/Utilities/Adobe Application Manager/DECore/Setup.app
769      - com.adobe.Installers.Setup
770      /Applications/Utilities/Adobe Application Manager/DWA/Setup.app
771      - com.adobe.Installers.Redirector
772      /Applications/Utilities/Adobe Application Manager/IPC/AdobeIPCBroker.app
773      - com.adobe.AdobeIPCBroker
774      /Applications/Utilities/Adobe Application Manager/LWA/AAM Registration Notifier.app
775      - com.adobe.PDApp.AAMRegistrationNotifier
776      /Applications/Utilities/Adobe Application Manager/LWA/adobe_licutil.app
777      - com.adobe.adobe_licutil
778      /Applications/Utilities/Adobe Application Manager/P6/AAM Registration Notifier.app
779      - com.adobe.AAMRegistrationNotifier
780      /Applications/Utilities/Adobe Application Manager/P6/adobe_licutil.app
781      - com.adobe.adobe_licutil
782      /Applications/Utilities/Adobe Application Manager/P7/AAM Registration Notifier.app
783      - com.adobe.AAMRegistrationNotifier
784      /Applications/Utilities/Adobe Application Manager/P7/adobe_licutil.app
785      - com.adobe.adobe_licutil
786      /Applications/Utilities/Adobe Application Manager/UWA/AAM Updates Notifier.app
787      - com.adobe.PDApp.AAMUpdatesNotifier
788      /Applications/Utilities/Adobe Application Manager/UWA/LogTransport2.app
789      - com.adobe.headlights.LogTransport2App
790      /Applications/Utilities/Adobe Application Manager/core/AAMLauncherUtil.app
791      - adobe.AAMLauncherUtil
792      /Applications/Utilities/Adobe Application Manager/core/Adobe Application Manager.app
793      - com.adobe.PDApp
794      /Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app
795      - com.adobe.acc.AdobeCreativeCloud
796      /Applications/Utilities/Adobe Creative Cloud/CoreSync/Core Sync.app
797      - com.adobe.accmac
798      /Applications/Utilities/Adobe Creative Cloud/CoreSyncV1/Core Sync.app
799      - com.adobe.accmac
800      /Applications/Utilities/Adobe Creative Cloud/HEX/Adobe CEF Helper.app
801      - com.adobe.acc.HEXHelper
802      /Applications/Utilities/Adobe Creative Cloud/Utils/Creative Cloud Installer.app
803      - com.adobe.Creative-Cloud-Installer
804      /Applications/Utilities/Adobe Creative Cloud/Utils/Creative Cloud Uninstaller.app
805      - com.adobe.ACCC.Uninstaller
806      /Applications/Utilities/Adobe Creative Cloud/Utils/CreativeCloud(URIHandler).app
807      - com.adobe.CreativeCloud-URIHandler-
808      /Applications/Utilities/Adobe Flash Player Install Manager.app
809      - com.adobe.flashplayer.installmanager
810      /Applications/Utilities/AirPort Utility.app
811      - com.apple.airport.airportutility
812      /Applications/Utilities/AppleScript Editor.app
813      - com.apple.ScriptEditor2
814      /Applications/Utilities/Audio MIDI Setup.app
815      - com.apple.audio.AudioMIDISetup
816      /Applications/Utilities/Bluetooth File Exchange.app
817      - com.apple.BluetoothFileExchange
818      /Applications/Utilities/Boot Camp Assistant.app
819      - com.apple.bootcampassistant
820      /Applications/Utilities/ColorSync Utility.app
821      - com.apple.ColorSyncUtility
822      /Applications/Utilities/Console.app
823      - com.apple.Console
824      /Applications/Utilities/DigitalColor Meter.app
825      - com.apple.DigitalColorMeter
826      /Applications/Utilities/Disk Utility.app
827      - com.apple.DiskUtility
828      /Applications/Utilities/Grab.app
829      - com.apple.Grab
830      /Applications/Utilities/Grapher.app
831      - com.apple.grapher
832      /Applications/Utilities/Keychain Access.app
833      - com.apple.keychainaccess
834      /Applications/Utilities/Migration Assistant.app
835      - com.apple.MigrateAssistant
836      /Applications/Utilities/Network Utility.app
837      - com.apple.NetworkUtility
838      /Applications/Utilities/Podcast Capture.app
839      - com.apple.PodcastCapture
840      /Applications/Utilities/Podcast Publisher.app
841      - com.apple.PodcastPublisher
842      /Applications/Utilities/RAID Utility.app
843      - com.apple.RAIDUtility
844      /Applications/Utilities/System Information.app
845      - com.apple.SystemProfiler
846      /Applications/Utilities/Terminal.app
847      - com.apple.Terminal
848      /Applications/Utilities/VoiceOver Utility.app
849      - com.apple.VoiceOverUtility
850      /Applications/Utilities/X11.app
851      - org.x.X11
852      /Applications/Vuze.app
853      - org.gudy.azureus2
854      /Applications/iCal.app
855      - com.apple.iCal
856      /Applications/iChat.app
857      - com.apple.iChat
858      /Applications/iDVD.app
859      - com.apple.iDVD
860      /Applications/iMovie.app
861      - com.apple.iMovie8
862      /Applications/iTunes.app
863      - com.apple.iTunes
864      /Applications/iWeb.app
865      - com.apple.iWeb
866      /Library/Application Support/Adobe/CEPServiceManager4/CEPServiceManager.app
867      - com.adobe.csi.CEPServiceManager4
868      /Library/Application Support/Adobe/CEPServiceManager4/extensions/AdobeExchange/assets/ExmanMac/Conte nts/MacOS/LogTransport2.app
869      - N/A
870      /Library/Application Support/Adobe/CEPServiceManager4/html/CEPHtmlEngine.app
871      - com.adobe.cep.CEPHtmlEngine
872      /Library/Application Support/Adobe/Common/dynamiclink/7.0/dynamiclinkmanager.app
873      - com.adobe.dynamiclinkmanager.application
874      /Library/Application Support/Adobe/Common/dynamiclinkmediaserver/7.0/dynamiclinkmediaserver.app
875      - com.adobe.dynamiclinkmediaserver
876      /Library/Application Support/Adobe/InDesign/Version 9.0/AdobeInDesign9AppBase/JFS/Adobe InDesign CC.app
877      - N/A
878      /Library/Application Support/Adobe/InDesign/Version 9.0/AdobeInDesign9AppBase/MFS/Adobe InDesign CC.app
879      - N/A
880      /Library/Application Support/Adobe/InDesign/Version 9.0/AdobeInDesign9AppBase/RFS/Adobe InDesign CC.app
881      - N/A
882      /Library/Application Support/Adobe/Installers/AdobeDigitalPublishingCC/Contentviewer/Adobe AIR Installer.app
883      - com.adobe.air.Installer
884      /Library/Application Support/Adobe/Installers/AdobeDigitalPublishingCC/Contentviewer/Install Adobe Content Viewer.app
885      - com.adobe.dmp.contentviewer.installer
886      /Library/Application Support/Adobe/Installers/AdobeDigitalPublishingCC/Contentviewer/Install DPS App Builder.app
887      - com.adobe.ViewerBuilder.installer
888      /Library/Application Support/Adobe/Installers/AdobeInDesign9AppBase/ExtraFiles/INSTALLDIR_EXE/Adobe InDesign CC.app
889      - N/A
890      /Library/Application Support/Adobe/Uninstall/{UUID}.app
891      - com.Adobe.Uninstall Product
892      /Library/Application Support/Adobe/Uninstall/{UUID}.app
893      - com.Adobe.Uninstall Product
894      /Library/Application Support/Adobe/Uninstall/{UUID}.app
895      - com.Adobe.Uninstall Product
896      /Library/Application Support/ArcSoft/Connect Service/ConnectService.app
897      - com.arcsoft.Daemon
898      /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app
899      - com.microsoft.autoupdate2
900      /Library/Application Support/Microsoft/MERP2.0/Microsoft Error Reporting.app
901      - com.microsoft.error_reporting
902      /Library/Application Support/Microsoft/MERP2.0/Microsoft Ship Asserts.app
903      - com.microsoft.netlib.shipassertprocess
904      /Library/Application Support/Microsoft/Silverlight/OutOfBrowser/SLLauncher.app
905      - com.microsoft.silverlight.sllauncher
906      /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR Application Installer.app
907      - com.adobe.air.ApplicationInstaller
908      /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Adobe AIR Updater.app
909      - com.adobe.air.Installer
910      /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Template.app
911      - com.adobe.air.Template
912      /Library/Image Capture/Devices/Canon IJScanner2.app
913      - jp.co.canon.ijscanner2.scanner.ica
914      /Library/Image Capture/Devices/EPSON Scanner.app
915      - com.epson.scanner.ica
916      /Library/Image Capture/Devices/HP Scanner 3.app
917      - com.hp.scanModule3
918      /Library/Image Capture/Devices/HPScanner.app
919      - com.hp.scanModule
920      /Library/Printers/Canon/BJPrinter/Utilities/BJPrinterUtility2.app
921      - jp.co.canon.bj.print.app.bjprinterutility2
922      /Library/Printers/Canon/BJPrinter/Utilities/CanonIJPrinterUtility.app
923      - jp.co.canon.bj.print.app.canonijprinterutility
924      /Library/Printers/EPSON/InkjetPrinter2/AutoSetupTool/EPIJAutoSetupTool2.app
925      - com.epson.ijprinter.EPIJAutoSetupTool2
926      /Library/Printers/EPSON/InkjetPrinter2/Filter/commandtoescp.app
927      - com.epson.ijprinter.commandtoescp
928      /Library/Printers/EPSON/InkjetPrinter2/Filter/pdftopdf2.app
929      - com.epson.ijprinter.pdftopdf2
930      /Library/Printers/EPSON/InkjetPrinter2/Filter/rastertoescpII.app
931      - com.epson.ijprinter.rastertoescpII
932      /Library/Printers/EPSON/InkjetPrinter2/Utility/UT4/Epson Printer Utility 4.app
933      - com.epson.ijprinter.EpsonPrinterUtility4
934      /Library/Printers/EPSON/InkjetPrinter2/Utility/UT4/EpsonSuppliesTool4.app
935      - com.epson.ijprinter.EpsonSuppliesTool4
936      /Library/Printers/EPSON/InkjetPrinter2/Utility/UTL/Epson Printer Utility Lite.app
937      - com.epson.ijprinter.EpsonPrinterUtilityLite
938      /Library/Printers/hp/Fax/fax.backend
939      - com.hp.fax
940      /Library/Printers/hp/Fax/rastertofax.filter
941      - com.hp.rastertofax
942      /Library/Printers/hp/Utilities/HP Utility.app
943      - com.hp.printerutility
944      /Library/Printers/hp/Utilities/Handlers/ScanEventHandler.app
945      - com.hp.scan.button.handler.generic
946      /Library/Printers/hp/cups/Inkjet4.driver
947      - com.hp.print.cups.filter.inkjet4
948      /Library/Printers/hp/cups/filters/commandtohp.filter
949      - com.hp.print.cups.filter.commandtohp
950      /Library/Printers/hp/cups/filters/pdftopdf.filter
951      - com.hp.print.cups.filter.pdftopdf
952      /Library/Printers/hp/cups/tools/autosetup.tool
953      - com.hp.print.autosetup
954      /Library/Scripts/ColorSync/Embed.app
955      - N/A
956      /Library/Scripts/ColorSync/Extract.app
957      - N/A
958      /Library/Scripts/ColorSync/Match.app
959      - N/A
960      /Library/Scripts/ColorSync/Proof.app
961      - N/A
962      /Library/Scripts/ColorSync/Remove.app
963      - N/A
964      /Library/Scripts/ColorSync/Rename.app
965      - N/A
966      /Library/Scripts/ColorSync/Set Info.app
967      - N/A
968      /Library/Scripts/ColorSync/Show Info.app
969      - N/A
970      /Users/USER/Desktop/Downloads/Acorn.app
971      - com.flyingmeat.Acorn
972      /Users/USER/Downloads/Downloads/Acorn.app
973      - com.flyingmeat.Acorn
974      /Users/USER/Downloads/Senuti.app
975      - com.fadingred.Senuti
976      /Users/USER/Library/Application Support/CitrixOnline/CitrixOnlineLauncher.app
977      - com.citrixonline.mac.WebDeploymentApp
978      /Users/USER/Library/Application Support/Epolife/Epolife.app
979      - com.ymeshul.AppYM
980      /Users/USER/Library/Application Support/Facebook/video/3.1.0.522/FacebookVideoCalling.app
981      - com.Skype.FacebookVideoCalling
982      /Users/USER/Library/Application Support/Kuklorest/Kuklorest.app
983      - com.dshovev.AppDS
984      /Users/USER/Library/Printers/EPSON Epson Stylus NX510.app
985      - com.apple.print.PrinterProxy
986      /Users/USER/Library/Printers/Officejet 6700.app
987      - com.apple.print.PrinterProxy
988      /Users/USER/Movies/Movies/Movies Converted into QuickTime files/RealPlayer.app
989      - com.RealNetworks.RealPlayer
990      /Volumes/LaCie/Installer/Installer.app
991      - N/A
992      /Volumes/LaCie/Private-Public/Private-Public.app
993      - com.lacie.laprivate
994      /usr/libexec/MiniTerm.app
995      - com.apple.pppminiterm
996      /usr/share/java/Tools/Applet Launcher.app
997      - com.apple.AppletLauncher
998      /usr/share/java/Tools/Jar Bundler.app
999      - com.apple.JarBundler
1000      /usr/share/java/Tools/Java VisualVM.app
1001      - com.apple.java.VisualVM.launcher
1002
1003 Frameworks
1004
1005      /Library/Frameworks/Adobe AIR.framework
1006      - com.adobe.AIR
1007      /Library/Frameworks/ArcCon.framework
1008      - com.arcsoft.ArcCon
1009
1010 PrefPane
1011
1012      /Library/PreferencePanes/Flash Player.prefPane
1013      - com.adobe.flashplayerpreferences
1014
1015 Bundles
1016
1017      /Library/Application Support/Adobe/APE/3.4/adbeapecore.framework/Versions/A/Libraries/Flash Player.plugin
1018      - com.macromedia.FlashPlayer-10.4-10.5.plugin
1019      /Library/Application Support/Adobe/Plug-Ins/CC/File Formats/Camera Raw.plugin
1020      - com.adobe.CameraRaw
1021      /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/AdobeCP15.plugin
1022      - com.adobe.adobecp
1023      /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin
1024      - com.macromedia.FlashPlayer-10.6.plugin
1025      /Library/Internet Plug-Ins/AdobeAAMDetect.plugin
1026      - com.AdobeAAMDetectLib.AdobeAAMDetect
1027      /Library/Internet Plug-Ins/Flash Player.plugin
1028      - com.macromedia.Flash Player.plugin
1029      /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
1030      - com.microsoft.sharepoint.browserplugin
1031      /Library/Internet Plug-Ins/Silverlight.plugin
1032      - com.microsoft.SilverlightPlugin
1033      /Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle
1034      - com.skype.skypeabdialer
1035      /Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle
1036      - com.skype.skypeabsms
1037      /Users/USER/Library/Caches/Adobe/Flash Player/NativeCache/UUID/666dbb5/adobecp64-301886-2.plugin
1038      - com.adobe.adobecp20
1039      /Users/USER/Library/Caches/Adobe/Flash Player/NativeCache/UUID/7ff03716/adobecp64-300592-3.plugin
1040      - com.adobe.adobecp20
1041      /Users/USER/Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin
1042      - com.citrixonline.mac.WebDeploymentPlugin
1043      /Users/USER/Library/Widgets/FlipClock.wdgt
1044      - com.FlipClock.widget.FlipClock
1045      /usr/share/servermgrd/bundles/servermgr_addressbook.bundle
1046      - null
1047
1048 Bundles (new)
1049
1050      /Applications/Utilities/Adobe Flash Player Install Manager.app
1051      - com.adobe.flashplayer.installmanager
1052      /Library/Internet Plug-Ins/Flash Player.plugin
1053      - com.macromedia.Flash Player.plugin
1054      /Library/PreferencePanes/Flash Player.prefPane
1055      - com.adobe.flashplayerpreferences
1056
1057 Library paths
1058
1059      /Applications/Adobe InDesign CC/Plug-Ins/Dictionaries/LILO/Linguistics/UserDictionaryMigrationTool/Framework s/ICUConverter.framework/Versions/4.0/libicucnv.40.0.dylib
1060      /Applications/Adobe InDesign CC/Plug-Ins/Dictionaries/LILO/Linguistics/UserDictionaryMigrationTool/Framework s/ICUData.framework/Versions/4.0/libicudata.40.0.dylib
1061      /Applications/Adobe InDesign CC/Plug-Ins/Dictionaries/LILO/Linguistics/UserDictionaryMigrationTool/Framework s/ICUInternationalization.framework/Versions/4.0/libicui18n.40.0.dylib
1062      /Applications/Adobe InDesign CC/Plug-Ins/Dictionaries/LILO/Linguistics/UserDictionaryMigrationTool/Framework s/ICUUnicode.framework/Versions/4.0/libicuuc.40.0.dylib
1063      /Applications/Microsoft Office 2011/Office/MicrosoftSetupUI.framework/Libraries/mbupgx.dylib
1064      /Applications/Microsoft Office 2011/Office/OPF.framework/Versions/14/Resources/OPF_Common.dylib
1065      /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/Fm20.dylib
1066      /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/MicrosoftOLE2TypesLib.dylib
1067      /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RefEdit.dylib
1068      /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RichEdit.dylib
1069      /Applications/Utilities/Adobe Application Manager/D6/D6Native.dylib
1070      /Applications/Utilities/Adobe Application Manager/DECore/ARKSelector.dylib
1071      /Applications/Utilities/Adobe Application Manager/DECore/DE5/Setup.dylib
1072      /Applications/Utilities/Adobe Application Manager/DECore/DE5/resources/libraries/ARKCmdCaps.dylib
1073      /Applications/Utilities/Adobe Application Manager/DECore/DE5/resources/libraries/ARKCmdFS.dylib
1074      /Applications/Utilities/Adobe Application Manager/DECore/DE5/resources/libraries/ARKEngine.dylib
1075      /Applications/Utilities/Adobe Application Manager/DECore/DE5/resources/libraries/AdobePIM.dylib
1076      /Applications/Utilities/Adobe Application Manager/DECore/DE6/Setup.dylib
1077      /Applications/Utilities/Adobe Application Manager/DECore/DE6/resources/libraries/ARKCmdCaps.dylib
1078      /Applications/Utilities/Adobe Application Manager/DECore/DE6/resources/libraries/ARKCmdFS.dylib
1079      /Applications/Utilities/Adobe Application Manager/DECore/DE6/resources/libraries/ARKEngine.dylib
1080      /Applications/Utilities/Adobe Application Manager/DECore/DE6/resources/libraries/AdobePIM.dylib
1081      /Applications/Utilities/Adobe Application Manager/DWA/DWANative.dylib
1082      /Applications/Utilities/Adobe Application Manager/LWA/PWANative.dylib
1083      /Applications/Utilities/Adobe Application Manager/LWA/adobe_caps.dylib
1084      /Applications/Utilities/Adobe Application Manager/LWA/adobe_oobelib.dylib
1085      /Applications/Utilities/Adobe Application Manager/LWA/adobe_upgrade.dylib
1086      /Applications/Utilities/Adobe Application Manager/P6/IMSLib.dylib
1087      /Applications/Utilities/Adobe Application Manager/P6/P6Native.dylib
1088      /Applications/Utilities/Adobe Application Manager/P6/VulcanBridge.dylib
1089      /Applications/Utilities/Adobe Application Manager/P6/VulcanMessage.dylib
1090      /Applications/Utilities/Adobe Application Manager/P6/adobe_oobelib.dylib
1091      /Applications/Utilities/Adobe Application Manager/P6/adobe_upgrade.dylib
1092      /Applications/Utilities/Adobe Application Manager/P6/axlib.dylib
1093      /Applications/Utilities/Adobe Application Manager/P7/IMSLib.dylib
1094      /Applications/Utilities/Adobe Application Manager/P7/P7Native.dylib
1095      /Applications/Utilities/Adobe Application Manager/P7/VulcanBridge.dylib
1096      /Applications/Utilities/Adobe Application Manager/P7/VulcanMessage4.dylib
1097      /Applications/Utilities/Adobe Application Manager/P7/adobe_oobelib.dylib
1098      /Applications/Utilities/Adobe Application Manager/P7/adobe_upgrade.dylib
1099      /Applications/Utilities/Adobe Application Manager/P7/axlibv7.dylib
1100      /Applications/Utilities/Adobe Application Manager/UWA/UWANative.dylib
1101      /Applications/Utilities/Adobe Application Manager/core/AdobePIM.dylib
1102      /Applications/Utilities/Adobe Application Manager/core/switcher/CCM_UI.dylib
1103      /Applications/Utilities/Adobe Application Manager/core/switcher/DWA_UI.dylib
1104      /Applications/Utilities/Adobe Application Manager/core/switcher/LWA_UI.dylib
1105      /Applications/Utilities/Adobe Creative Cloud/ACC/C3ContainerBL.dylib
1106      /Applications/Utilities/Adobe Creative Cloud/ACC/SibTrayNotification.dylib
1107      /Applications/Utilities/Adobe Creative Cloud/AppsPanel/AppsPanelBL.dylib
1108      /Applications/Utilities/Adobe Creative Cloud/AppsPanel/AppsPanelIL.dylib
1109      /Applications/Utilities/Adobe Creative Cloud/BehancePanel/BehancePanelBL.dylib
1110      /Applications/Utilities/Adobe Creative Cloud/Core/NXGCore.dylib
1111      /Applications/Utilities/Adobe Creative Cloud/CoreExt/Analytics.dylib
1112      /Applications/Utilities/Adobe Creative Cloud/CoreExt/C3Prefs.dylib
1113      /Applications/Utilities/Adobe Creative Cloud/CoreExt/CmdCntr.dylib
1114      /Applications/Utilities/Adobe Creative Cloud/CoreExt/ElevationManager.dylib
1115      /Applications/Utilities/Adobe Creative Cloud/CoreExt/LocManager.dylib
1116      /Applications/Utilities/Adobe Creative Cloud/CoreExt/VulcanMessage5.dylib
1117      /Applications/Utilities/Adobe Creative Cloud/CoreExt/VulcanWrapper.dylib
1118      /Applications/Utilities/Adobe Creative Cloud/CoreSync/plugins/ExchangePlugin/ExManCoreLib/Contents/Frameworks/libExMan CoreLibCoreSync64.dylib
1119      /Applications/Utilities/Adobe Creative Cloud/FilesPanel/FilesPanelBL.dylib
1120      /Applications/Utilities/Adobe Creative Cloud/FontsPanel/FontsPanelBL.dylib
1121      /Applications/Utilities/Adobe Creative Cloud/HEX/Chromium Embedded Framework.framework/Libraries/libcef.dylib
1122      /Applications/Utilities/Adobe Creative Cloud/HEX/HEX.dylib
1123      /Applications/Utilities/Adobe Creative Cloud/HEX/libplugin_carbon_interpose.dylib
1124      /Applications/Utilities/Adobe Creative Cloud/HomePanel/HomePanelBL.dylib
1125      /Applications/Utilities/Adobe Creative Cloud/NEX/NEX.dylib
1126      /Applications/Utilities/Adobe Creative Cloud/NEX/NEXUILibrary.dylib
1127      /Applications/Utilities/Adobe Creative Cloud/Utils/AdobePIM.dylib
1128      /Library/Application Support/Adobe/APE/3.4/adbeapecore.framework/Versions/A/Libraries/WebKit.dylib
1129      /Library/Application Support/Adobe/CEPServiceManager4/lib/CSXS-Installer-Hook.dylib
1130      /Library/Application Support/Adobe/CEPServiceManager4/lib/ServiceManager-Launcher.dylib
1131      /Library/Application Support/Adobe/Installers/AdobeDigitalPublishingCC/CustomHooks.dylib
1132      /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/WebKit.dylib
1133
1134 Modifications
1135
1136      resource added: /Applications/iWeb.app/Contents/Resources/English.lproj/BLAboutPanel.nib/classe s.nib
1137      resource added: /Applications/iWeb.app/Contents/Resources/English.lproj/BLAboutPanel.nib/info.n ib
1138
1139 Elapsed time (sec): 751
Reply options

Link to this post

by ASilberkleit,

ASilberkleit Aug 22, 2015 11:28 AM in response to Linc Davis
Level 1 (0 points)

Aug 22, 2015 11:28 AM in response to Linc Davis

Hi, I tried doing this but it said that no folder was found when I pasted both of those lines. I also posted my diagnostic results as a reply to that post of yours. Let me know how to proceed. Thanks!
Reply options

Link to this post

by thomas_r.,

thomas_r. Aug 23, 2015 8:26 AM in response to ASilberkleit
Level 7 (30,919 points)

Mac OS X

Aug 23, 2015 8:26 AM in response to ASilberkleit

You have two different variants of Genieo installed plus some other older adware. For help removing these things, see:

http://www.thesafemac.com/arg

(Fair disclosure: I am affiliated with Malwarebytes, whose site I am linking to.)
Reply options

Link to this post

by Linc Davis,

Linc Davis Aug 23, 2015 8:39 AM in response to ASilberkleit
Level 10 (207,963 points)

Applications

Aug 23, 2015 8:39 AM in response to ASilberkleit
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
You installed one or more variants of the "InstallMac" trojan. Take the steps below to disable it.
The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
Back up all data before continuing.
1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.
2. Inside the folder you just opened, there may files with a name of the form
          something.download.plist
          something.ltvbit.plist
          something.update.plist
where something is usually a meaningless string, such as any of the following:
          InKeepr
          InstallMac
          Javeview
          Leperdvil
          Manroling
          Otwexplain
These are examples, not a complete list. The string could be anything. The point is that the same string will appear in the name of three files.
You could have more than one copy of the malware, with different values of something.
In your case, something is both "Epolife" and "Kuklorest".
Move all such items to the Trash. There may not be any other files in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)
Log out or restart the computer. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.
3. Open this folder in the same way as above:
~/Library/Application Support
and move to the Trash any subfolders named with the same something you found in Step 2.
Don't move the Application Support folder or anything else inside it.
4. Open the Applications folder. If there is an item with the same name as in Step 3, or any of the other names listed in Step 2, drag it to the Trash.
If in doubt, press the key combination option-command-4 to arrange the apps by date added. Look at the apps that have been added since you first noticed the problem. If there is one you don't recognize, drag it to the Trash.
Empty the Trash.
If you get an alert that the application is in use, force it to quit.
5. From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall all extensions you don't know you need, including one called "Yontoo". If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.
6. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select
          Safari ▹ Preferences... ▹ General
and click
          Set to Current Page
Reply options

Link to this post

by Huevomaiztro,

Huevomaiztro Nov 23, 2015 11:07 PM in response to Linc Davis
Level 1 (0 points)

Nov 23, 2015 11:07 PM in response to Linc Davis
Linc, thanks for this explanation of the general technique for identifying adware and malware. For four days, I had been battling the frustration of having at least one ad open every time I followed a link in Safari. I cleaned out cookies, set preferences to block third-party cookies, and went through all the steps described in Apple Support's article, Stop pop-up ads and adware in Safari. I did find one of the files they mentioned—I think it was one of the ones with VSearch in the filename—and deleted it, but after what must have been an hour or two of copying, pasting, finding nothing, repeating, getting interrupted, finding one thing, deleting, restarting, questioning whether I had copied the right stuff in all those iterations in which I had found nothing, repeating, and re-repeating, I was approaching my wits' end and still had fixed nothing. My preferences in Safari were still getting reset to allow all cookies, links continued to open ads, ads, ads, and my sanity was about to depart.

Then I found your explanation here. I began looking in I did have EpoLife. Using the idea of searching for odd files that had been updated when the problem arose, I searched the contents of these folders:
/Library/LaunchAgents/
/Library/LaunchDaemons/
/Library/Application Support/
~/Library/LaunchAgents/
~/Library/LaunchDaemons/
~/Library/Application Support/
Looking for clusters of files sharing nonsense names that were added when the problem began, I also found files with LoyallyPhotoscopy and shivareeUpd in their names. Because I could find no mention of either of those on the Web in general and in this forum in particular, I deleted those files and restarted. Problem gone!

But now I'm wondering if I went too far. Looking at the report that your script from another thread produced for my computer, I see both EpoLife and LoyallyPhotocopy mentioned in /LaunchAgents and /LaunchDaemons, but at first I didn't notice anything containing shivareeUpd. And then I found these files and folders, among others:
/Library/shivareeUpd/Contents/Frameworks/QtCore [which doesn't look like a folder, but pops open to reveal items]
/Library/shivareeUpd/Contents/Frameworks/QtNetwork [ditto]
/Library/shivareeUpd/Contents/MacOS/shivareeUpd
/Library/shivareeUpd/Contents/Plugins/[several folders]
/Library/shivareeUpd/Contents/Resources/[2 files]
I searched the Web for QtCore and discovered that this seems to be a legitimate product written in C++, a tool for working with C++, or something like that.

So is shivareeUpd part of a legit name for valuable files? Should I search my backup files to find the files I deleted? (Should I make this a new question?) Or should I delete the rest of these shivareeUpd files, too?

Even if I did screw this one part up, I learned a lot about my Mac from this exercise. I feel more capable of fixing things myself—although next time I encounter something like this, I'll get verification before I delete the file for good.

I'm looking forward to hearing your answer.
Reply options

Link to this post

by Linc Davis,

Linc Davis Nov 24, 2015 12:35 PM in response to Huevomaiztro
Level 10 (207,963 points)

Applications

Nov 24, 2015 12:35 PM in response to Huevomaiztro

So is shivareeUpd part of a legit name for valuable files?

No. That folder, and everything inside it, is part of the malware.
Reply options

Link to this post

by Huevomaiztro,

Huevomaiztro Nov 25, 2015 2:59 PM in response to Linc Davis
Level 1 (0 points)

Nov 25, 2015 2:59 PM in response to Linc Davis

Thanks, Linc! I will get right to it!
Reply options

Link to this post

by bkstacy,

bkstacy May 8, 2016 5:42 PM in response to Linc Davis
Level 1 (4 points)

May 8, 2016 5:42 PM in response to Linc Davis

   1 Start time: 20:35:34 05/08/16
   2
   3 Revision: 1594
   4
   5 Model Identifier: MacBookPro11,1
   6 Boot ROM Version: MBP111.0138.B16
   7 System Version: OS X 10.11.3 (15D21)
   8 Kernel Version: Darwin 15.3.0
   9 Time since boot: 55 days 11:44
10
11 System load
12
13      combined level = Bad
14      - battery level = Bad
15
16 FileVault 2
17
18      FileVault is On.
19
20 Energy impact, lifetime (relative)
21
22      Terminal (UID 501): 15.11
23
24 CPU usage, lifetime (ms/s)
25
26      Terminal (UID 501): 153.34
27
28 Memory (MB)
29
30      kernel_task (UID 0): 1006
31
32 Profiles: 10
33
34 LS schemes: No
35
36 Wi-Fi
37
38      Security: WPA Personal
39
40 Kernel log
41
42      May 1 11:39:24 USBF:    117842.180    IOUSBHIDDriver(AppleUSBTCKeyboard)::RearmInterruptRead returning error 0xe00002c0 (no such device), not issuing any reads to device
43      May 1 11:39:24 USBF:    117842.180    IOUSBHIDDriver(AppleUSBTCButtons)::RearmInterruptRead returning error 0xe00002c0 (no such device), not issuing any reads to device
44      May 1 11:39:24 ARPT: 117842.181737: wl0: fatal error, reinitializing, total count of reinit's[3], @'wlc_verify_d3_exit':56075
45      May 1 11:39:24 USBF:    117842.513    IOUSBHIDDriver(AppleUSBMultitouchDriver)::RearmInterruptRead returning error 0xe00002d8 (device is not ready), not issuing any reads to device
46      May 1 11:39:25 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
47      May 1 13:17:01 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
48      May 1 14:17:46 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
49      May 1 15:18:46 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
50      May 1 16:19:31 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
51      May 1 17:20:32 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
52      May 1 18:21:17 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
53      May 1 19:09:23 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
54      May 2 00:35:36 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
55      May 2 19:31:10 USBF:    129413.529    IOUSBHIDDriver(AppleUSBMultitouchDriver)::RearmInterruptRead returning error 0xe00002d8 (device is not ready), not issuing any reads to device
56      May 2 19:31:11 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
57      May 2 19:51:42 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
58      May 2 20:28:16 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
59      May 2 21:51:56 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
60      May 2 22:19:25 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
61      May 2 22:25:59 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
62      May 2 22:32:59 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
63      May 3 01:33:34 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
64      May 8 19:32:13 ARPT: 137857.967916: wl0: fatal error, reinitializing, total count of reinit's[4], @'wlc_verify_d3_exit':56075
65      May 8 19:32:13 USBF:    137858.303    IOUSBHIDDriver(AppleUSBMultitouchDriver)::RearmInterruptRead returning error 0xe00002d8 (device is not ready), not issuing any reads to device
66      May 8 19:32:15 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
67
68 System log
69
70          2   libxpc.dylib                        0x00007fff9b70d91f _xpc_connection_reply_callout + 26
71          3   libxpc.dylib                        0x00007fff9b70d8c0 _xpc_connection_call_reply + 36
72          4   libdispatch.dylib                   0x00007fff90e5933f _dispatch_client_callout + 8
73          5   libdispatch.dylib                   0x00007fff90e5df6f _dispatch_queue_drain + 754
74          6   libdispatch.dylib                   0x00007fff90e6463b _dispatch_queue_invoke + 549
75          7   libdispatch.dylib                   0x00007fff90e5cc87 _dispatch_root_queue_drain + 538
76          8   libdispatch.dylib                   0x00007fff90e5ca34 _dispatch_worker_thread3 + 91
77          9   libsystem_pthread.dylib             0x00007fff968e168f _pthread_wqthread + 1129
78          10 libsystem_pthread.dylib             0x00007fff968df365 start_wqthread + 13
79      May 8 20:31:27 QuickLookSatellite: __net_helper_get_connection_block_invoke_3 could not connect to networkd
80      May 8 20:31:27 QuickLookSatellite: nw_path_evaluator_start_helper_connection net_helper_path_evaluation_start failed, dumping backtrace:
81              [x86_64] libnetcore-583.20.10
82          0   libsystem_network.dylib             0x00007fff8d6deba5 __nw_create_backtrace_string + 123
83          1   libsystem_network.dylib             0x00007fff8d6f4228 nw_path_evaluator_start_helper_connection + 196
84          2   libdispatch.dylib                   0x00007fff90e64871 _dispatch_call_block_and_release + 12
85          3   libdispatch.dylib                   0x00007fff90e5933f _dispatch_client_callout + 8
86          4   libdispatch.dylib                   0x00007fff90e5df6f _dispatch_queue_drain + 754
87          5   libdispatch.dylib                   0x00007fff90e6463b _dispatch_queue_invoke + 549
88          6   libdispatch.dylib                   0x00007fff90e5cc87 _dispatch_root_queue_drain + 538
89          7   libdispatch.dylib                   0x00007fff90e5ca34 _dispatch_worker_thread3 + 91
90          8   libsystem_pthread.dylib             0x00007fff968e168f _pthread_wqthread + 1129
91          9   libsystem_pthread.dylib             0x00007fff968df365 start_wqthread + 13
92      May 8 20:35:35 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD
93      May 8 20:35:46 diskarbitrationd: AdobeReader [12728]:67743 not responding.
94      May 8 20:36:00 Safari: tcp_connection_tls_session_error_callback_imp 178 __tcp_connection_tls_session_callback_write_block_invoke.434 error 22
95
96 Console log
97
98      May 1 11:41:38 storeassetd: -[__NSDictionary0 downloads]: unrecognized selector sent to instance 0x7fd7a94001a0
99
100 System services loaded
101
102      com.adobe.fpsaud
103      com.apple.logd
104      - status: 1
105      com.apple.security.syspolicy
106      - status: -15
107      com.apple.watchdogd
108      com.google.keystone.daemon
109      com.microsoft.autoupdate.helpertool
110      com.microsoft.office.licensingV2.helper
111
112 Login services loaded
113
114      com.citrix.AuthManager_Mac
115      com.citrix.ReceiverHelper
116      com.citrix.ServiceRecords
117      com.citrixonline.GoToMeeting.G2MUpdate
118      com.google.keystone.system.agent
119
120 Login services disabled
121
122      Nariabox.update
123      InKeepr.AppRemoval
124      InKeepr.update
125      Nariabox.ltvbit
126      InKeepr.ltvbit
127      InKeepr.download
128      Nariabox.download
129
130 User services disabled
131
132      Nariabox.update
133      InKeepr.AppRemoval
134      InKeepr.update
135      Nariabox.ltvbit
136      InKeepr.ltvbit
137      InKeepr.download
138      Nariabox.download
139
140 Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist
141      - mod date: Feb 22 19:46:58 2015
142      - size (B): 603
143      - checksum: 394026997
144
145      <?xml version="1.0" encoding="UTF-8"?>
146      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
147      <plist version="1.0">
148      <dict>
149       <key>Label</key>
150       <string>com.adobe.ARM.UUID</string>
151       <key>ProgramArguments</key>
152       <array>
153       <string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>
154       <string>semi-auto</string>
155       </array>
156       <key>RunAtLoad</key>
157       <true/>
158       <key>StartInterval</key>
159       <integer>12600</integer>
160      </dict>
161      </plist>
162
163 Contents of Library/LaunchAgents/com.citrixonline.GoToMeeting.G2MUpdate.plist
164      - mod date: Apr 7 21:51:51 2015
165      - size (B): 466
166      - checksum: 3804516715
167
168      <?xml version="1.0" encoding="UTF-8"?>
169      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
170      <plist version="1.0">
171      <dict>
172       <key>Label</key>
173       <string>com.citrixonline.GoToMeeting.G2MUpdate</string>
174       <key>ProgramArguments</key>
175       <array>
176       <string>/Users/USER/Library/Application Support/CitrixOnline/GoToMeeting/G2MUpdate</string>
177       </array>
178       <key>StartInterval</key>
179       <integer>3660</integer>
180      </dict>
181      </plist>
182
183 User login items
184
185      iTunesHelper
186      - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
187
188 Safari extensions
189
190      InKeepr
191      - com.inkeepr.safari
192
193 Widgets
194
195      Artimis
196
197 iCloud services
198
199      MOBILE_DOCUMENTS
200      PHOTO_STREAM
201      MAIL_AND_NOTES
202      CONTACTS
203      CALENDAR
204      REMINDERS
205      BOOKMARKS
206      NOTES
207      KEYCHAIN_SYNC
208      BACK_TO_MY_MAC
209      FIND_MY_MAC
210
211 Continuity errors
212
213      sharingd 1
214
215 Restrictive permissions: 313
216
217 Lockfiles: 1
218
219 PrefPane
220
221      /Library/PreferencePanes/Flash Player.prefPane
222      - com.adobe.flashplayerpreferences
223
224 Bundles
225
226      /Library/Internet Plug-Ins/AdobePDFViewer.plugin
227      - com.adobe.acrobat.pdfviewer
228      - Adobe Systems, Inc.
229      /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
230      - com.adobe.acrobat.pdfviewerNPAPI
231      - Adobe Systems, Inc.
232      /Library/Internet Plug-Ins/CitrixICAClientPlugIn.plugin
233      - com.citrix.citrixicaclientplugIn
234      - Citrix Systems, Inc.
235      /Library/Internet Plug-Ins/Flash Player.plugin
236      - com.macromedia.Flash Player.plugin
237      - Adobe Systems, Inc.
238      /Library/Internet Plug-Ins/PepperFlashPlayer/PepperFlashPlayer.plugin
239      - com.macromedia.PepperFlashPlayer.pepper
240      - Adobe Systems, Inc.
241      /Library/Internet Plug-Ins/Quartz Composer.webplugin
242      - com.apple.QuartzComposer.webplugin
243      - Software Signing
244      /Library/Internet Plug-Ins/Silverlight.plugin
245      - com.microsoft.SilverlightPlugin
246      /Users/USER/Downloads/Google Earth Web Plug-in.plugin
247      - com.Google.GoogleEarthPlugin.plugin
248      - Google Inc.
249      /Users/USER/Downloads/MacPinball.wdgt
250      - unity.baKno.MacPinball.widget
251      /Users/USER/Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin
252      - com.citrixonline.mac.WebDeploymentPlugin
253      /Users/USER/Library/Widgets/Artimis.wdgt
254      - it.widget.maccrafters.com
255
256 Bundles (new)
257
258      /Library/Internet Plug-Ins/PepperFlashPlayer/PepperFlashPlayer.plugin
259      - com.macromedia.PepperFlashPlayer.pepper
260      - Adobe Systems, Inc.
261      /Library/PreferencePanes/Flash Player.prefPane
262      - com.adobe.flashplayerpreferences
263
264 Library paths
265
266      /Users/USER/Library/Application Support/Firefox/Profiles/nbhv38w3.default/gmp-gmpopenh264/1.3/libgmpopenh264.dy lib
267      /Users/USER/Library/Application Support/Firefox/Profiles/nbhv38w3.default/gmp-gmpopenh264/1.5.3/libgmpopenh264. dylib
268
269 MD importers
270
271      /Applications/Google Earth.app/Contents/Library/Spotlight/Google Earth.mdimporter
272      /Applications/Microsoft Outlook.app/Contents/Library/Spotlight/Microsoft Outlook Spotlight Importer.mdimporter
273
274 App extensions
275
276      com.microsoft.onenote.mac.shareextension
277
278 Non-loading kernel extensions
279
280      /System/Library/Extensions/AppleOSXUSBNCM.kext
281      - com.apple.driver.AppleOSXUSBNCM
282      - Software Signing
283
284 Installations
285
286      Microsoft Word for Mac: 5/2/16, 10:16 PM
287      Microsoft OneNote for Mac: 5/2/16, 10:15 PM
288      Microsoft Excel for Mac: 5/2/16, 10:15 PM
289      Microsoft Outlook for Mac: 5/2/16, 10:15 PM
290      Microsoft PowerPoint for Mac: 5/2/16, 10:14 PM
291
292 Elapsed time (sec): 399
Reply options

Link to this post

first Page 7 of 7

Q: Downloaded something called InKeepr and it is impossible to remove from my Mac, please help. There is nothing out there about this!

All replies Helpful answers

by amcq,

by ASilberkleit,

by ASilberkleit,

by thomas_r.,

by Linc Davis,

by Huevomaiztro,

by Linc Davis,

by Huevomaiztro,

by bkstacy,

All replies

Helpful answers