jkendrick
Level 1 (28 points)
Mac OS X

Q: MacKeeper install nightmare

After stupidly installing MacKeeper, I now have a Guest User account that never existed before since first getting this MBP.

MacKeeper has been eliminated, along with most of the BS it created. Using Malwarebytes I also deleted

/private/etc/st-up.sh

/etc/change_net_settings.sh

/etc/st-up.sh

 

leaving only 4 items I cannot delete all in MacHD/private/var:

cellulate                 in MacHD/private/var

com.apple.launchd.peruser.401            in MacHD/private/var/db/launchd.db

com.apple.launchd.peruser.401            in MacHD/private/var/log

pishaugupd.root                                    in MacHD/private/var/tmp

 

 

Any idea what cellulate is? or pishaugupd.root? Any idea how to get rid of these?

 

Plus, no matter what, I cannot eliminate this Guest User account. The minus button doesn't help. I have disabled the account.

 

I've never used iCloud or Find My Mac.

I did sign in to iCloud just to make sure Find My Mac was unticked, but this was AFTER the Guest User account appeared.

 

There is also now an "Other" on the login screen, in addition to the two users I have had since first setting up this MBP. I have not a clue what name or password this account has, tried a few guesses, got nowhere. I'd like to eliminate this from the login screen.

 

Any help will be greatly appreciated, and please spell out any suggestions in elaborate detail. Thanks

 

MacBook Pro retina, mid 2012

Mt Lion  10.8.5

Intel Core i7, 2.3 GHz

16GB RAM

MacBook Pro (Retina, Mid 2012), OS X Mountain Lion (10.8.5), 16GB RAM

Posted on May 10, 2016 11:28 PM

by thomas_r.,Solvedanswer
thomas_r. thomas_r.
Level 7 (30,889 points)
Mac OS X
A:

First, go to the following folder in the Finder:


/etc/


In that folder, look for a file named pf_proxy.conf. It may or may not be there. If you do see it there, delete it.


Then, try this to delete that stubborn file:

 

sudo rm -f /private/var/tmp/pishaugupd.root

 

Beware, though! The "sudo rm" command is very dangerous, and will instantly delete any file you point it at. So be sure you enter the command exactly as shown above!


Also, that "ls -alO" command just lists everything in the given directory, including invisible files, along with some useful properties of those files.

Posted on May 16, 2016 1:07 PM

Close
jkendrick

Q: MacKeeper install nightmare

  • All replies
  • Helpful answers

Previous Page 2 of 3 last Next

  • by thomas_r.,Helpful

    thomas_r. thomas_r. May 12, 2016 6:41 PM in response to jkendrick
    Level 7 (30,889 points)
    Mac OS X
    May 12, 2016 6:41 PM in response to jkendrick

    You have installed an uncommon variant of VSearch also known as Pirrit. One of the effects of this particular variant is that it creates a hidden user on your system to help it do its dirty work. That hidden user will need to be removed.

     

    Run the following command in the Terminal:

     

    dscl . -list /Users UniqueID | grep 401

     

    This will give you output showing the name of the hidden account, a bunch of spaces, and then the number 401. The name will be needed in the next step.

     

    Now, enter the following command in the Terminal, replacing "username" with the name of the hidden account from the previous step:

     

    sudo dscl . create /Users/username IsHidden 0

     

    At this point, that account should show up in System Preferences -> Users & Groups, and you should delete it from there.

     

    From there, if Malwarebytes Anti-Malware for Mac doesn't clean up the rest, choose Contact Support from the Help menu within the app and that'll help you send some system information to our support techs, who can help you with anything that might have slipped past.

     

    Thomas Reed

    Director of Mac Offerings, Malwarebytes

  • by Kurt Lang,

    Kurt Lang Kurt Lang May 12, 2016 6:15 AM in response to thomas_r.
    Level 8 (37,716 points)
    May 12, 2016 6:15 AM in response to thomas_r.

     

    Actually, Malwarebytes Anti-Malware for Mac will remove malware as well...

     

    Yup! Mentioned that.

    He has since started to add the ability to find and remove some actual malware,

    Keep up the great work, Thomas.

  • by jkendrick,

    jkendrick jkendrick May 12, 2016 4:57 PM in response to thomas_r.
    Level 1 (28 points)
    Mac OS X
    May 12, 2016 4:57 PM in response to thomas_r.

    @Kurt Lang

    I already had EasyFind, which was unable to "see" any of the items, although File Buddy can.

     

    File Buddy found pishaugupd.root   (@0 K) in Macintosh HD/private/var/tmp

    It found cellulate    (of size - ) in Macintosh HD/private/var

    It found com.apple.launchd.peruser.401 twice, once  in Macintosh HD/private/var/db/launchd.db   and once in Macintosh HD/private/var/log

     

    Each of these items showed a tiny red minus sign over the folder icon and will not allow me to open or delete it in File Buddy

     

    All four items are the last which appeared in the one or two minutes during the MacKeeper install

     

    What Size supposedly allowed me to delete these items as admin, EXCEPT for some parts of cellulate bc it said it is owned by root.

     

    @thomas_r.

    I followed your Terminal suggestions, but grr.

    Macs-MacBook-Pro:~ MBPr$ dscl . -list /Users UniqueID | grep 401

    cellulate               401

     

    The create user command asked for my password, which I supplied, but this "cellulate" user does NOT show up in SysPrefs. and so, I cannot delete it.

    Tried the two Terminal commands a second time with the same results.

     

    File Buddy cannot find cellulate anymore, although it does find the 0 K pishaugupd.root which What Size ostensibly deleted. What Size cannot find cellulate either.

    I did a safe boot and a reboot and Other still shows up on the login screen.

     

    ARG!!!

  • by thomas_r.,Helpful

    thomas_r. thomas_r. May 12, 2016 6:41 PM in response to jkendrick
    Level 7 (30,889 points)
    Mac OS X
    May 12, 2016 6:41 PM in response to jkendrick

    Try this, in that case:

     

    sudo dscl . delete /Users/cellulate

  • by jkendrick,

    jkendrick jkendrick May 12, 2016 6:28 PM in response to jkendrick
    Level 1 (28 points)
    Mac OS X
    May 12, 2016 6:28 PM in response to jkendrick

    I am still searching for answers, and in another forum one guy said the Other on my login screen is a "Group user" because the icon looks like this

    Screen Shot 2016-05-12 at 6.28.00 PM.png

    Don't know if this makes any difference in possible solutions.

  • by jkendrick,

    jkendrick jkendrick May 12, 2016 6:40 PM in response to thomas_r.
    Level 1 (28 points)
    Mac OS X
    May 12, 2016 6:40 PM in response to thomas_r.

    tried that and got

    Last login: Thu May 12 17:51:19 on ttys000

    Macs-MacBook-Pro:~ MBPr$ sudo dscl . delete /Users/cellulate

    Password:

    delete: Invalid Path

    <dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

    Macs-MacBook-Pro:~ MBPr$

     

    Even more weirdly, the earlier Command

    dscl . -list /Users UniqueID | grep 401

    now yields no result

     

    HA! I just logged out and MIRACLE! the Other group login has disappeared!

     

    Thanks for your help thomas_r.

  • by jkendrick,

    jkendrick jkendrick May 12, 2016 6:57 PM in response to thomas_r.
    Level 1 (28 points)
    Mac OS X
    May 12, 2016 6:57 PM in response to thomas_r.

    FWIW there is still one item left from the two minutes during that MacKeeper install

    pishaugupd.root

    File Buddy's info

    Screen Shot 2016-05-12 at 6.55.56 PM.png

    I tried changing the owner to myself to delete, but NG.

    Cannot find one iota of info about this apparently empty exec

  • by thomas_r.,

    thomas_r. thomas_r. May 13, 2016 5:13 AM in response to jkendrick
    Level 7 (30,889 points)
    Mac OS X
    May 13, 2016 5:13 AM in response to jkendrick

    Is that pishaugupd.root file the only one left? If so, what happens if you simply drag it to the trash in the Finder? If you do this from an admin account, regardless of the permissions on the file, you should be able to move it to the trash. If you don't have access to the file, you will be prompted for an admin password, and then the Finder will move it with root permissions.

     

    If that fails, what happens when it fails?

  • by jkendrick,

    jkendrick jkendrick May 13, 2016 3:55 PM in response to thomas_r.
    Level 1 (28 points)
    Mac OS X
    May 13, 2016 3:55 PM in response to thomas_r.

    File Buddy continues to find the 0 bytes pishaugupd.root in

    Macintosh HD/private/var/tmp

     

    Screen Shot 2016-05-13 at 3.39.25 PM.png

    What Size can find it, and I tried as admin to delete it, but it did not

    Same for Easy Find, which cannot open the folder via Reveal In Finder

     

    Finder>Go can't find it either

     

    tried Terminal

    defaults write com.apple.finder AppleShowAllFiles TRUE && killall Finder

    pishaugupd.root doesn't show up so I can't drag it to the trash

     

    tried

    Macs-MacBook-Pro:~ MBPr$ chown MBPr pishaugupd.root

    chown: pishaugupd.root: No such file or directory


    I'm beginning to think there is some ghost in the machine with respect to these various 3rd party apps continuing to find this file.

  • by thomas_r.,

    thomas_r. thomas_r. May 13, 2016 5:51 PM in response to jkendrick
    Level 7 (30,889 points)
    Mac OS X
    May 13, 2016 5:51 PM in response to jkendrick

    What's the output if you do the following in the Terminal:

     

    ls -alO /private/var/tmp/

  • by jkendrick,

    jkendrick jkendrick May 13, 2016 6:08 PM in response to thomas_r.
    Level 1 (28 points)
    Mac OS X
    May 13, 2016 6:08 PM in response to thomas_r.

    here's Terminal's response to

    ls -alO /private/var/tmp/

    total 368

    drwxrwxrwt  13 root  wheel  -  442 May 13 17:31 .

    drwxr-xr-x  27 root  wheel  -  918 May 12 12:31 ..

    -rw-r--r--  1 root  wheel  -    0 Mar 27  2015 DeferredInstallFixup.file_list

    drwxr-xr-x  2 root  wheel  -    68 Mar 13  2015 MPSJ2IBU

    drwxr-xr-x  2 root  wheel  -    68 Aug  1  2015 MPVSJES7

    -rw-r--r--  1 MBPr  wheel  -  3411 Sep 23  2014 cfnetworkagent.log

    -rw-r--r--  1 root  wheel  - 14281 Aug 19  2014 configd-pattern.plist

    -rw-r--r--  1 root  wheel  -  8649 Aug 19  2014 configd-reachability

    -rw-r--r--  1 root  wheel  - 11814 Aug 19  2014 configd-session.plist

    -rw-r--r--  1 root  wheel  - 88233 Aug 19  2014 configd-state

    -rw-r--r--  1 root  wheel  - 49277 Aug 19  2014 configd-store.plist

    drwx------  3 root  wheel  -  102 May 12 12:55 launchd

    srwxr-x---  1 root  wheel  -    0 May  2 19:47 pishaugupd.root


    P.S. Just curious, what is the meaning of that command you had me enter?

  • by HypnoPoodle,

    HypnoPoodle HypnoPoodle May 15, 2016 8:52 PM in response to thomas_r.
    Level 1 (4 points)
    May 15, 2016 8:52 PM in response to thomas_r.

    This happened to me once on Windows -- no one would believe me.  I finally talked with a guy who was the head of MSN and he told me how to get rid of it. Lesson learned. Do not download anything on your Mac that does not come from Apple!!  Don't even use a mouse on Yahoo as you get malware there too. Seems the only safe place is Google News. Feel sorry for you.  HypnoPoodle

  • by babowa,

    babowa babowa May 15, 2016 9:02 PM in response to HypnoPoodle
    Level 7 (31,935 points)
    iPad
    May 15, 2016 9:02 PM in response to HypnoPoodle

    Don't even use a mouse on Yahoo as you get malware there too. Seems the only safe place is Google News

     

    A mouse does not produce malware.

     

    Google isn't any safer than any other website.

  • by thomas_r.,Solvedanswer

    thomas_r. thomas_r. May 16, 2016 1:07 PM in response to jkendrick
    Level 7 (30,889 points)
    Mac OS X
    May 16, 2016 1:07 PM in response to jkendrick

    First, go to the following folder in the Finder:


    /etc/


    In that folder, look for a file named pf_proxy.conf. It may or may not be there. If you do see it there, delete it.


    Then, try this to delete that stubborn file:

     

    sudo rm -f /private/var/tmp/pishaugupd.root

     

    Beware, though! The "sudo rm" command is very dangerous, and will instantly delete any file you point it at. So be sure you enter the command exactly as shown above!


    Also, that "ls -alO" command just lists everything in the given directory, including invisible files, along with some useful properties of those files.

  • by jkendrick,

    jkendrick jkendrick May 16, 2016 1:32 PM in response to thomas_r.
    Level 1 (28 points)
    Mac OS X
    May 16, 2016 1:32 PM in response to thomas_r.

    Many, many thanks to thomas_r. for patiently working with me to solve this nightmare.

     

    FWIW I recommend File Buddy (not cheap, but worth it) which can search for and find just about anything via any number of criteria. I initially used it to ascertain what had been done in the two minutes during the MacKeeper installation.

    I also looked thru the pertinent console install log and perused it carefully. That is where I discovered my browsers' preferences had been hijacked to use search-quick.com as a default search engine.

        "Search-quick.com virus is a browser hijacker that is distributed to random computer systems together with freeware applications. It infiltrates to Internet Explorer, Mozilla Firefox, Google Chrome and Safari, and once there, changes the main settings of these browsers."

     

    Be careful out there!

Previous Page 2 of 3 last Next