Nexus.<ticketId>.cox.app -- Support.com_Nexus -- ssrangsrv -- www.ccc4321.com

Question

Level 1

9 points

Nexus.<ticketId>.cox.app -- Support.com_Nexus -- ssrangsrv -- www.ccc4321.com

Recently I had reason to ask my cable provider for help. As all the little voices in my head clamored to stop me I installed their support app even tho' it asked for my password when I ran it.

"Not to worry" said the support rep -- it doesn't install anything, it's only active when it's running.

"And yet the installer asked for my password to install startup files" said I...

"And my watchdog program 'Lingon X' alerted me to newly installed startup files for something called Support.com_Nexus" I added...

"So when we're done here I'll go remove those things that your support app didn't install"...

----

This is what it left behind:

What the support software from www.ccc4321.com left behind

    a.k.a. Nexus.<ticketNumber>.cox.app

#1 remember to go to System Prefs - Security & Privacy - Privacy 

    uncheck & remove: ssrangsrv

#2 then open Terminal and delete this stuff:

startup files and launch agents

    /Library/StartupItems/Support.com_Nexus
    /Library/StartupItems/Support.com_Nexus/Support.com_Nexus
    /Library/Support.com_Nexus
    /Library/LaunchAgents/com.support.com.Nexussrvd.plist
    /Library/LaunchAgents/com.support.com.peruser.Nexussrvd.plist
    /Library/LaunchAgents/com.support.com.Nexusd.plist
    /Library/LaunchAgents/com.support.com.peruser.Nexusd.plist

application support

    ~/Library/Application\ Support/CrashReporter/ssrangsrv_*.plist


logs, crash reports and cache files

    /Library/Logs/supportdotcom/ssrang*
    ~/Library/Logs/DiagnosticReports/ssrang*
    ~/Library/Logs/supportdotcom/ssrang*.log*
    ~/Library/Caches/com.support.com.Nexus*
    ~/Library/Caches/ssrang*

MacBook Pro 15", macOS 10.14

Posted on May 6, 2019 6:22 PM

Reply

Answer 1

Best reply

Scochoman

Level 1

4 points

May 7, 2019 4:12 PM in response to ajoslin

FYI, That is a legit app that Cox Complete Care uses for remote support. It is not harmful and the executable gets killed, uninstalled and removed when it is closed. It may leave behind some log files and reg entries but is not malicious. The startup files are used so if the computer is rebooted it will reconnect but again, once the remote is closed the main executable is removed so serves no purpose after. You only need to provide a password to allow it to run with admin privileges and in OS Mojave it requires it to allow the remote technician to be able to manipulate the mouse and not just to see the screen.

Reply

Answer 2

ajoslin Author

Level 1

9 points

May 7, 2019 6:18 PM in response to Scochoman

I in no way called it out as malicious, it was my own voices that call out against installing remote control software and my reaction to being told that it did not leave anything behind

I made requests of more than one tech from CCC as to how to remove the vestiges - and also searched the net to no avail

I did find one thread in Apple Discussions where they were trying to figure out if a very similar thing was malicious

I only point out what it left behind so that others may clear it out if they wish to as I did

CCC did really well by me, they gave me what I needed to know as well as giving me really good advice as to the best solution to the troubles I was having

CCC is ok in my book -- I know they didn't write that software and that it's used by more companies than just them

This was intended to only be a record, told with some humor -- the CCC tech and I had fun

Apologies if I ruffled any feathers -- CCC is a good outfit

Reply

Nexus.<ticketId>.cox.app -- Support.com_Nexus -- ssrangsrv -- www.ccc4321.com

Similar questions