OpenApplication "Trojan" on my MacBook Pro running macOS Mohave Version 10.14.16

Yesterday (09/24/2019) seem to see a application in my dock that says "OpenApplication" when you mouse over. Deleted the installed application from my /Applications directory.

If anybody has experienced that same and figured a way to delete, I would appreciate any leads.

I am also debugging on how to rid it off the system.

Thanks in advance

MacBook Pro

Posted on Sep 24, 2019 6:27 PM

Reply
Question marked as Top-ranking reply

Posted on Sep 27, 2019 4:23 PM

@JMF21, Looks like we have very similar issues with the many incarnations of this Trojan.


I went ahead and tried out the free version of MalwareBytes from the link kindly provided by @entrsoft and it seems to have cleant up a bunch of other areas, launch agents, even in the root /Library path (not just user areas)


My macBook now seems to be responding well, so I would think it would resolve your issues as well, and in a jiffy.


Would certainly like to thank @etresoft and @OT for their valuable and helpful advice.

Will observe for a week to two and am definitely inclined towards acquiring a premium copy.

10 replies
Question marked as Top-ranking reply

Sep 27, 2019 4:23 PM in response to JMF21

@JMF21, Looks like we have very similar issues with the many incarnations of this Trojan.


I went ahead and tried out the free version of MalwareBytes from the link kindly provided by @entrsoft and it seems to have cleant up a bunch of other areas, launch agents, even in the root /Library path (not just user areas)


My macBook now seems to be responding well, so I would think it would resolve your issues as well, and in a jiffy.


Would certainly like to thank @etresoft and @OT for their valuable and helpful advice.

Will observe for a week to two and am definitely inclined towards acquiring a premium copy.

Sep 26, 2019 2:56 PM in response to oscar_saldanha

oscar_saldanha wrote:

I certainly would like to try MalwareBytes but wondering if MalwareBytes is legit itself.
Have you, or other apple folks, used it without any scamming or other hideous effects!
I have a copy of NortonAntivirus that I can use, but online reviews are not too enthusiastic due to its very intrusive behavior - it might interfere with MacOS's (and Safari's) security monitoring.

Both MalwareBytes and Norton are legitimate apps. Norton is an “old-school” antivirus that makes significant changes to the operating system and scans mostly for Windows malware. MalwareBytes is much less intrusive and only scans for Mac malware.


We are not “apple folks”. We are just other Apple customers like yourself. Apple employees rarely participate in the forums and they usually limit themselves to posting links to support articles.


You will probably not be able to remove this software on your own. It would require accessing multiple hidden directories and running command-line tools. It is best to leave this job to software that is designed to do it.

Sep 26, 2019 8:53 AM in response to JMF21

Thanks @JMF21, mine too appeared about then, as I noticed that I wasn't able to access the internet on my MacBook Pro.

The giveaway is that I use "google" for my search (default) and when the virus is active, the search results appear from "yahoo"


Deleted a few folders, application and am able to "temporarily" access to the internet.

  1. Looked for the latest install in /Applications folder, which was "openApplication", and deleted it
  2. Using Finder, search for "open application". I found a bunch of folders (having "open application" at the end, under my "home-directory" (where below, '~' => home-directory). I merrily deleted them
    • ~/Library/Scripts/*openapplication*
    • ~/Library/Containers/*openapplication*
    • ~/Library/Group\ Containers/*openapplication*

Also browed through Safari preferences, like "Extensions" etc for untoward edits.

Check if you are able to regain access to the internet


After a day, the virus had morphed into a new name, "openApplication" => "WindoMode", and apparently installs itself?

When asked to confirm that installation is complete (you have no control of the mouse), I did a "Force exit".(Command+Option+Esc") and exited the hanging application.


Sent the Error Report to Apple, to see if they can identify any security holes.


Went through the above clean-up steps once again and am using my Mac now to respond.

Still monitoring and will explore other suggestions

Sep 26, 2019 9:08 AM in response to etresoft

@etresoft Thanks.

I certainly would like to try MalwareBytes but wondering if MalwareBytes is legit itself.

Have you, or other apple folks, used it without any scamming or other hideous effects!

I have a copy of NortonAntivirus that I can use, but online reviews are not too enthusiastic due to its very intrusive behavior - it might interfere with MacOS's (and Safari's) security monitoring.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

OpenApplication "Trojan" on my MacBook Pro running macOS Mohave Version 10.14.16

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.