Got malware, want to wipe clean and start from scratch, but with current OS - Sierra

You’re not going to like any of this...

Use current software. Not Sierra.

(Wouldn’t go below High Sierra, at this point... That’s the oldest that’s still typically getting security patches.)

Getting old installer kits is increasingly difficult, particularly after subsequent releases ship.

This Mac can run Catalina, and which has better protections against sketchy apps.

Catalina deprecates 32-bit apps, and you’ll want to check your key apps, check that your printer and scanner vendors have drivers available, and upgrade. (And maybe keep a copy of the Catalina installer around.)

MacKeeper is a controversial choice here, too—see allegations that "neither the free trial nor the full registered versions of MacKeeper performed any credible diagnostic testing"” referenced there, among other details.

Your credentials and the rest are either gone, or should be assumed to be.

MalwareBytes might be able to decontaminate, but it’s best to roll in your backups from immediately prior.

But your passwords and tokens are best assumed compromised. Revoke and recreate app authentication tokens, too.

You can get rid of it:

1. http://osxdaily.com/uninstall-mackeeper-from-mac/
2. download Malwarebytes: https://www.malwarebytes.com/mac/ and run it.
3. run it again.
4. Safari:

Shut down Safari, then open Safari while holding the Shift key.

In Safari->Preferences->Advaced: check "Show Develop menu in menu bar";

Then Safari->History->ClearHistory->Clear All:

Then in Safari->Develop->Empty Caches.

Now you should not get the pop ups.

Sorry MrHoffman, my last post was for blazedj420 of course..

Lex

Imagine handing (evil) me your admin password, and then handing me your Mac.

That’s what happened.

You granted admin access, right?

That means you granted the keys to the whole kingdom.

Access to everything.

What actually got uploaded if anything, we don’t know.

But with admin access, it’s all in play.

Which means assuming passwords are compromised.

All of them.

Including your recovery email accounts and passwords.

Roll in your backups from prior to the breach.

If you don’t have routine backups, decontamination is a yet bigger project.

Which would involve starting over with backups, wiping, and a fresh install.

Migrating in just docs from your now-just-created post-breadh backups.

MalwareBytes might be able to clean up rogue files, but it might not.

And I’d still assume that your credentials and credit cards and the rest was uploaded.

MacKeeper is a contentious hunk of software, and not one I prefer to have installed on any system I manage.

More generally and across all of what’s available, add-on anti-malware, add-on anti-virus, add-on VPN clients, add-on cleaners, free stuff and free coupons, stuff from app aggregators, various of that is problematic at best. And some of it is malware. Some of the legitimate stuff introduces vulnerabilities, too. Some makes systems unstable. And there are fake versions of legitimate software.

The built-in macOS anti-malware works reasonably well.

Most folks get in trouble with what they’ve decided to download and install and authenticate.

Make a backup, cloning your storage using Disk Utility or Carbon Copy Cloner or otherwise, maybe make another one, boot Recovery, wipe, reload macOS, and migrate in your files and not your apps. Reload your app files from a known-good source. Downloads from the Mac App Store and from vendor/developer sites are usually okay.

The MalwareBytes stuff has a decent reputation around the forum, though I don’t run that. That might be able to clean up this, prior to performing a reload.