cleanparametered will damage your computer

Oh my goodness. I finally deleted it. Thank you so so so much coolmar2! I really appreciate it :)

To summarise for everyone else: CleanParameterd is a malware that takes data from you to deliver personalised ads. It is a low-risk malware but it'll cause multiple issues in the long run like slow running speed.

Steps summarised from coolmar2.

1. Download EtreCheck (www.etrecheck.com) from AppStore
2. Run a scan, it's free. After doing the first scan, you will see under 'unsigned files', some of the files will say CleanParameterd in the file name somewhere. Remove those files.
3. This issue should still persist even after you click "ok" from the pop-up icon. So download Spyhunter (https://www.enigmasoftware.com/spyhunter-download-instructions/)
4. Run a scan again. There should be one last malware file. You will have to pay to get it removed. But you can do it manually and for free. The directory is provided. (/private/var/root/Library/Application Support/.CleanParameter.dp/CleanParameterd). Keying this in Shift+Command+G will not work.
5. Press Shift+Command+G and type "/private/var" you should see a locked file root. Press command+i and scroll all the way down. You should unlock it at the bottom right by clicking the lock icon first. Then, amend the privacy settings such that everyone can "view and edit the file".
6. Do the same for the subsequent files for Library and Application Support.
7. At this stage, you will not see a '.CleanParameter.dp' file as it is hidden.
8. To reveal it, press command+shift+. to reveal the hidden folders. For me, I had 2 hidden folders, one of them being .CleanParameter.dp. At this stage, just move this file to bin and everything will be settled and solved.

Special thanks to coolmar2 for coming up with this solution. It worked for me, and I'm sure it'll work for everyone here too! It is completely free. The process will take long. But it is worth it. Thanks again!

Looks like a new round of Adware has been deployed.

Look in /Library/LaunchDaemons for a plist file that is out of place. It may actually have cleanparameterd in the name.

If there is, move it to the Trash. If not, post the list of files you find there.

Open Network System Preferences, select the service you use to connect to the Internet, and click the Advanced button.

Click on the Proxies tab and uncheck any of the proxies listed in the “proxies to configure” list.

Restart after removing the plist file.

Etrecheck may be able to remove the Adware, but you’ll need to clear the proxy settings to get to it.

Hi,

I figured out how to fix it, but it turned into a very lengthy process. The first thing that I did that was successful was download EtreCheck which is something you can download from the app store. After doing the first scan, you will see under unsigned files, some of the files will say CleanParameterd in the file name somewhere. After making sure that all of those files were gone, I realized that there was one more file that was still there. So I downloaded Spyhunter was after the scan, it found exactly what I needed to be removed, however, the application asked me to pay to delete it, but it did tell me the directory for it so what I had to do was delete it manually. The directory that it was at was /private/var/root/Library/Application Support/.CleanParameter.dp/CleanParameterd. When on Finder, you can press Shift+Command+G and that will open up the find window, and after putting in my directory, it didn't work, so then I took it one step at a time. I first typed /var where I looked for the next folder which is root, but then I realized that it was locked, pressing command+i, allows me to scroll down to sharing and permissions, and from there I added myself in that list and was allowed to access it. I repeated that process until I got to Application Support, but then I realized that the folder was hidden, command+shift+. helped me find the corporate, deleted the file, and I was good to go.

P.S. If anything doesn't make sense please let me know.

dylonko wrote:

Download EtreCheck (www.etrecheck.com ) from AppStore

If you know you already have malware like this, then it would be better to use EtreCheckPro. You would download it directly from the website above, not the App Store. All of the security and malware removal features in EtreCheckPro are free. You don't have to pay anything for this. Apple imposes certain security restrictions on all apps in the Mac App Store. These restrictions make it more difficult to remove malware using EtreCheck downloaded from the Mac App Store. EtreCheckPro doesn't have these restrictions so it will be easier to use in this case.

What is happening here is that Apple's built-in security software is disabling the malware. Unfortunately, Apple only disables the executable. It does not delete the launchd scripts that keep trying to run the executable. Also, some of this malware installs network proxies. So if the malware has embedded itself into your network, and Apple disables the malware, you've got no network.

What you can do is boot into safe mode according to instructions here: https://support.apple.com/HT201262

If you run in safe mode, you MUST use EtreCheckPro. When running in safe mode, EtreCheck in the Mac App Store will not be able to detect all of your malware.

And finally, if you do have network issues, after removing the malware, make sure to go to System Preferences > Network > Advanced > Proxies and remove those proxies. When malware does this, it adds it to all of your network interfaces. So in the Network preference pane, you will have to go through the list on the left, one by one, click "Advanced" on each, and remove all the proxies. You have to do this after removing the malware. Otherwise, the malware will just reinstall the proxies.

Once you get all the malware removed, the proxies deleted, restart your computer. Run another EtreCheck report and look for anything identified as "adware" or "possible adware". Remove them, restart, repeat until they are all gone.

I just had this issue and I downloaded the trial version of Malwarebytes. I ran the scan, it detected the files, and removed them. I just ran a new scan and it was clean. Hope this helps.

What I did was go to network in system preferences and created a new network instead of automatic. Make sure you hit apply in the lower right corner.

Then opened safari, downloaded malware bytes, restarted and issue resolved.

( I tried this)

What I did was go to network in system preferences and created a new network instead of automatic. Make sure you hit apply in the lower right corner.

Then opened safari, downloaded malware bytes, restarted and issue resolved.

You can also try Malwarebytes, a free download (there is a more capable version you can purchase but the most basic version is free), it will scan your computer and find and remove the malware.

There's nothing to worry about. See Etresoft's post in this similar topic: UnitHandlerd MALWARE ?? PLEASE help - Apple Community

Then try this:

Download the shareware Find Any File.

Boot into Safe Mode by booting with the Shift key held down

NOTE: Safe Mode boot can take up to 10 minutes as it's doing the following; 

• Verifies your startup disk and attempts to repair directory issues, if needed

• Loads only required kernel extensions (prevents 3rd party kernel/extensions from loading)

• Prevents Startup Items and Login Items from opening automatically

• Disables user-installed fonts 

• Deletes font caches, kernel cache, and other system cache files

and run Etrecheck with the following search:

1 - Name contains XXXX

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  

Uploaded Malwarebytes)

Solved the problem in 2 minutes

Thank you!

Bro you cant download anything since ut ***** the wifi

Check your proxy settings in Network System Preferences. Disable any enabled.

If you use another browser besides Safari, the proxy settings may be in the App or an extension is blocking access.

Amigo, haga los pasos solo de ubicar el archivo en support y eliminarlo, no necesita aplicaciónes. (así fue que lo hice yo)

Friend! you are a genius!

Amigo, eres un genio! hablo español, me causo un poco de dificultad la traducción del sistema, pero fue suficiente para aplicar tus instrucciones y eliminar los archivos! Muchas gracias!

Hello, for

1. ”To reveal it, press command+shift+. to reveal the hidden folders. For me, I had 2 hidden folders, one of them being .CleanParameter.dp. At this stage, just move this file to bin and everything will be settled and solved.“

when i hold command and shift nothing comes up