removing hijackers

How do I remove a hijacker from my OS X El Capitan v10.11.6?

iMac, OS X 10.11

Posted on Nov 24, 2021 8:17 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 25, 2021 1:33 AM

Malwarebytes


There are no known Windows-like Viruses in the wild that self replicate and affect macOS, because of the underling UNIX  Foundation and Permission Limitation. 


The The Built in Security  is all that is required to protect the computer.


Should “ Certain & Specific Software “ referenced from above be installed - it will negatively impact macOS. It is suggested, to download directly from a respected ASC Contributor, the application Malwarebytes for Mac


It is free or paid for added features. 


Disclaimer: I am not affiliated with nor receive compensation from the Developer.


Run the Application and it should remove the malware / adware.


Once done, restart computer and test.

6 replies
Question marked as Top-ranking reply

Nov 25, 2021 1:33 AM in response to _--d-_a_-n

Malwarebytes


There are no known Windows-like Viruses in the wild that self replicate and affect macOS, because of the underling UNIX  Foundation and Permission Limitation. 


The The Built in Security  is all that is required to protect the computer.


Should “ Certain & Specific Software “ referenced from above be installed - it will negatively impact macOS. It is suggested, to download directly from a respected ASC Contributor, the application Malwarebytes for Mac


It is free or paid for added features. 


Disclaimer: I am not affiliated with nor receive compensation from the Developer.


Run the Application and it should remove the malware / adware.


Once done, restart computer and test.

Nov 27, 2021 9:11 AM in response to _--d-_a_-n

If you’ve suffered a catastrophic security breach (which is what you’ve described in that first post), wipe, reinstall from known-good distributions, and (maybe) restore documents and files (and not apps!), and change all passwords to new and unique and robust values, change passwords on your password-reset paths, change two-factor tokens, enable two-factor authentication on your Apple ID, everything.


Watch for activity on your financial accounts, too.


Usual path for the miscreants onto the local Mac is phishing or a compromised app; gaining access via remote app support scams and related scams are common. Other potential access paths can include enabling screen sharing with weak passwords, a compromised Apple ID password, password re-use, etc.


Most of these cases involve allowing the miscreants access to the Mac, as full remote breaches can and have happened—but are fairly rare. As for full breaches, there was a remote exploit identified in September in the Finder handling of the file: protocol, and there also have been watering hole efforts by miscreants.


Once that catastrophic breach happens though, you’re headed for rebuilding all of your security. Unfortunately.


Wiping and re-installing is usually enough to avoid persistence, though that’s not entirely certain. Reinstalling something a little more current than OS X 10.11 would be greatly preferred too, if your hardware supports that.


Here is some Apple-provided info on better securing your whole environment: Device and Data Access when Personal Safety is At Risk

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

removing hijackers

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.