Problem with the nbp malware

Question

Level 1

5 points

Problem with the nbp malware

Months ago I ran into a problem that whenever I tried searching using Google Crome or Safari I would be redirected to either: a survey website, chillysearch.xyz or nearbyme.io. After installing and running Malwarebytes, the software found a file OSX.Vsearch with a nbp.com folder. After I delete it my Apple login items notification goes of saying that nbp.app is still here and can run in the background. Same thing after I turn it off in the settings. Any ideas on how to fix it? Thanks! - Andrii.

MacBook Pro 16″, macOS 13.1

Posted on Nov 6, 2023 12:18 AM

Reply

Answer 1

Top-ranking reply

vineet1707

Level 1

13 points

Apr 1, 2024 5:32 AM in response to John Galt

Reply

Answer 2

John Galt

Level 10

155,402 points

Dec 27, 2023 5:21 AM in response to hosunyee

Please restart your Mac in "Safe Mode": Use safe mode on your Mac - Apple Support.

While in that mode, drag the following files to the Trash:

com.MacUpperDaemon.plist

com.profound.plist

Then, restart your Mac normally and confirm the alert messages cease to appear.

Reply

Answer 3

John Galt

Level 10

155,402 points

Mar 1, 2024 5:48 PM in response to baanvi

baanvi a total of three folders need to be inspected. You posted screenshots of two of them. The missing folder is either

~/Library/LaunchAgents

or

/Library/LaunchAgents

With the understanding that the following is predicated on incomplete information, you may proceed as below.

Otherwise, please capture and post a screenshot of the missing folder and await further instructions.

Please restart your Mac in "Safe Mode": Use safe mode on your Mac - Apple Support.

While in that mode, drag all the following files in those three folders to the Trash, with the exception of those files with the following in their names:

Adobe

Google

Microsoft

Zoom

Then, restart your Mac normally and confirm the website redirect problems are resolved.

Reply

Answer 4

John Galt

Level 10

155,402 points

Nov 7, 2023 12:01 PM in response to andrii6488

Please restart your Mac in "Safe Mode": Use safe mode on your Mac - Apple Support.

While in that mode, drag the file named com.nbp.plist to the Trash. Then, restart your Mac normally.

It may be as simple as that, but if it reappears, please write back for more thorough instructions.

Reply

Answer 5

John Galt

Level 10

155,402 points

Nov 6, 2023 10:15 AM in response to andrii6488

Uninstall "Malwarebytes" according to its instructions.

Please read Removing "Search Marquis" / "Search Baron" / etc on your own - Apple Community, and post the three screenshots it describes in a reply to this Discussion.

Reply

Answer 6

John Galt

Level 10

155,402 points

Apr 1, 2024 6:48 AM in response to vineet1707

vineet1707, please restart your Mac in "Safe Mode": Use safe mode on your Mac - Apple Support.

While in that mode, drag all the files in the first screenshot to the Trash, except for the three with Google in their names. Those are ok.

Specifically for Google Chrome: If you use it, you will also need to reset the Chrome product to its default settings. To learn how to do that read https://support.google.com/chrome/answer/3296214?hl=en

Then, restart your Mac normally and confirm the website redirect problems are resolved.

Reply