hello,
I'm on a mac mini m4 pro.
I constantly get popup messages regarding a "garad.wz": "Malware Blocked. "garadz.wz" was not opened because it contains malware. This action did not harm your Mac".
There's no startup action nor activity under that name, nor any file with the ".wz" suffix.
I have updated from 15.4 to 26.2 with the hope to see it fixed but it's still here.
Any advice?
Thank you!
See this user tip:
https://discussions.apple.com/docs/DOC-250007882
Post screen shots as it says (in List view) of the three folders listed.
See this user tip:
https://discussions.apple.com/docs/DOC-250007882
Post screen shots as it says (in List view) of the three folders listed.
I would still recommend posting the screenshots of the 3 Launch folders suggested by Kurt Lang. I suspect you have a file there that is referencing the folder you found in your Library and removing that folder will still leave the file that is looking for it.
About those "<app> will damage your… - Apple Community
The alternative is to post the free EtreCheck report that lists those same files in the Launch Folders, but may also show the other locations that they reference.
How to use the Add Text Feature When Post… - Apple Community
Be sure to capture the entire contents of ~/Library/LaunchAgents in case there are additional files to review.
You could, but these types of malware tend to fix themselves if you don't stop them from loading in the first place. Which is what the item(s) in the launch folder(s) do.
If you delete the launch items, the malware is dead, despite the item still being on the drive. No means to launch it, no malware running.
wait, I found garad.wz!!!
It's in Macintosh HD/Library/garad.wz
It's very weird the finder wasn't finding it (and still doesn't)
Should I simply remove it?
I'm doing a time machine right now
You won't necessarily (more like, unlikely) to find garad.wz
Post screen shots of the folders mentioned in the article, making sure to stretch out the Finder window to show the entire length of any names. Like this:
Here's a recent example of the kind of nonsense named items you might find.
Malware Blocked notification for TypeChar… - Apple Community
Yes, that is a very sketchy looking name in my list. But, it is from Adobe. All it does is point to an update helper:
/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper
Are you a gamer?
A quick web search returns references to .wz files being related to Call or Duty: Warzone (WZ)
Ring any bells?
unguitar wrote:
no, I'm not, I also found that connection online, but it's not my case.
thank you for checking!
You're welcome.
Hope you can track this down quickly. Our friends, @Kurt Lang and @John Galt, always provide good guidance. 👍🏽
That was a pretty darn good guess by D.I. Johnson, though the character is only known as Garad, not garad.wz
Country codes tend to follow a period, and wz is the code for Eswatini (formerly Swaziland). That the OS already recognizes it as known malware is pretty definitive.
Kurt Lang wrote:
…Here's a recent example of the kind of nonsense named items you might find…
Not counting the efforts to look sketchy from Adobe (example above), and other similar app developer creativity.
Make sure to first start up in Safe Mode so the malware is not running. Then delete the items in red.
I couldn't find any relevant information on dandification or uglisome. But if a legitimate app uses them, it should recreate those after you restart out of Safe Mode.
And once you do restart after removing the .plist items, then you can delete the copy of garad.wz you found.
no, I'm not, I also found that connection online, but it's not my case.
thank you for checking!
thank you, will dive into this!
thank you for the interesting link, but unfortunately it didn't help...
Mac mini: 'Malware Blocked' pop-ups for 'garad.wz
