Alert: Magican and Request for Help

Question

Level 1

18 points

Alert: Magican and Request for Help

I made the mistake of installing some new software, supposedly a cleaning utility called Magican, which I think may be some kind of malware. Immediately after running it, I began to have problems launching some applications. I tried to remove it and all the things it installed, but it has not been easy. The console now shows a never-ending stream of messages such as those below, a new one every several seconds. I should say that I also once had installed MacKeeper, but I thought that it had long since been eradicated.

FWIW, I have combed through all my Library files for Launch items and demons, startup items, gone through my Accounts startup items and attempted to find invisible files, searching on zeobit, MacKeeper, Magican, castle, etc. [no matches show up]. The Activity Viewer shows nothing running that seems to be associated with any of these. Any thoughts on how to get rid of this stuff would be much appreciated.

12/1/11 6:38:55 com.apple.launchd.peruser.501[162] (com.zeobit.MacKeeper.Helper) Throttling respawn: Will start in 10 seconds

12/1/11 6:26:59 com.apple.launchd.peruser.501[162] (com.zeobit.MacKeeper.Helper[852]) posix_spawn("/Applications/MacKeeper.app/Contents/Resources/Helper.app/Contents /MacOS/Helper", ...): No such file or directory

12/1/11 6:26:49 com.apple.launchd.peruser.501[162] (com.zeobit.MacKeeper.Helper) Throttling respawn: Will start in 10 seconds

12/1/11 6:26:32 com.apple.launchd[1] (com.magican.castle[843]) posix_spawn("/Library/Application Support/Magican/McDaemon", ...): No such file or directory

12/1/11 6:26:42 com.apple.launchd[1] (com.magican.castle[847]) Exited with exit code: 1

12/1/11 6:27:02 com.apple.launchd[1] (com.magican.castle[853]) posix_spawn("/Library/Application Support/Magican/McDaemon", ...): No such file or directory

MacBook, Mac OS X (10.6.7)

Posted on Dec 1, 2011 5:07 PM

Reply

Answer 1

Best reply

Sebastien Stormacq

Level 1

69 points

Jul 7, 2012 1:52 AM in response to hmibrooklyn

launchd is Mac OS X's system to launch program at startup time or regular interval. It ensures your automatically started applications are restarted in case of crash.

Because, you deleted all binaries, but kept Magican registered with launchd, it complains it can not start the binary.

To cleanup Magican and MacKeeper from launchd, use a terminal and issue the following command

sudo launchctl remove com.magican.castle

you can also use "launchctl list" to see the list of registered daemons.

Finally, to ensure that Magican will not register itself at next reboot, you must issue the following command

sudo rm /Library/LaunchDaemons/com.magican.castle.plist

(alternatively, just delete this file and reboot your mac :-)

Hope this helps

Seb

Reply