MPlayerX Malware Removal

Question

Level 1

1 points

MPlayerX Malware Removal

I was recently approched by a friend who had accidentally downloaded and run the installer for what appears to be a trojan. The installer says it is "MPlayerX" which appears to be a legitimate application, however the installer bears no resemblence to the one of the actual application.

Virus total link

Here is a screenshot:

He followed through the install process, and entered his password. I did a lot of googling but could not find any information. I then decided to give it a crack mysef and opened up the install binary in a disassembler. Unfortunatley, this was way above my level and I could not make sense of it. Here are the details of his computer:

As he supplied his password, it is possible that it may have installed a rootkit as well.

Has anyone ever encountered this before, or do you know how to remove it?

MacBook Pro, OS X Mavericks (10.9.1)

Posted on May 19, 2014 9:36 AM

Reply

Answer 1

Best reply

Tesla735 Author

Level 1

1 points

May 19, 2014 10:56 AM in response to Tesla735

After looking at the launch agents loaded on his computer (launchctl list) I found several plists that seemed out of order:

/Library/LaunchAgents/com.vsearch.agent.plist
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

After googling these I ended up finding an article explaining how to remove it

Reply

Answer 2

Tesla735 Author

Level 1

1 points

May 19, 2014 11:05 AM in response to Tesla735

I made a quick applescript to carry out the process described in the article.

It actually just runs:

rm -rf /Library/Application Support/VSearch;rm -f /Library/LaunchAgents/com.vsearch.*;rm -rf /Library/LaunchDaemons/Jack*;rm -rf /System/Library/Frameworks/VSearch.framework

With administrator privileges.

===============================================================================

DISCLAIMER:

I DO NOT CLAIM THAT THIS SCRIPT ACTUALLY REMOVES THE MALWARE. THIS IS JUST MY BEST ATTEMPT. IF IT DOES NOT WORK, DO NOT HOLD ME RESPONSIBLE.

Reply

Answer 3

Tesla735 Author

Level 1

1 points

May 19, 2014 11:13 AM in response to Tesla735

Yet another fun day in my freshman year of highschool seems to be coming to an end. Some extra research seems to confirm that my fix was successful, so I am going to mark my own answers as correct.

Maybe this thread will be helpful to someone somewhere. . .

Reply

Answer 4

praiford

Level 1

114 points

May 19, 2014 11:14 AM in response to Tesla735

Thomas has a script created already that will search your system for all known adware programs. You can find out more and download it from this link: http://www.thesafemac.com/art/

It will remove the files that you found above as well as files for other adware programs such as the genieo malware. It moves all the info to the trash can and then you can empty the trash can to get rid of the files.

Reply

Answer 5

Tesla735 Author

Level 1

1 points

May 19, 2014 11:19 AM in response to praiford

I will send this to my friend. I have no doubt he has installed a few other fishy things by accident. Thank you for the help.

As I side note:

I actually have genieo installed in a vm and am using it as an oppurtunity to try and learn more about reversing. I think it's a good one to start with because they make use of well known scripts like mach_inject and mach_override as well as having a very large portion of the software written in java (which is pretty easy to decompile with something like JADE).

Reply

Answer 6

thomas_r.

Level 7

31,983 points

May 19, 2014 11:22 AM in response to Tesla735

I see someone beat me to touting my own script! (Thanks, praiford! 🙂)

More importantly, though, I wanted to alert you to the fact that it looks like you have missed a file, based on your description and your script. Your friend should also have the following file that needs to be removed:

/Library/PrivilegedHelperTools/Jack

Also, note that your friend almost certainly downloaded and installed this item after downloading what he/she thought was a movie or TV show, illegally downloaded from a torrent or video piracy site. I have a sample in my possession, obtained from such a source, whose installer looks exactly like what you showed, and which is packaged to look like a copy of Robocop.

Your friend needs to be read the riot act about this kind of activity. If that activity continues, he/she will be infected again, and the next time it may not be something as easy to get rid of as simple adware.

Reply

Answer 7

praiford

Level 1

114 points

May 19, 2014 11:27 AM in response to Tesla735

Your welcome. The great thing about the script is that it will check for updates so if Thomas finds another adware that needs to be added, when you run the script it will tell you that there is an update out for it and will ask you if you wish to download the update first. It will also close Safari, Chrome, and Firefox before running and will let you know if you have to reboot or do any other special commands before it continues. Its a pretty good little tool and he supplies the source code as well just in case you want to study it and make sure it doesn't do any harm to the system. So far I have not needed it, but I have run it to see what it does and I like to study the code since I am a novice when comes to apple script.

Reply

Answer 8

praiford

Level 1

114 points

May 19, 2014 11:30 AM in response to thomas_r.

No problem Thomas. You have a good script and I find your advices very helpful. Keep up the good work.

Reply

Answer 9

Tesla735 Author

Level 1

1 points

May 19, 2014 12:43 PM in response to thomas_r.

Theoretically, I may or may have not have been pretty sure that that is how he got it, and in this theoretical scenario gave him a lecture on the moral, legal, and safety implications of using software from such sites.

Thank you for the tip, I will add /Library/PrivilegedHelperTools/Jack

Also, is it possible to change the answer I marked as correct? Yours is far better than mine.

Reply

Answer 10

thomas_r.

Level 7

31,983 points

May 19, 2014 1:10 PM in response to Tesla735

Also, is it possible to change the answer I marked as correct? Yours is far better than mine.

Nope. Not even the moderators can do that (or, more likely, won't, since it would probably open up a floodgate of requests). No big deal, though.

Reply

Answer 11

stashh

Level 1

0 points

Jun 24, 2014 7:20 AM in response to Tesla735

Not sure I have ever posted on this forum... then again i never seem to have a problem with my mac... well, after being free of problems for 7 years earlier this morning i managed to get mplayerX and genio on my computer.... its pretty remarkable how vicious that thing is!!!! after a lot of panic, i found this thread and the script thomas made... in under 20 seconds my computer is once again back to normal...

HUGE THANK YOU THOMAS.... you saved me a lot of time and stress today 🙂

anyone needing to get rid of malware would be wise to go with this script, it works like magic

Reply

Answer 12

thomas_r.

Level 7

31,983 points

Jun 24, 2014 8:40 AM in response to stashh

Glad I could help! 🙂

Reply

Answer 13

Jun 24, 2014 7:17 PM in response to thomas_r.

Thomas thank you so much! it cleaned my computer in the matter of seconds! your script completely got rid of the virus

Reply

Answer 14

Jul 22, 2014 7:52 AM in response to Tesla735

Thank you! this worked perfectly and quickly! I downloaded this malware because it did look official... more fool me... I will be far more carful in the future thanks again!! kevin.

Reply

Answer 15

Aug 8, 2014 9:54 PM in response to thomas_r.

Thomas, thank you for the script! It worked great on my Mac!

Reply