My bitdefender finds a file named " launchd.conf" in a hidden folder named "private". Is it a virus?

Guys please someone help me! Shall i try and delete it?

OS X Mavericks (10.9.5)

Posted on Apr 2, 2015 8:50 AM

Reply
15 replies

Apr 2, 2015 11:50 AM in response to ChrisLoizou

You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before proceeding.

Malware is always changing to get around the defenses against it. In addition to the files listed in the support article, you may also have to remove the following in the same way:

~/Library/LaunchAgents/com.Installer.completer.download.plist

~/Library/LaunchAgents/com.Installer.completer.ltvbit.plist

~/Library/LaunchAgents/com.Installer.completer.update.plist

~/Library/Application Support/IM.Installer/Completer.app

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

After removing the malware, remember to reset your home page in all the web browsers affected, if it was changed.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.

If you find Apple's instructions too hard to follow, ask for an alternative that doesn't require you to trust a black-box application without knowing what it does.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Apr 2, 2015 1:32 PM in response to ChrisLoizou

It is likely that you have a Genieo adware infection, as Linc points out. If that is correct, you will need to be extremely careful with removal of this adware, since the launchd.conf file is involved! Improper removal can result in your Mac crashing and then becoming unable to start up. Apple's page on Genieo removal does not mention this, so while following it you may not take the steps as seriously as you should. Follow them TO THE LETTER!


An alternative to Apple's guide, which includes some additional files not mentioned in Apple's document that may or may not also be present, can be found here:


http://www.thesafemac.com/arg-genieo


Once you have removed Genieo, assuming that's what this is, you will also need to get rid of Avast. There are many issues with Avast, including a high rate of false positives, possible inclusion of adware as a part of Avast and problems with Avast overriding security of "https" sites in a very insecure and dangerous manner. Uninstall it using the uninstall option in the Avast menu within the Avast app.


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

Apr 3, 2015 12:46 PM in response to ChrisLoizou

ChrisLoizou wrote:


So IS IT A VIRUS/ADWARE OR NOT??? Is there a way to find that out?


It may be Genieo, which is adware, not a virus. If you try the Genieo removal instructions that either Linc or I have given you and find components of Genieo installed, then that's what it was.


If you need more information than that, we would need to know what BitDefender is identifying that file as.

Apr 3, 2015 7:12 PM in response to ChrisLoizou

ChrisLoizou wrote:


i checked for the files that are mentioned above but i couldn't find any of them


You definitely have Genieo installed. BitDefender may have removed some of the Genieo-related files. It should have alerted you to that if it did. If it did not, I'm unclear on what else you have done to this point.


Have you deleted any Genieo files in any way yet? If not, you may simply be having difficulty with following the directions. Try the manual removal instructions in my Adware Removal Guide to see if they are more understandable to you... they may or may not be.


http://www.thesafemac.com/arg-genieo/


Have you used AdwareMedic? If so, be sure you have followed the directions it gave you. It should have told you that you need to restart the computer, and that you should run a scan again after restarting to remove the remaining items. If you didn't do that, the launchd.conf file will not have been removed yet.


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

My bitdefender finds a file named " launchd.conf" in a hidden folder named "private". Is it a virus?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.