Hi, I recently downloaded FileZilla and with it came also spyware called Premieropinion. I deleted the files, but its still visible in my top menu bar. Really annoying to be constantly reminded, that I recently had spyware on my mac (or maybe still have??)
Has anyone got a solution of how to remove it from the top menu bar? It doesn't work simply dragging it to the desktop.
Cheers
/Mr. Friberg
Mac Pro, OS X Yosemite (10.10.3), spyware
demisjohn wrote:
Sounds like some malicious software!
Since deleting the LaunchDaemon is thwarted by the program re-installing the Daemon, I suspect that the Daemon/Agent is actually running and reinstalling its launch agent.
…
and deleting the two "com.PremierOpinions.plist" files. These files cause the OS to keep opening PremiereOpinion, either at boot or if it's not running at any time.
No. It is launchd that re-launches them if the KeepAlive parameter is set. Launchd uses the plist to load the process into it's queue when launchd comes alive, but once it is in the queue, launchd manages it.
You can delete the plist and the process will still be loaded in the launchd queue. You can kill the process and launchd will restart it if it is set to stay running, even with the plist deleted.
If it is in the main /Library, you must restart after deleting the plist.
If it is in your user /Library, you can log out and log in after deleting the plist.
You can also use launchctl to remove the process from the launchd queue.
Yeah, I was commenting on what I thought was Friberg stating that he DELETED the LaunchAgent plist file (while the LaunchAgent was loaded an still running in memory), and that the plist FILE reappeared after 10min. Perhaps I understood wrong and he was actually talking about the process.
In my experience launchd doesn't recreate a deleted plist file when it's removed, even if the agent/daemon is currently running. Please do let me know if that's incorrect.
This technical difference appears to have little impact on the solution though. (I think booting into safe mode is still the easiest way to remove it, rather than launchd gymnastics).
demisjohn wrote:
In my experience launchd doesn't recreate a deleted plist file when it's removed, even if the agent/daemon is currently running. Please do let me know if that's incorrect.
That is correct. Of course, it would also be possible for the process that the agent/daemon is responsible for keeping alive to periodically check for the existence of the agent/daemon file and re-create it if it has been removed. I don't know whether PremierOpinion does this or not, I'm just saying it's possible.
demisjohn wrote:
In my experience launchd doesn't recreate a deleted plist file when it's removed, even if the agent/daemon is currently running. Please do let me know if that's incorrect.
I thought you were saying the opposite. I just misunderstood, then.
Even though my attempt appears to have been successful (using at least 3 websites to locate all the files!), I must agree with you - AdwareMedic appears to be the sure-fire way to go, since he'll update the uninstaller as the malwares morph.
So I can tell you from experience, that if this is what you have, and don't want to struggle with it, or pay for some extra garbage, just go download malwarebytes. It is free for Mac users, and works great at taking care off all kinds of adware and malware. It will turn your headache into a 5 minutes task, where it does all the hard work. Hope this helps you all out.
Try using this donation ware: http://www.adwaremedic.com/index.phphttp://www.adwaremedic.com/index.php
Thx Lanny. Seems that i have to erase harddrive and start all over.
Oh my god.
Then there is this too: http://malwaretips.com/blogs/premieropinion-removal/
Do you have a Time Machine backup that you can use?
You should download AdwareMedic from thesafemac.com, as proposed by Thomas Reed. Run it. and you will also get rid of other adware at the same time.
Lex
How do i get rid of Spyware: Premieropinion
