.HTML/Rce.Gen3 virus How do I get rid of this permanently

Question

Level 1

8 points

.HTML/Rce.Gen3 virus How do I get rid of this permanently

I read the string on removing HTML/Rce.Gen3. I have this on my air OS 10.10.3. Yes I have mac Keeper and i get that it *****. Is it the cause? It is alerting me to the malware and i do have MS office running. I few things I noticed that may or may not be the result of Gen3. Safari no longer displays video content and account statements don't open when on line but no problem in Firefox. I'm diligent about removing Gen3 but it keeps coming back. I used finder and although I did not find the virus name I did find ms email (msgsource) files that came up in the search and deleted them. Also the display has intermittent long rectangular boxes blinking away.

Found the following in activity monitor:

AntiVirus

92.6

10:30:58.63

16

0

48

root

-

No

0 bytes

32 bit

No

0 bytes

0

0 bytes

No

MacKeeper

3.0

14:10.62

11

1

463

christopherlocasciolocascio

-

No

0 bytes

64 bit

No

0 bytes

0

0 bytes

No

MacKeeper Helper

5.3

32:18.90

8

300

christopherlocasciolocascio

-

No

0 bytes

64 bit

No

0 bytes

0

0 bytes

No

MacKeeperATd

0.0

1.83

4

0

53

root

-

No

0 bytes

64 bit

No

0 bytes

0

0 bytes

No

Posted on Jun 29, 2015 7:06 PM

Reply

Answer 1

Linc Davis

Level 10

209,535 points

Jun 29, 2015 8:38 PM in response to Angwilla

"MacKeeper" is a scam with only one useful feature: it deletes itself. The imaginary "virus" is either nothing at all or a cached web page that (unlike MacKeeper) is completely harmless.

First, back up all data.

Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.

If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and immediately emptying—then you'll have to reinstall it and start over.

IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.

In the Finder, select

Go ▹ Applications

from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the other functional components of the software will be deleted. Restart the computer and empty the Trash.

☞ Quit MacKeeper before dragging it to the Trash.

☞ Let MacKeeper delete its other components before you empty the Trash.

☞ Don't try to drag MacKeeper from the Dock or the Launchpad to the Trash.

☞ Don't try to remove MacKeeper while running in safe mode.

Reply

Answer 2

thomas_r.

Level 7

31,989 points

Jun 30, 2015 3:45 AM in response to Angwilla

HTML/Rce.Gen3 is not Mac malware, so it cannot affect your Mac in any way. This may even be a false positive... I would ignore it.

What you should not ignore is the presence of MacKeeper. As long as it's installed, your system is unmaintainable. Uninstall it immediately!

As for the other problems you describe, since they're definitely not related to HTML/Rce.Gen3, I'd suggest starting a new topic to ask about them if they persist after removing MacKeeper.

Reply