Kuklorest is taking over my search engine

I'm replying to this post since EtreCheck says I have Kuklorest:

Safari Extensions: ⓘ

Kuklorest

donation reminder

Evernote Web Clipper

iMedia Converter Deluxe

except I can't find it on the machine, so perhaps you can point it out to me please:

You'll note I'm using ClamXav - it occasionally finds trojans etc in MS Office Docs, which I tend to receive quite a bit.

TIA

UPDATE:

I looked in ~/Library/Safari/Extensions and found Kuklorest.safariextz in it, so trashed that. It didn't show up in the extensions list, or a Spotlight search!

DavidFerrington wrote:

I'm replying to this post since EtreCheck says I have Kuklorest:

Safari Extensions: ⓘ

Kuklorest

donation reminder

Evernote Web Clipper

iMedia Converter Deluxe

except I can't find it on the machine, so perhaps you can point it out to me please:

I looked in ~/Library/Safari/Extensions and found Kuklorest.safariextz in it, so trashed that. It didn't show up in the extensions list, or a Spotlight search!

Hello David,

Unfortunately, the Safari extension list is a bit problematic. Apple has really scrambled the Safari preferences by storing them in the Keychain. This makes it very difficult for EtreCheck to see what is going on inside Safari. Plus, it does not seem to have affected the ability of the adware developers to install malicious Safari extensions. I don't want EtreCheck to be yet another tool that demands users hand over their passwords. There are too many of those floating around. But without the keychain password, all EtreCheck can do is look on the disk for extensions.

If you have adware, I suggest using MalwareBytes for Mac (https://www.malwarebytes.org/antimalware/mac/) to remove it. I am thinking about enhancing EtreCheck to handle adware on its own, but that won't happen anytime soon.

You don't have "Kuklorest" or any other adware. Ignore the completely false warning. Quit "etrecheck" if it's running, then drag it to the Trash and empty. Never use any "anti-virus" or "anti-malware" software on a Mac for any reason, even if you do have adware. That's how you cause problems, not how you solve them, and you don't have a problem to solve.

I somehow "acquired" Kuklorest on my MacBook Pro a few weeks ago. Not sure what I had clicked on; but every evening it began prompting me to upgrade it, which I would abort. So I began looking for information on what it is and what I could do about it.

I easily found this post and followed your instructions. I located Kuklorest-related files in ~/Library/LaunchAgents, in Applications, and in ~/Library/Application Support. I removed them and rebooted, and it worked great.

Thanks for the excellent guidance you provided to the original posters; it's helping other people out here as well!

it's helping other people out here as well!

Thanks for your encouraging comment. I'm trying to get people to think for themselves and build up a commons of information on the subject of preventing and removing malware infections. Mac users get nothing from Apple Support, and usually nothing on this site, when they need that kind of help. The inevitable result of throwing themselves on the mercy of the anti-virus industry will be that the Mac platform will become an open sewer overflowing with malware, like Windows and Android.

I have Windows PCs as well as Mac, and I can assure that they are not "open sewers flowing with malware". I haven't ever had a virus or Trojan on my Windows machines. I can appreciate your helping others, but really, don't engage in delusions. Everyone should practice safe computing no matter what they use.

Hello l'Mendota,

But that is because you use anti-virus on Windows. No Windows user would be considered to practice "safe computing" without that. On the Mac, the malware scene is still in its early stages. While Mac people always made fun of Windows people for malware, the Windows people replied that it was just because the Mac wasn't popular. It turns out the Windows people were right. Now that the Mac is becoming more popular (thanks in large part to the iPhone), we are now starting to suffer from malware. But the Mac anti-malware industry is still in its infancy. Most Mac anti-malware software are still crude ports from Windows that only check for Windows malware. I can't tell you how many EtreCheck reports I've seen that have multiple types of adware installed right next to Mac anti-malware. And the idea of "safe computing" on the Mac is still at a very naive level where people just blame the victim and accuse them of going to illicit web sites. Things are a bit messed up right now. It will only get worse for the foreseeable future.

Whatever Kuklorest is, which I assume it's an adware, right? Whatever it is, he's a persistent dude. I've had to use your excellent instructions twice more to get rid of it since my original response on 4/24, including tonight. I can only assume it's coming from something on Facebook, which I need to figure out what to STOP doing there. At least thanks to you, I know how to get rid of it.

Thanks again.