Launching Safari defaults to wolfnknite

Hello Mr Quorange,

There may be other parts to the app you still need to remove. I recently added this brand of adware to EtreCheck. Download EtreCheck from http://www.etrecheck.com, run it, and paste the results here. EtreCheck is perfectly safe to run, does not ask for your password to install, and is signed with my Apple Developer ID.

The EtreCheck report should have the adware listed. You can then deleted it from within EtreCheck. You may still need to reset your home page in Safari.

Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.

Hello again Mr Quorange,

The short answer is that you buy an external hard drive and start running Time Machine. If a minor adware infection gets you to start running Time Machine, then you might be able to say that adware was beneficial for you. 🙂

If you really want to live dangerously, EtreCheck does print the full path to these adware items. You can go to Finder > Go > hold own option key > Library. Then go into the "LaunchAgents" directory and delete the files manually. Make sure to logout and/or restart afterwards.

You also have a Safari extension with the same name. I haven't done as much with checking Safari extensions, so you will have to remove that manually from within Safari.

Items listed under "adware" are definitely adware. Items listed under "unknown files" might or might not be adware. I haven't definitively decided if they are adware or not. The "com.ShoppyTool.agent.plist" file sure looks like adware. I don't know about "com.SoftwareUpdater.agent.plist". The "ZipCloud" items are sometimes called adware. It looks like you could safely get rid of everything in that directory. You may still have executables on your hard disk, but they won't be running automatically anymore.

Hi, i have the same problem today. Here is the report.

EtreCheck version: 2.9.3 (253)

Report generated 2016-02-05 22:21:59

Download EtreCheck from http://etrecheck.com

Runtime 1:31

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Click the [Remove] links to remove adware.

Click the [Check files] link for help with unknown files.

Problem: No problem - just checking

Hardware Information:ⓘ

MacBook Pro (Retina, 13-inch, Early 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro12,1

1 2.7 GHz Intel Core i5 CPU: 2-core

8 GB RAM Not upgradeable

BANK 0/DIMM0

4 GB DDR3 1867 MHz ok

BANK 1/DIMM0

4 GB DDR3 1867 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 15 - SN = D865453W132FY5GCE

Video Information:ⓘ

Intel Iris Graphics 6100

Color LCD 1920 x 1080

SAMSUNG 1920 x 1080

System Software:ⓘ

OS X El Capitan 10.11 (15A284) - Time since boot: about 32 days

Disk Information:ⓘ

APPLE SSD SM0128G disk0 : (121.33 GB) (Solid State - TRIM: Yes)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 120.11 GB (55.71 GB free)

Encrypted AES-XTS Unlocked

Core Storage: disk0s2 120.47 GB Online

USB Information:ⓘ

Broadcom Corp. Bluetooth USB Host Controller

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

Gatekeeper:ⓘ

Mac App Store and identified developers

Adware:ⓘ

~/Library/LaunchAgents/Wolfnknite.AppVemoral.plist

~/Library/LaunchAgents/Wolfnknite.btvlit.plist

~/Library/LaunchAgents/Wolfnknite.dolnwoad.plist

~/Library/LaunchAgents/Wolfnknite.uadpte.plist

4 adware files found. [Remove]

Unknown Files:ⓘ

/Library/LaunchAgents/com.ShopTool.agent.plist

/Library/LaunchAgents/com.SoftwareUpdater.agent.plist

/Library/LaunchAgents/com.sogou.SogouServices.plist

~/Library/LaunchAgents/com.ShopTool.agent.plist

~/Library/LaunchAgents/com.SoftwareUpdater.agent.plist

~/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist

~/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist

~/Library/LaunchAgents/com.pcv.hlpramcn.plist

8 unknown files found. [Check files]

System Launch Agents:ⓘ

[killed] com.apple.BezelUI.plist

[killed] com.apple.CallHistoryPluginHelper.plist

[killed] com.apple.CallHistorySyncHelper.plist

[killed] com.apple.DiskArbitrationAgent.plist

[killed] com.apple.EscrowSecurityAlert.plist

[killed] com.apple.FolderActionsDispatcher.plist

[killed] com.apple.SafariPlugInUpdateNotifier.plist

[killed] com.apple.cmfsyncagent.plist

[killed] com.apple.coreservices.appleid.authentication.plist

[killed] com.apple.gamed.plist

[killed] com.apple.icloud.fmfd.plist

[killed] com.apple.printtool.agent.plist

[killed] com.apple.printuitool.agent.plist

[killed] com.apple.rcd.plist

[killed] com.apple.rtcreportingd.plist

[killed] com.apple.scopedbookmarkagent.xpc.plist

[killed] com.apple.telephonyutilities.callservicesd.plist

[loaded] 144 Apple tasks

[running] 74 Apple tasks

17 processes killed due to insufficient RAM

System Launch Daemons:ⓘ

[killed] com.apple.GSSCred.plist

[killed] com.apple.corestorage.corestoragehelperd.plist

[killed] com.apple.emond.aslmanager.plist

[killed] com.apple.findmymac.plist

[killed] com.apple.ifdreader.plist

[killed] com.apple.periodic-daily.plist

[killed] com.apple.periodic-monthly.plist

[killed] com.apple.periodic-weekly.plist

[killed] com.apple.printtool.daemon.plist

[killed] com.apple.softwareupdate_download_service.plist

[killed] com.apple.system_installd.plist

[killed] com.apple.systemstats.analysis.plist

[killed] com.apple.wdhelper.plist

[killed] com.apple.xpc.smd.plist

[loaded] 181 Apple tasks

[running] 90 Apple tasks

14 processes killed due to insufficient RAM

Launch Agents:ⓘ

[running] com.ShopTool.agent.plist [Support]

[loaded] com.SoftwareUpdater.agent.plist [Support]

[loaded] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a...plist [Support]

[running] com.sogou.SogouServices.plist [Support]

Launch Daemons:ⓘ

[loaded] com.adobe.ARMDC.Communicator.plist [Support]

[loaded] com.adobe.ARMDC.SMJobBlessHelper.plist [Support]

[loaded] com.adobe.fpsaud.plist [Support]

User Launch Agents:ⓘ

[loaded] Wolfnknite.AppVemoral.plist Adware! [Remove]

[loaded] Wolfnknite.btvlit.plist Adware! [Remove]

[loaded] Wolfnknite.dolnwoad.plist Adware! [Remove]

[loaded] Wolfnknite.uadpte.plist Adware! [Remove]

[running] com.ShopTool.agent.plist [Support]

[loaded] com.SoftwareUpdater.agent.plist [Support]

[loaded] com.google.keystone.agent.plist [Support]

[loaded] com.jdibackup.ZipCloud.autostart.plist [Support]

[failed] com.jdibackup.ZipCloud.notify.plist [Support] [Details]

[running] com.pcv.hlpramcn.plist [Support]

User Login Items:ⓘ

iTunesHelper Application (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Advanced Mac Cleaner UNKNOWN (missing value)

Other Apps:ⓘ

[running] com.apple.xpc.launchd.oneshot.0x1000006c.EtreCheck

[running] com.google.Chrome.76192

[loaded] com.mackeeper.MacKeeper.service.clean

[running] com.sogou.inputmethod.sogou.62432

[running] com.youdao.YoudaoDict.65952

[loaded] com.yourcompany.mediaDownloader.70752

Internet Plug-ins:ⓘ

AdobePDFViewerNPAPI: Version: 15.010.20056 - SDK 10.8 [Support]

FlashPlayer-10.6: Version: 20.0.0.286 - SDK 10.6 [Support]

AdobePDFViewer: Version: 15.010.20056 - SDK 10.8 [Support]

QuickTime Plugin: Version: 7.7.3

Flash Player: Version: 20.0.0.286 - SDK 10.6 [Support]

Default Browser: Version: 601 - SDK 10.11

Safari Extensions:ⓘ

Wolfnknite

Pin It Button

3rd Party Preference Panes:ⓘ

Flash Player [Support]

Time Machine:ⓘ

Time Machine not configured!

Top Processes by CPU:ⓘ

16% (osascript)

15% WindowServer

11% com.apple.WebKit.WebContent(7)

7% Safari

6% com.apple.WebKit.Networking

Top Processes by Memory:ⓘ

1.36 GB kernel_task

1.12 GB com.apple.WebKit.WebContent(7)

942 MB Google Chrome Helper(6)

197 MB mdworker(11)

188 MB Google Chrome

Virtual Memory Information:ⓘ

659 MB Free RAM

7.35 GB Used RAM (1.59 GB Cached)

336 MB Swap Used

i have a hard drive that can be set as time machine. But the problem is that i don't know whether the documents existing in this hard drive will be remove once i set it as time machine?

Hello alashn,

If you don't have a backup, that should be your first priority - before removing adware. Make a backup of your machine, including the adware. Then remove the adware. Then make another backup without the adware.

The Mac is becoming more and more like Windows every day. This new adware epidemic is a good example of that. I remember about 12 years ago I was cleaning malware from a friend's PC. It was so tightly integrated with the system that it would not function without the malware. I had to restore some of the malware from backup and just tell my friend to alwasys use Firefox instead of Internet Explorer. That is why EtreCheck requires a Time Machine backup before removing malware.

Hello again Mr Quorange,

MalwareBytes is a good product. Up until a few days ago EtreCheck would recommend using MalwareBytes to remove adware. But there are some subtle differences in how EtreCheck and MalwareBytes detect and handle adware. If EtreCheck is reporting something as adware, I want to be sure that it will be properly handled. While MalwareBytes is frequently recommended, even by me, I can't honestly say I'm "sure" about what it does, because I haven't seen the source code for it. In the end, EtreCheck is my responsibility, so I felt I needed to handle adware that EtreCheck reports myself.

alashn wrote:

Hi, i have the same problem today. Here is the report.

EtreCheck version: 2.9.3 (253)

Report generated 2016-02-05 22:21:59

Download EtreCheck from http://etrecheck.com

Runtime 1:31

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Click the [Remove] links to remove adware.

Click the [Check files] link for help with unknown files.

Problem: No problem - just checking

Hardware Information: ⓘ

MacBook Pro (Retina, 13-inch, Early 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro12,1

1 2.7 GHz Intel Core i5 CPU: 2-core

8 GB RAM Not upgradeable

BANK 0/DIMM0

4 GB DDR3 1867 MHz ok

BANK 1/DIMM0

4 GB DDR3 1867 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 15 - SN = D865453W132FY5GCE

Video Information: ⓘ

Intel Iris Graphics 6100

Color LCD 1920 x 1080

SAMSUNG 1920 x 1080

System Software: ⓘ

OS X El Capitan 10.11 (15A284) - Time since boot: about 32 days

Disk Information: ⓘ

APPLE SSD SM0128G disk0 : (121.33 GB) (Solid State - TRIM: Yes)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 120.11 GB (55.71 GB free)

Encrypted AES-XTS Unlocked

Core Storage: disk0s2 120.47 GB Online

USB Information: ⓘ

Broadcom Corp. Bluetooth USB Host Controller

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Gatekeeper: ⓘ

Mac App Store and identified developers

Adware: ⓘ

~/Library/LaunchAgents/Wolfnknite.AppVemoral.plist

~/Library/LaunchAgents/Wolfnknite.btvlit.plist

~/Library/LaunchAgents/Wolfnknite.dolnwoad.plist

~/Library/LaunchAgents/Wolfnknite.uadpte.plist

4 adware files found. [Remove]

Unknown Files: ⓘ

/Library/LaunchAgents/com.ShopTool.agent.plist

/Library/LaunchAgents/com.SoftwareUpdater.agent.plist

/Library/LaunchAgents/com.sogou.SogouServices.plist

~/Library/LaunchAgents/com.ShopTool.agent.plist

~/Library/LaunchAgents/com.SoftwareUpdater.agent.plist

~/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist

~/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist

~/Library/LaunchAgents/com.pcv.hlpramcn.plist

8 unknown files found. [Check files]

System Launch Agents: ⓘ

[killed] com.apple.BezelUI.plist

[killed] com.apple.CallHistoryPluginHelper.plist

[killed] com.apple.CallHistorySyncHelper.plist

[killed] com.apple.DiskArbitrationAgent.plist

[killed] com.apple.EscrowSecurityAlert.plist

[killed] com.apple.FolderActionsDispatcher.plist

[killed] com.apple.SafariPlugInUpdateNotifier.plist

[killed] com.apple.cmfsyncagent.plist

[killed] com.apple.coreservices.appleid.authentication.plist

[killed] com.apple.gamed.plist

[killed] com.apple.icloud.fmfd.plist

[killed] com.apple.printtool.agent.plist

[killed] com.apple.printuitool.agent.plist

[killed] com.apple.rcd.plist

[killed] com.apple.rtcreportingd.plist

[killed] com.apple.scopedbookmarkagent.xpc.plist

[killed] com.apple.telephonyutilities.callservicesd.plist

[loaded] 144 Apple tasks

[running] 74 Apple tasks

17 processes killed due to insufficient RAM

System Launch Daemons: ⓘ

[killed] com.apple.GSSCred.plist

[killed] com.apple.corestorage.corestoragehelperd.plist

[killed] com.apple.emond.aslmanager.plist

[killed] com.apple.findmymac.plist

[killed] com.apple.ifdreader.plist

[killed] com.apple.periodic-daily.plist

[killed] com.apple.periodic-monthly.plist

[killed] com.apple.periodic-weekly.plist

[killed] com.apple.printtool.daemon.plist

[killed] com.apple.softwareupdate_download_service.plist

[killed] com.apple.system_installd.plist

[killed] com.apple.systemstats.analysis.plist

[killed] com.apple.wdhelper.plist

[killed] com.apple.xpc.smd.plist

[loaded] 181 Apple tasks

[running] 90 Apple tasks

14 processes killed due to insufficient RAM

Launch Agents: ⓘ

[running] com.ShopTool.agent.plist [Support]

[loaded] com.SoftwareUpdater.agent.plist [Support]

[loaded] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a...plist [Support]

[running] com.sogou.SogouServices.plist [Support]

Launch Daemons: ⓘ

[loaded] com.adobe.ARMDC.Communicator.plist [Support]

[loaded] com.adobe.ARMDC.SMJobBlessHelper.plist [Support]

[loaded] com.adobe.fpsaud.plist [Support]

User Launch Agents: ⓘ

[loaded] Wolfnknite.AppVemoral.plist Adware! [Remove]

[loaded] Wolfnknite.btvlit.plist Adware! [Remove]

[loaded] Wolfnknite.dolnwoad.plist Adware! [Remove]

[loaded] Wolfnknite.uadpte.plist Adware! [Remove]

[running] com.ShopTool.agent.plist [Support]

[loaded] com.SoftwareUpdater.agent.plist [Support]

[loaded] com.google.keystone.agent.plist [Support]

[loaded] com.jdibackup.ZipCloud.autostart.plist [Support]

[failed] com.jdibackup.ZipCloud.notify.plist [Support] [Details]

[running] com.pcv.hlpramcn.plist [Support]

User Login Items: ⓘ

iTunesHelper Application (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Advanced Mac Cleaner UNKNOWN (missing value)

Other Apps: ⓘ

[running] com.apple.xpc.launchd.oneshot.0x1000006c.EtreCheck

[running] com.google.Chrome.76192

[loaded] com.mackeeper.MacKeeper.service.clean

[running] com.sogou.inputmethod.sogou.62432

[running] com.youdao.YoudaoDict.65952

[loaded] com.yourcompany.mediaDownloader.70752

Internet Plug-ins: ⓘ

AdobePDFViewerNPAPI: Version: 15.010.20056 - SDK 10.8 [Support]

FlashPlayer-10.6: Version: 20.0.0.286 - SDK 10.6 [Support]

AdobePDFViewer: Version: 15.010.20056 - SDK 10.8 [Support]

QuickTime Plugin: Version: 7.7.3

Flash Player: Version: 20.0.0.286 - SDK 10.6 [Support]

Default Browser: Version: 601 - SDK 10.11

Safari Extensions: ⓘ

Wolfnknite

Pin It Button

3rd Party Preference Panes: ⓘ

Flash Player [Support]

Time Machine: ⓘ

Time Machine not configured!

Top Processes by CPU: ⓘ

16% (osascript)

15% WindowServer

11% com.apple.WebKit.WebContent(7)

7% Safari

6% com.apple.WebKit.Networking

Top Processes by Memory: ⓘ

1.36 GB kernel_task

1.12 GB com.apple.WebKit.WebContent(7)

942 MB Google Chrome Helper(6)

197 MB mdworker(11)

188 MB Google Chrome

Virtual Memory Information: ⓘ

659 MB Free RAM

7.35 GB Used RAM (1.59 GB Cached)

336 MB Swap Used

Your computer is in trouble. You've got a ton of adware on it, plus MacKeeper, which is the equivalent of giving your computer a social disease. Run Malwarebytes Anti-Malware for Macto get rid of it, then follow the steps in this article to get rid of MacKeeper.

http://www.macworld.com/article/2861435/software-utilities/how-to-uninstall-mack eeper-from-your-mac.html

Thanks so much. Malwarebytes Anti-Malware for mac did great job in a foolproof way. I tried some apps but those can't solve the problem. So i don't want to do sth else and just booked a genius bar reservation. I was ready to have may macbook factory reset, because i got it just for 1 month, there was nothing important on it. The guy in genius bar just download Malwarebytes and scan my macbook, then the problem was solved in one second.

Thank you for your information. Finally i get rid of those malware by download malwarebytes. My first macbook worked great in last 4 years, the one i am using now is just 1 month. Maybe i should be more carefully now, because like what you said that Mac is becoming more and more like Windows every day.