CJ706
Level 1 (4 points)
Mac OS X

Q: How to get rid of pirrit adware PLEASE help

I somehow got the mackeeper download that downloaded the OS X pirrit? Ive used bit defender and malwarebytes (which doesn't find anything) but everytime i restart my mac its back. I can see it in my activity monitor i can use and it shows up as random things with random user each time. Could anyone PLEASE help me get rid of this?

 

Screen Shot 2016-06-03 at 4.24.13 PM.pngScreen Shot 2016-06-03 at 4.23.29 PM.pngScreen Shot 2016-06-03 at 4.24.41 PM.png

Posted on Jun 3, 2016 1:31 PM

Close
CJ706

Q: How to get rid of pirrit adware PLEASE help

  • All replies
  • Helpful answers

  • by macjack,

    macjack macjack Jun 3, 2016 1:35 PM in response to CJ706
    Level 9 (55,709 points)
    Mac OS X
    Jun 3, 2016 1:35 PM in response to CJ706

    Download and run MalwareBytes. Malwarebytes was developed by one of our own colleagues here in ASC. It gets rave reviews and is about the most proven anti-malware software for Mac.

  • by CJ706,

    CJ706 CJ706 Jun 3, 2016 1:46 PM in response to macjack
    Level 1 (4 points)
    Mac OS X
    Jun 3, 2016 1:46 PM in response to macjack

    I've downloaded it. MalwareBytes doesn't find anything.

  • by macjack,

    macjack macjack Jun 3, 2016 1:58 PM in response to CJ706
    Level 9 (55,709 points)
    Mac OS X
    Jun 3, 2016 1:58 PM in response to CJ706

    Sorry I read-read your post.

    That's because MacKeeper is an app, not technically malware but a very bad one. It can really mess with your OS.

    Uninstall it and see if that stops it.

    Instructions to remove MacKeeper

    https://mackeeper.com/uninstall_mackeeper

  • by CJ706,

    CJ706 CJ706 Jun 3, 2016 2:14 PM in response to macjack
    Level 1 (4 points)
    Mac OS X
    Jun 3, 2016 2:14 PM in response to macjack

    I've uninstalled the mackeeper but i still have this pirrit adware on my mac that won't go away. bit defender will find it and delete it but its back under something else when i restart my mac.

  • by OGELTHORPE,

    OGELTHORPE OGELTHORPE Jun 3, 2016 5:00 PM in response to CJ706
    Level 9 (52,764 points)
    Mac OS X
    Jun 3, 2016 5:00 PM in response to CJ706

    If Malwarebytes Anti-Malware for Mac did not take care of 'pirrit', open Malwarebytes again, click on HELP and from the drop down menu click on CONTACT SUPPORT.

     

    Ciao.

  • by stevejobsfan0123,

    stevejobsfan0123 stevejobsfan0123 Jun 3, 2016 5:04 PM in response to macjack
    Level 8 (44,007 points)
    iPhone
    Jun 3, 2016 5:04 PM in response to macjack

    macjack wrote:

     

    Sorry I read-read your post.

    That's because MacKeeper is an app, not technically malware but a very bad one. It can really mess with your OS.

    Uninstall it and see if that stops it.

    Instructions to remove MacKeeper

    https://mackeeper.com/uninstall_mackeeper

    MalwareBytes should still flag MacKeeper as a PUP (potentially unwanted program), but it's possible the OP removed it prior to posting. The Pirrit adware not being detected is another matter though. Hopefully Thomas will drop in here.

  • by Eric Root,

    Eric Root Eric Root Jun 4, 2016 8:35 AM in response to CJ706
    Level 9 (73,971 points)
    iTunes
    Jun 4, 2016 8:35 AM in response to CJ706

    Reference your screen shot, have you followed the path displayed, and deleted the 4 files?

  • by CJ706,

    CJ706 CJ706 Jun 4, 2016 10:24 AM in response to Eric Root
    Level 1 (4 points)
    Mac OS X
    Jun 4, 2016 10:24 AM in response to Eric Root

    Yes I'd use the reveal in finder feature move the files to the trash and I had to find the process and force quit it then empty the trash before it started up. The problem was when I restarted another process under a different name and user would appear. it just continued in a never ending cycle and I finally just decided to save what I needed and wipe my Mac clean and start over which I hated doing.

  • by sacundai,

    sacundai sacundai Jun 15, 2016 11:09 AM in response to CJ706
    Level 1 (4 points)
    Jun 15, 2016 11:09 AM in response to CJ706

    Hi,

     

    had the same probs, i must have clicked on the 'mackeeper' link by mistake too (ahem..) Went nuts trying to sort this, almost melted my router!

    Check this, if you have hidden accounts (UID 401s) then this might help.

     

    https://github.com/aserper/osx.pirrit_removal

  • by fireandice11,

    fireandice11 fireandice11 Jun 29, 2016 10:27 AM in response to CJ706
    Level 1 (4 points)
    Jun 29, 2016 10:27 AM in response to CJ706

    mackeeper - awful - accidentally clicked on something and it downloaded - brought a whole load of adware with it - pop-ups everywhere - prevented me accessing my internet banking, just got ads instead - everything slowed down. Uninstalled it following instructions on apple site, but it hung around. I had to go through all files  on my mac and delete anything vaguely related to it. Still there. Then did scan with Sophos anti virus, still there. Finally downloaded and ran Malwarebytes, which got the last residual mackeeper bits and related adware and deleted them. Wow, first time my mac has ever succumbed to malware. Beware mackeeper - but Malwarebytes seems very good (and real quick to use too).

  • by Click,

    Click Click Oct 16, 2016 3:54 AM in response to CJ706
    Level 1 (13 points)
    Mac OS X
    Oct 16, 2016 3:54 AM in response to CJ706

    I use Avast Mac security software I have just found exactly what u have on your mac, my youngest son, playing on Roblox clicked on the mackeeper ad/message re u have a virus... on that site & now i have it...got rid of it though using Avast. https://www.avast.com/free-mac-security  Very happy it found it.

     

    This Avast seems to be very through, still using it doing whole scans or custom scans on my HD & it has stopped weird things with 'Smart mac ads' popping up in Chrome over other sites. Also an extension I was using, since deleted, Http everywhere - it might work for some but in my experience, man this thing me a lot of grief, slowness, & not loading pages...deleted it. I'll post further experiences & found bad stuff as I go here. Also I found malwarebytes  didn't find anything yet. I keep using it first then Avast. 8^)

     

    Found tonight & deleted:

    Mac Pirrit-D [Adw]

    /Library/rustling/rustling

    /Library/wavably/wavably

  • by thomas_r.,

    thomas_r. thomas_r. Oct 16, 2016 7:22 AM in response to Click
    Level 7 (30,944 points)
    Mac OS X
    Oct 16, 2016 7:22 AM in response to Click

    Never saw this topic before, but note that we've got a beta that will do a better job of detecting VSearch (aka Pirrit):

     

    https://forums.malwarebytes.org/topic/188888-announcing-anti-malware-for-mac-125 -beta/

     

    The scans with the beta take a little longer on the VSearch portion of the scan, since they've done some things to make it harder to detect, and we have to scan a larger number of files looking for it.

     

    Note that the link I have given goes to my company's web site, and links on that page may promote my company's products.

     

    Thomas Reed

    Director of Mac Offerings, Malwarebytes