I somehow got the mackeeper download that downloaded the OS X pirrit? Ive used bit defender and malwarebytes (which doesn't find anything) but everytime i restart my mac its back. I can see it in my activity monitor i can use and it shows up as random things with random user each time. Could anyone PLEASE help me get rid of this?
macjack wrote:
Sorry I read-read your post.
That's because MacKeeper is an app, not technically malware but a very bad one. It can really mess with your OS.
Uninstall it and see if that stops it.
Instructions to remove MacKeeper
MalwareBytes should still flag MacKeeper as a PUP (potentially unwanted program), but it's possible the OP removed it prior to posting. The Pirrit adware not being detected is another matter though. Hopefully Thomas will drop in here.
Reference your screen shot, have you followed the path displayed, and deleted the 4 files?
Yes I'd use the reveal in finder feature move the files to the trash and I had to find the process and force quit it then empty the trash before it started up. The problem was when I restarted another process under a different name and user would appear. it just continued in a never ending cycle and I finally just decided to save what I needed and wipe my Mac clean and start over which I hated doing.
Hi,
had the same probs, i must have clicked on the 'mackeeper' link by mistake too (ahem..) Went nuts trying to sort this, almost melted my router!
Check this, if you have hidden accounts (UID 401s) then this might help.
mackeeper - awful - accidentally clicked on something and it downloaded - brought a whole load of adware with it - pop-ups everywhere - prevented me accessing my internet banking, just got ads instead - everything slowed down. Uninstalled it following instructions on apple site, but it hung around. I had to go through all files on my mac and delete anything vaguely related to it. Still there. Then did scan with Sophos anti virus, still there. Finally downloaded and ran Malwarebytes, which got the last residual mackeeper bits and related adware and deleted them. Wow, first time my mac has ever succumbed to malware. Beware mackeeper - but Malwarebytes seems very good (and real quick to use too).
I use Avast Mac security software I have just found exactly what u have on your mac, my youngest son, playing on Roblox clicked on the mackeeper ad/message re u have a virus... on that site & now i have it...got rid of it though using Avast. https://www.avast.com/free-mac-security Very happy it found it.
This Avast seems to be very through, still using it doing whole scans or custom scans on my HD & it has stopped weird things with 'Smart mac ads' popping up in Chrome over other sites. Also an extension I was using, since deleted, Http everywhere - it might work for some but in my experience, man this thing me a lot of grief, slowness, & not loading pages...deleted it. I'll post further experiences & found bad stuff as I go here. Also I found malwarebytes didn't find anything yet. I keep using it first then Avast. 8^)
Found tonight & deleted:
Mac Pirrit-D [Adw]
/Library/rustling/rustling
/Library/wavably/wavably
Never saw this topic before, but note that we've got a beta that will do a better job of detecting VSearch (aka Pirrit):
https://forums.malwarebytes.org/topic/188888-announcing-anti-malware-for-mac-125 -beta/
The scans with the beta take a little longer on the VSearch portion of the scan, since they've done some things to make it harder to detect, and we have to scan a larger number of files looking for it.
Note that the link I have given goes to my company's web site, and links on that page may promote my company's products.
Thomas Reed
Director of Mac Offerings, Malwarebytes
I have a free version of Sophos antivirus on my Mac which found and quarantined Pirrit. I then used the clean-up option to remove it.
I would slit my throat rather than install Avast.
How to get rid of pirrit adware PLEASE help
