Pirrit - how to custom restore your data without infecting an erased MacBookPro?

Hello again Belfast MacUser,

Perhaps I should change that animation now that EtreCheck is slowly turning into an anti-malware tool. The animations don't have anything to do with adware or malware. The devil is actually a "daemon" and the other image is an "agent". It is more a play on words than anything else.

I didn't expect the malware removal to be successful the first time. It is never a good idea to try to do this kind of work manually. With the new malware that is circulating, it is virtually impossible for most people to manually remove. You need software that knows how to do the steps properly. In theory, a program like MalwareBytes has the ability to easily remove malware. Most Mac anti-malware tools fail completely. MalwareBytes was the only effective tool. But recently, people have reported that it no longer works on modern Mac malware. I know EtreCheck doesn't work on the malware from the past couple of weeks. But I work on it part-time and I won't have time for a new release for at least 3 weeks.

My biggest complaint with MalwareBytes is that we have no idea if it worked or not. While EtreCheck might not be able to remove recent malware, it will still identify it as either adware or unknown files. So I suggest you post another EtreCheck report and then we can tell you if all the malware is truly gone.

What functional problem do you have now? If your web browsers are working as expected, there is no active malware. I suggest that you get rid of any third-party software that serves no useful purpose.

Belfast MacUser wrote:

Thank you Etrecheck.

I have just completed another Etrecheck and the report is below. If I am allowed to, I will also include a screenshot showing that the daemon icon appeared which suggested that it found malware or adware (and the agent icon appeared just after that - both of these appeared just after the printers had been checked). Yet you will see that unlike on previous occasions when suspect files were identified, the Etrecheck report does not highlight any suspect files (in red). It may be that we will all just have to wait for your update when you have the time to do it. Malwarebytes identifies files but doesn't tell you where they are coming from - today (and I think previously) those files ended in .sh - so I am not sure that it is clearing the root of the problem.

Hello again Belfast MacUser,

Those icons are only meant to be cute. They don't mean anything except that EtreCheck has about another 45 seconds to run and need to do something to entertain the user.

Even though your last EtreCheck report is corrupted, it doesn't show any active malware. I think you're cured. You have already followed Linc's wise advice. You got rid of the antivirus and "clean up" tools that served no useful purpose. But you found that using EtreCheck and MalwareBytes proved very useful to detect, remove, and verify your malware infection.

I guess I should clarify what I mean by software that serves a useful purpose.

Only use software that does something for you—not (as you imagine) for the computer. A word processor, a photo editor, and a game are all examples of software that does something for you. A "cache cleaner" or a "malware scanner" does nothing for you. You didn't buy a computer so you could clean caches or scan for malware. You've already seen that automated scanning for malware doesn't work.

Never install any software, no matter what it purportedly does or where it comes from, unless you—not someone else—decided that you need it, and then only if you—not someone else—have done due diligence to determine whether it's safe. You can reasonably assume that software that you get directly from the Mac App Store or the website of a well-known, long-established developer is safe (though not necessarily that it's of good quality.)

Follow those guidelines and you'll be as safe as you can be from malware attacks.

I did download Bitdefender from the Apple Store and having seen it there I did read reviews recommending it as the best programme for removing malware/adware for the Mac.

As I mentioned, a product in the App Store is safe, in the sense that you can assume it's not malware. You can't assume that it does anything useful. That particular product is essentially useless, like all "anti-virus" software. It's worse than useless if you rely on it to protect you or rescue you from a malware attack, and therefore feel free to take risks that you wouldn't take otherwise. As for the reviews, if you search for apps that cast horoscopes or read Tarot cards, you may find one that gets better reviews than the others. That doesn't mean it can predict the future better than the others.

I also purchased CleanmyMac after reading an online review in MacWorld that gave it 4/5 stars. I had thought that that was due diligence.

It's understandable that you would think so, but the truth is that "macworld" is a trash site, and software reviews are bought and paid for all the time. Due diligence in this case would have consisted of seeking out end-user opinions and evaluating them critically. You also have to reach a certain level of sophistication as a user to know that any software that purports to automatically "clean up" or "speed up" a Mac is a scam, and that no software should ever be trusted to delete files that it didn't install.

Don't make blithe assumptions. Always think about the trust that you're reposing in the developers of any software. You don't know them personally. You're giving them at least partial control of your computer. Do you need to give them that control? Do you have a good reason to trust them?

In an ideal world, computer programmers would be licensed, like civil engineers, and there would be means of holding them accountable for their actions. In the real world, anyone can call himself a programmer and there is almost no accountability.

Hello again Belfast MacUser,

One of the things that you have learned is something that you should have already known - that people on the internet have different opinions and are more than happy to share them. Opinions, just like software, need careful evaluation. For example, when someone speaks in terms of absolutes, their opinions then have less value. The world is subtle and full of details and complications. Why should the Internet be any different?

Try posting another Etrecheck report.