Strange user has appeared in my activity monitor

Question

Level 1

9 points

Strange user has appeared in my activity monitor

Booted my Mac Pro running Mountain Lion and for the first time ever got a dialogue asking if "AMPULLITIS" can use my location.

Of course said no and tried to find out what this strange app might be and where it resides.

Could not find it so launched activity monitor to find that there several associated items all under the user name of "MICROLEPIDOPTERON"

The list of items attributed to this unknown user are :

CFPREFSD

LAUNCHD

TOLYPEUTINE

PRECOSTAL

AMPULLITIS

PAINTINGNESS

I can find nothing about any of these things doing searches except for some relationship to obscure medical terms.

Can anyone cast any light on this please as I've not noticed any of this stuff before.

Many thanks.

Rod

Posted on Jun 9, 2016 1:42 PM

Reply

Answer 1

Nov 13, 2017 5:22 AM in response to Rod Lord

I had a similar incident with a teachers computer. About 30 additional users showed up. Pics show some examples

I blame Mackeeper for it.

Etrecheck and Malwarebytes took care of that.

Reply

Answer 2

BDAqua

Level 10

250,259 points

Jun 9, 2016 6:21 PM in response to Rod Lord

Sounds like a hack or malware, no idea if it could help, but...

EtreCheck is a simple little app to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to help people help you with your Mac.

http://www.etresoft.com/etrecheck

Reply

Answer 3

Rod Lord Author

Level 1

9 points

Jun 9, 2016 6:24 PM in response to BDAqua

Thank you very much for your suggestion.

I have run Etrecheck and it found and removed adware and also found these files as unknown files :

Unknown Files: ⓘ

/Library/LaunchDaemons/com.ampullitis.plist

/etc/ampullitis.sh

/Library/LaunchDaemons/com.paintingness.plist

/etc/paintingness.sh

/Library/LaunchDaemons/com.precostal.plist

/etc/precostal.sh

/Library/LaunchDaemons/com.tolypeutine.plist

/etc/tolypeutine.sh

/Library/LaunchDaemons/com.undeservingness.plist

/etc/undeservingness.sh

5 unknown files found. [Check files]

I can't actually find them to delete them - is there some way of "un-hiding" them please ?

Reply

Answer 4

Rod Lord Author

Level 1

9 points

Jun 9, 2016 7:27 PM in response to Rod Lord

I have finally got rid of these files by running Malwarebytes.

The strange unknown user and files are now gone.

So somehow I picked up both adware and malware and I think it happened when I allowed an update of Flash player.

Somehow Mackeeper magically appeared at the same as did all this other stuff.

So this problem is closed now thanks.

Reply

Answer 5

etresoft

Level 9

56,656 points

Jun 10, 2016 5:51 AM in response to Rod Lord

Hello Rod,

Can you run another EtreCheck report to verify that they are really gone? Restart your computer first. Some of the newer variants of adware have really crossed into malware territory and cannot be easily removed.

Reply

Answer 6

Rod Lord Author

Level 1

9 points

Jun 10, 2016 9:05 AM in response to etresoft

Hi etresoft - thanks for following up on this.

Have just run Etrecheck again and it has found no unknown files now.

I have also fired up Activity monitor and there is no longer any sign of this strange user name or any of the running files I mentioned.

So I have to assume this is sorted for the time being.

I hate to think what that stuff was actually doing but it made activity monitor very frenetic and I could hear the discs accessed almost constantly as well as watching it in the monitor.

Thanks again

Rod

Reply