[WORKING!] Completely Remove Snowbitt Virus and HighJacker Removal Complete Safari and Chrome
I have been dealing with Snowbitt virus on my MacBook Pro in Chrome browser not in Safari. Lots of research after this issue i am dealing with that one more than 3-4 months. Now i have realized that i couldn't find any sufficient answers and most of the questions redirects peoples to download not neccessary applications or malwares to install. You dont need anything to install or to do just read this article and any suggested questions and answers please mail me. or tweet me (https://twitter.com/hsnbilgen)
1- Check your ../Library/ folder
2- Find if it has "../Library/backup.zip" and Delete
3- if you find that zipped file which shows you will see there will be "../Library/watch.log" and "../Library/saml" files also
4- Find if it has "../Library/saml" file and Delete
5- Now only you will do is Delete three file under Library
6- Your virus will be removed completely from you mac.
Attention: I suggest you mackers before delete the "watch.log" file be sure where the SnowBitt **** is coming from. This is my scenario on my Mac. Maybe older versions keeps the tar file in another files or folders. saml is the exec file under Library this is the trojan 😀 and source is the backup.zip Be safe and secure at http://127.0.0.1 .Cheers 😉
Here is a part of "watch.log" file:
Watcher - Reinstalling...
convertFile - /Library/backup.zip to /Library/SnowBitt.tar.gz
Watcher - cd /Library/; tar xfz SnowBitt.tar.gz; rm -f SnowBitt.tar.gz;
Watcher - cd /Library/SnowBitt; ./setup.sh "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= hp&type=YHS_TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= nt&type=YHS_TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= ds&type=TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1" SnowBitt PPa865780bfe3e8a8f-2-FS-TR--74D38A34-5681-5F59-A637-02D76180C013 noinit;
Checking for competitors... done.
debug(): Safari new version url error
debug(): Safari's homepage not found. Reinstall.
Name saml User hasanbilgen Browsers SnowBitt__Chrome-Succeed __Safari-Failed-http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= hp&type=YHS_TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1 is not registered
Log-"http://t.trkitok.com/track/slog?mid=74D38A34-5681-5F59-A637-02D76180C013&log=Dat a replaced_Name saml User hasanbilgen Browsers SnowBitt__Chrome-Succeed __Safari-Failed-http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= hp&type=YHS_TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1 is not registered"
Watcher - Reinstalling...
convertFile - /Library/backup.zip to /Library/SnowBitt.tar.gz
Watcher - cd /Library/; tar xfz SnowBitt.tar.gz; rm -f SnowBitt.tar.gz;
Watcher - cd /Library/SnowBitt; ./setup.sh "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= hp&type=YHS_TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= nt&type=YHS_TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype= ds&type=TGE_PPa865780bfe3e8a8f-2-FS-TR&_=tt1" SnowBitt PPa865780bfe3e8a8f-2-FS-TR--74D38A34-5681-5F59-A637-02D76180C013 noinit;
Checking for competitors... done.
Error count hits threshold. Avoiding error loop.
Error count hits threshold. Avoiding error loop.
Message was edited by: hsnbilgen
MacBook Pro, macOS Sierra (10.12.3), Chrome Browser