pulsestart malware removal
How do I get rid of this malware? A Grandkid mistakenly clicked on something and now Safari loads with this each time.
MacBook Air, macOS High Sierra (10.13.4)
How do I get rid of this malware? A Grandkid mistakenly clicked on something and now Safari loads with this each time.
MacBook Air, macOS High Sierra (10.13.4)
1. BackUp your Mac.
2. Close all windows and quit all other applications.
Hold "option" key down and click "Go" menu in the Finder menu bar.
Library will appear between “Home” and “Computer” entries in the dropdown.
Select "Library" from the dropdown.
Click the “List” view button in the Finder toolbar.
Scroll down the list.
Click open the Launch Agents folder.
If you see
“com.NetLookupSearch.plist”
right click on it and choose “Move To Trash”.
2. Safari > Preferences > Extensions
Temporarily disable all extensions.
3. Restart and test.
1. BackUp your Mac.
2. Close all windows and quit all other applications.
Hold "option" key down and click "Go" menu in the Finder menu bar.
Library will appear between “Home” and “Computer” entries in the dropdown.
Select "Library" from the dropdown.
Click the “List” view button in the Finder toolbar.
Scroll down the list.
Click open the Launch Agents folder.
If you see
“com.NetLookupSearch.plist”
right click on it and choose “Move To Trash”.
2. Safari > Preferences > Extensions
Temporarily disable all extensions.
3. Restart and test.
Please run EtreCheck and post the report here. This is a diagnostic test.
Click “Free Download” button, open Downloads folder, click on it to open, and then select ”Open”.
Click on the bouncing EtreCheck icon in the Dock.
“Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.
Click “Share Report” button in the toolbar, select “Copy to Clipboard” .
Paste it into the reply.
EtreCheck version: 4.2.1 (4C020)
Report generated: 2018-05-04 12:39:49
Download EtreCheck from https://etrecheck.com
Runtime: 3:31
Performance: Good
Problem: Other problem
Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup- Time Machine backup not found.
Minor Issues:
These issues do not need immediate attention but they may indicate future problems.
Unsigned files- There is unsigned software installed. They appear to be legitimate but should be reviewed.
32-bit Apps- This machine has 32-bits apps that may have problems in the future.
Hardware Information:
MacBook Air (13-inch, 2017)
MacBook Air Model: MacBookAir7,2
1 1.8 GHz Intel Core i5 (i5-5350U) CPU: 2-core
8 GB RAMNot upgradeable
BANK 0/DIMM0 - 4 GB DDR3 1600 ok
BANK 1/DIMM0 - 4 GB DDR3 1600 ok
Battery: Health = Normal - Cycle count = 25
Video Information:
Intel HD Graphics 6000 - VRAM: 1536 MB
Color LCD 1440 x 900
Drives:
disk0 - APPLE SSD SM0256G 251.00 GB (Solid State - TRIM: Yes)
Internal PCI 5.0 GT/s x4 Serial ATA
disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk0s2 () 250.79 GB
disk1s1 - Macintosh HD (APFS) 250.79 GB (108.62 GB used)
disk1s2 - Preboot (APFS) [APFS Preboot] 250.79 GB (21 MB used)
disk1s3 - Recovery (APFS) [Recovery] 250.79 GB (518 MB used)
disk1s4 - VM (APFS) [APFS VM] 250.79 GB (2.15 GB used)
Mounted Volumes:
disk1s1 - Macintosh HD 250.79 GB (139.35 GB free)
APFS
Mount point: /
Encrypted
disk1s4 - VM [APFS VM] 250.79 GB (139.35 GB free)
APFS
Mount point: /private/var/vm
Network:
Interface en3: iPad
Interface en0: Wi-Fi
802.11 a/b/g/n/ac
One IPv4 address
Interface en4: iPhone
Interface en2: Bluetooth PAN
Interface bridge0: Thunderbolt Bridge
iCloud Quota: 94.43 GB available
System Software:
macOS High Sierra 10.13.4 (17E199)
Time since boot: About an hour
System Load: 1.36 (1 min ago) 1.93 (5 min ago) 2.58 (15 min ago)
Security:
| System | Status |
|---|---|
| Gatekeeper | Mac App Store and identified developers |
| System Integrity Protection | Enabled |
Unsigned Files:
Launchd: ~/Library/LaunchAgents/com.NetLookupSearch.plist
Executable: /Users/***/Library/Application Support/com.NetLookupSearch/NetLookupSearch r
32-bit Applications:
9 32-bit apps
Kernel Extensions:
/Applications/zoom.us.app
[Not Loaded] ZoomAudioDevice.kext (1.1 - SDK 10.8)
System Launch Agents:
| [Not Loaded] | 8 Apple tasks |
| [Loaded] | 159 Apple tasks |
| [Running] | 125 Apple tasks |
| [Other] | One Apple task |
System Launch Daemons:
| [Not Loaded] | 34 Apple tasks |
| [Loaded] | 184 Apple tasks |
| [Running] | 116 Apple tasks |
Launch Agents:
| [Running] | com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2018-04-27) |
| [Loaded] | com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-04-19) |
| [Not Loaded] | com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2018-04-19) |
| [Loaded] | com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-04-23) |
| [Other] | com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2018-04-13) |
Launch Daemons:
| [Loaded] | com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-04-13) |
| [Loaded] | com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-04-19) |
| [Running] | com.adobe.acc.installer.plist (Adobe Systems, Inc. - installed 2018-04-27) |
| [Loaded] | com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-03-26) |
| [Running] | com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-04-23) |
| [Loaded] | com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-04-13) |
| [Loaded] | com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2018-03-12) |
User Launch Agents:
| [Loaded] | com.google.keystone.agent.plist (Google, Inc. - installed 2018-04-27) |
| [Loaded] | com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-04-23) |
| [Loaded] | com.NetLookupSearch.plist (? 0 - installed 2018-05-02) |
User Login Items:
CricutLauncher4 Application (Provo Craft and Novelty, Inc.
(/Users/***/Library/Application Support/CricutDesignSpace3/BRIDGE/CricutLauncher4.app)
iTunesHelper Application (Apple - installed 2018-03-30)
(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
AdobeResourceSynchronizer Application (Adobe Systems, Inc.
(/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Helpers/AdobeResourceSynchronizer.app)
Internet Plug-ins:
AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-04-19)
FlashPlayer-10.6: 29.0.0.140 (installed 2018-04-10)
AdobePDFViewer: 18.011.20038 (installed 2018-04-19)
QuickTime Plugin: 7.7.3 (installed 2018-04-23)
Flash Player: 29.0.0.140 (installed 2018-04-10)
AdobeAAMDetect: 3.0.0.0 (installed 2018-04-27)
User Internet Plug-ins:
ZoomUsPlugIn: 4.1.23108.0402 (installed 2018-04-08)
Safari Extensions:
| DirectTrusted.safariextz - - (installed 2018-04-19) |
3rd Party Preference Panes:
Flash Player (installed 2018-03-26)
Time Machine:
Time Machine Not Configured!
Top Processes by CPU:
| Process (count) | Source | % of CPU |
| WindowServer | Apple | 9 |
| kernel_task | Apple | 3 |
| Adobe CEF Helper (2) | Adobe Systems, Inc. | 1 |
| sandboxd | Apple | 0 |
| Apple | 0 |
Top Processes by Memory:
| Process (count) | Source | RAM usage |
| com.apple.WebKit.WebContent (7) | Apple | 948 MB |
| kernel_task | Apple | 862 MB |
| Apple | 681 MB | |
| mdworker (29) | Apple | 500 MB |
| Microsoft Word | Microsoft Corporation | 248 MB |
Top Processes by Network Use:
| Process | Source | Input | Output |
| mDNSResponder | Apple | 1 MB | 188 KB |
| Apple | 278 KB | 25 KB | |
| CalendarAgent | Apple | 44 KB | 5 KB |
| apsd | Apple | 12 KB | 14 KB |
| netbiosd | Apple | 12 KB | 8 KB |
Top Processes by Energy Use:
| Process (count) | Source | Energy usage (0-100) |
| CalendarAgent | Apple | 8 |
| Calendar | Apple | 3 |
| CalNCService | Apple | 2 |
| WindowServer | Apple | 1 |
| Adobe CEF Helper (2) | Adobe Systems, Inc. | 1 |
Virtual Memory Information:
| Available RAM | 2.23 GB |
| Free RAM | 18 MB |
| Used RAM | 5.77 GB |
| Cached files | 2.22 GB |
| Swap Used | 42 MB |
Diagnostics Information (past 7 days):
2018-05-04 10:50:08 Last Shutdown Cause: 3 - Hard shutdown (once)
2018-05-03 17:59:21 Microsoft Word.app CPU (once)
End of report
Worked like a charm. Thanks!
pulsestart malware removal