RansomWhere app

Question

Level 1

13 points

RansomWhere app

I am running OsX 10.11.6 on an iMac 27" late 2015. I'm trying to uninstall the RansomWhere app but cannot find it on my computer. It does not appear in Applications, Utilities or Library. Spotlight and Finder turn up no results. It does, however, show up on Activity Monitor. To the best of my knowledge I have never installed this app and it does not show up on my App Store purchased list.

I went to the developers website (https://objective-see.com/products/ransomwhere.html) and copied the following code to run in Terminal:

//stop launch daemon
$ sudo launchctl unload /Library/LaunchDaemons/com.objective-see.ransomwhere.plist
//remove launch daemon, its plist, and supporting files
$ sudo rm -rf /Library/LaunchDaemons/com.objective-see.ransomwhere.plist
$ sudo rm -rf /Library/Objective-See/RansomWhere

When I pasted it into terminal I got the following:

//stop launch daemon

-bash: //stop: No such file or directory

j:~ Blu$ $ sudo launchctl unload /Library/LaunchDaemons/com.objective-see.ransomwhere.plist

-bash: $: command not found

j:~ Blu$

j:~ Blu$ //remove launch daemon, its plist, and supporting files

-bash: //remove: No such file or directory

j:~ Blu$ $ sudo rm -rf /Library/LaunchDaemons/com.objective-see.ransomwhere.plist

-bash: $: command not found

j:~ Blu$

j:~ Blu$ $ sudo rm -rf /Library/Objective-See/RansomWhere

-bash: $: command not found

j:~ Blu$

I don't know what to try next; any suggestions would be helpful and I appreciate your time and help.

iMac, OS X El Capitan (10.11.6)

Posted on Oct 7, 2018 7:29 AM

Reply

Answer 1

jblue2 Author

Level 1

13 points

Oct 7, 2018 12:33 PM in response to macjack

Here's the report--hope it helps!

EtreCheck version: 3.0.6 (315)

Report generated 2018-10-07 12:27:41

Download EtreCheck from https://etrecheck.com

Runtime 1:39

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Other problem

Description:

need to uninstall RansomeWhere app

Hardware Information: ⓘ

iMac (Retina 5K, 27-inch, Late 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

iMac - model: iMac17,1

1 3.2 GHz Intel Core i5 CPU: 4-core

16 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

Empty

BANK 0/DIMM1

8 GB DDR3 1867 MHz ok

BANK 1/DIMM0

Empty

BANK 1/DIMM1

8 GB DDR3 1867 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en1: 802.11 a/b/g/n/ac

Video Information: ⓘ

AMD Radeon R9 M380 - VRAM: 2048 MB

iMac 5120 x 2880

System Software: ⓘ

OS X El Capitan 10.11.6 (15G22010) - Time since boot: about 3 days

Disk Information: ⓘ

APPLE SSD SM0512G disk0 : (500.28 GB) (Solid State - TRIM: Yes)

EFI (disk0s1) <not mounted> : 210 MB

Macintosh HD (disk0s2) / [Startup]: 499.42 GB (234.38 GB free)

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

USB Information: ⓘ

Samsung Portable SSD T5 500.11 GB

EFI (disk1s1) <not mounted> : 210 MB

Samsung_T5 (disk1s2) /Volumes/Samsung_T5 : 499.76 GB (184.74 GB free)

Apple, Inc. Keyboard Hub

Logitech USB Receiver

Apple, Inc Apple Keyboard

Broadcom Corp. Bluetooth USB Host Controller

Apple Inc. FaceTime HD Camera (Built-in)

Silicon Labs CP2102 USB to UART Bridge Controller

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Configuration files: ⓘ

/etc/sudoers, File size 1242 but expected 2299

Gatekeeper: ⓘ

Mac App Store and identified developers

Unknown Files: ⓘ

/Library/LaunchAgents/com.malwarebytes.mbam.frontend.agent.plist

/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/FrontendAgent.app/Cont ents/MacOS/FrontendAgent

/Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist

/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app /Contents/MacOS/RTProtectionDaemon

/Library/LaunchDaemons/com.malwarebytes.mbam.settings.daemon.plist

/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/SettingsDaemon.app/Con tents/MacOS/SettingsDaemon

/Library/LaunchDaemons/com.monitoringclient.beacon.plist

/Library/MonitoringClient/RunBeacon

~/Library/LaunchAgents/com.dropbox.DropboxMacUpdate.agent.plist

~/Library/Dropbox/DropboxMacUpdate.app/Contents/MacOS/DropboxMacUpdate -check periodic

5 unknown files found. [Check files]

Kernel Extensions: ⓘ

/Library/Application Support/Malwarebytes/MBAM/Kext

[loaded] com.malwarebytes.mbam.rtprotection (3.4 - SDK 10.13 - 2018-09-22) [Support]

/System/Library/Extensions

[loaded] com.Logitech.Control Center.HID Driver (3.9.0 - SDK 10.6 - 2018-07-17) [Support]

[loaded] com.Logitech.Unifying.HID Driver (1.3.0 - SDK 10.6 - 2018-07-17) [Support]

[not loaded] com.MCCI.SLAB_USBtoUART (V1.02.2 - 2018-07-17) [Support]

[not loaded] com.Maxtor.driver.PowSecDriver (4.3.16 - 2018-07-17) [Support]

[not loaded] com.cy.iokit.Morpheus (1.4.0 - 2018-07-17) [Support]

[not loaded] com.fitbit.galileo.FitbitUSBCable (1.0 - SDK 10.11 - 2018-07-17) [Support]

[not loaded] com.maxtor.iokit.IOFireWireMxBt (4.2.6 - 2018-07-17) [Support]

[not loaded] com.novatelwireless.kext.wwan (v3.0.15 (004) - 2018-07-17) [Support]

[loaded] com.silabs.driver.CP210xVCPDriver64 (2.9.0d1 - 2018-07-17) [Support]

/System/Library/Extensions/NovatelWirelessWWAN.kext/Contents/Plugins

[not loaded] com.NovatelWireless.driver.NovatelWirelessUSBCDCECMControl (v3.0.15 (004) - 2010-06-09) [Support]

[not loaded] com.NovatelWireless.driver.NovatelWirelessUSBCDCECMData (v3.0.15 (004) - 2010-06-09) [Support]

[not loaded] com.novatelwireless.driver.3G (v3.0.15 (004) - 2010-06-09) [Support]

[not loaded] com.novatelwireless.driver.3GData (v3.0.15 (004) - 2010-06-09) [Support]

[not loaded] com.novatelwireless.driver.DisableAutoInstall (v3.0.15 (004) - 2010-06-09) [Support]

[not loaded] com.novatelwireless.driver.NWVBE (v3.0.15 (004) - 2010-06-09) [Support]

System Launch Agents: ⓘ

[not loaded] 7 Apple tasks

[loaded] 149 Apple tasks

[running] 85 Apple tasks

System Launch Daemons: ⓘ

[not loaded] 45 Apple tasks

[loaded] 150 Apple tasks

[running] 96 Apple tasks

Launch Agents: ⓘ

[running] com.Logitech.Control Center.Daemon.plist (2014-06-19) [Support]

[failed] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a 23d420d.plist (2018-02-16) [Support]

[not loaded] com.brother.LOGINserver.plist (2018-07-05) [Support]

[running] com.malwarebytes.mbam.frontend.agent.plist (2018-09-14) [Support]

[running] com.monitoringclient.cmhelperd.plist (2018-06-13) [Support]

[loaded] com.oracle.java.Java-Updater.plist (2016-09-17) [Support]

[running] com.teamviewer.teamviewer.plist (2018-08-17) [Support]

[running] com.teamviewer.teamviewer_desktop.plist (2018-08-17) [Support]

Launch Daemons: ⓘ

[running] com.adobe.ARMDC.Communicator.plist (2018-02-16) [Support]

[running] com.adobe.ARMDC.SMJobBlessHelper.plist (2018-02-16) [Support]

[loaded] com.adobe.fpsaud.plist (2018-08-27) [Support]

[not loaded] com.crashplan.engine.plist (2018-07-26) [Support]

[failed] com.fitbit.galileod.plist (2016-11-30) [Support]

[loaded] com.malwarebytes.HelperTool.plist (2017-02-02) [Support]

[running] com.malwarebytes.mbam.rtprotection.daemon.plist (2018-09-14) [Support]

[running] com.malwarebytes.mbam.settings.daemon.plist (2018-09-14) [Support]

[loaded] com.monitoringclient.beacon.plist (2018-06-13) [Support]

[loaded] com.monitoringclient.client.plist (2018-06-13) [Support]

[running] com.monitoringclient.diskjournald.plist (2018-06-13) [Support]

[loaded] com.monitoringclient.updater.plist (2018-06-13) [Support]

[running] com.objective-see.ransomwhere.plist (2017-04-20) [Support]

[loaded] com.oracle.java.Helper-Tool.plist (2016-09-17) [Support]

[loaded] com.teamviewer.Helper.plist (2018-08-07) [Support]

[running] com.teamviewer.teamviewer_service.plist (2018-08-17) [Support]

User Launch Agents: ⓘ

[failed] com.adobe.ARM.[...].plist (2010-02-18) [Support]

[loaded] com.adobe.ARM.[...].plist (2014-03-08) [Support]

[running] com.code42.menubar.plist (2018-06-12) [Support]

[loaded] com.dropbox.DropboxMacUpdate.agent.plist (2018-08-21) [Support]

User Login Items: ⓘ

Adobe InDesign CS6 Application (/Applications/Adobe InDesign CS6/Adobe InDesign CS6.app)

LWC2 Application (/Applications/Lightsoft Weather Center/LWC2.app)

MailButler Application (/Applications/MailButler.app)

Internet Plug-ins: ⓘ

Java Applet: 11.4.2 (2007-09-18)

Google Earth Web Plug-in: 7.1 (2015-09-28) [Support]

Default Browser: 601 - SDK 10.11 (2016-07-08)

AdobeExManDetect: AdobeExManDetect 1.1.0.0 - SDK 10.7 (2014-07-09) [Support]

Musicnotes: 1.17.3 (2009-06-26) [Support]

RealPlayer Plugin: Unknown

AdobePDFViewerNPAPI: 17.012.20098 - SDK 10.13 (2018-09-20) [Support]

FlashPlayer-10.6: 31.0.0.108 - SDK 10.12 (2018-09-11) [Support]

Silverlight: 5.1.50428.0 - SDK 10.6 (2016-08-29) [Support]

QuickTime Plugin: 7.7.3 (2018-07-17)

Flash Player: 31.0.0.108 - SDK 10.12 (2018-09-11) [Support]

iPhotoPhotocast: 7.0 - SDK 10.7 (2012-06-10)

AdobePDFViewer: 19.008.20071 - SDK 10.13 (2018-09-20) [Support]

CouponPrinter-FireFox_v2: 1.1.10 - SDK 10.6 (2013-11-16) [Support]

Scorch: 6.2.0 (2012-02-01) [Support]

JavaAppletPlugin: Java 8 Update 181 build 13 (2018-08-04) Check version

User internet Plug-ins: ⓘ

iGetterScriptablePlugin: 2.9.2 (2013-11-04) [Support]

Safari Extensions: ⓘ

ClickToFlash - Marc Hoyois - http://hoyois.github.com/safariextensions/clicktoplugin/ (2014-07-06)

Stylish - Vladimir Sobolev - https://fbapp.us (2017-12-05)

3rd Party Preference Panes: ⓘ

Akamai NetSession Preferences (2016-09-01) [Support]

Flash Player (2018-08-27) [Support]

Growl (2010-07-24) [Support]

Java (2018-08-04) [Support]

Logitech Control Center (2014-08-28) [Support]

MacServices Alerts (2018-09-26) [Support]

TimeMachineScheduler (2012-07-29) [Support]

Time Machine: ⓘ

Skip System Files: NO

Mobile backups: OFF

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 499.42 GB Disk used: 265.03 GB

Destinations:

Samsung_T5 [Local]

Total size: 499.76 GB

Total number of backups: 69

Oldest backup: 3/19/18, 3:46 PM

Last backup: 10/7/18, 12:00 PM

Size of backup disk: Too small

Backup size 499.76 GB < (Disk used 265.03 GB X 3)

Top Processes by CPU: ⓘ

19% BFG Lost Amulets: Mystic Land

5% WindowServer

4% kernel_task

2% fontd

1% plugin-container(5)

Top Processes by Memory: ⓘ

2.18 GB plugin-container(5)

1.22 GB kernel_task

1.15 GB firefox

1.01 GB icdd

426 MB CrashPlanService

Virtual Memory Information: ⓘ

227 MB Free RAM

16.00 GB Used RAM (5.04 GB Cached)

910 MB Swap Used

Diagnostics Information: ⓘ

Oct 7, 2018, 06:47:13 AM ~/Library/Logs/DiagnosticReports/SuperDuper!_2018-10-07-064713_[redacted].crash

com.blacey.SuperDuper! - /Applications/SuperDuper!.app/Contents/MacOS/SuperDuper!

Oct 7, 2018, 06:46:58 AM ~/Library/Logs/DiagnosticReports/SuperDuper!_2018-10-07-064658_[redacted].crash

Oct 7, 2018, 06:19:37 AM ~/Library/Logs/DiagnosticReports/AdobeReader_2018-10-07-061937_[redacted].crash

com.adobe.Reader - /Applications/Adobe Acrobat Reader DC.app/Contents/MacOS/AdobeReader

Reply

Answer 2

macjack

Level 10

111,242 points

Oct 7, 2018 9:07 AM in response to jblue2

Please download and run Etrecheck It is a diagnostic tool that's very useful to us in finding problems. It will provide a snapshot of your Mac. After it runs post the log file here. It will contain no personal information. It should locate the file and once you know where in your file system it is you can delete it.

Reply

Answer 3

macjack

Level 10

111,242 points

Oct 7, 2018 12:45 PM in response to jblue2

In your Launch Daemons (Macintosh HD/Library/LaunchDaemons:

[running] com.objective-see.ransomwhere.plist (2017-04-20) [Support]

Also, what is Watchman Monitoring and are you aware you are running that?

Reply

Answer 4

macjack

Level 10

111,242 points

Oct 7, 2018 7:32 AM in response to jblue2

Download and run Malwarebytes. Malwarebytes was developed by one of our own colleagues here in ASC and is about the most proven anti-malware software for Mac.

Reply

Answer 5

macjack

Level 10

111,242 points

Oct 7, 2018 12:56 PM in response to jblue2

You're welcome. Yes, trashing the LaunchDaemon should get rid of it.

Reply

Answer 6

jblue2 Author

Level 1

13 points

Oct 7, 2018 12:53 PM in response to macjack

Thanks for such a quick response.

Watchman Monitoring is my MacServices tech guy's app; he monitors for crashes, etc. I am aware that this is installed and have verified that it's not spyware from an untrusted source. Glad you caught it though!

So I presume if I trash the above noted LaunchDaemon that should do the trick? Excellent.

I'm glad to know about Etrecheck--thank you for that tip, and especially thank you for taking the time to help me.

Reply

Answer 7

jblue2 Author

Level 1

13 points

Oct 7, 2018 8:58 AM in response to macjack

Thanks for the speedy reply. I already have Malwarebytes installed and run it hourly (love this app!). It doesn't not recognize the RansomWhere app as a threat (i.e., it doesn't quarantine it).

Reply

RansomWhere app

Similar questions