Cybersecurity, Removing macOS Spam Malware
There is a new piece of malware going around that infects Apple devices. It uses a small amount of your computer's processing power and internet connection to send out spam emails. It isn't known to hijack accounts or compromise your University mailbox, but it will usually lead to your device being banned from IllinoisNet.
Before you begin, run an antivirus scan from a program such as MalwareBytes to be sure there is not anything else malicious in your computer, and take a screenshot of a 'clean' result.
Then follow these steps to locate the newer virus, which is not yet reliably detected by MalwareBytes:
- Empty your Trash.
- Open a Finder window (blue/gray face icon).
- In the menu bar at the top of the screen, click Go and then choose Go to Folder to open a dialog box.
- Input ~/Library and then press Enter. Be sure to include the tilde and forward slash; simply typing Library may lead to the wrong folder. This will open a Finder window to a folder named Library in your home directory.
- In Library, navigate to the Application Support folder and locate and delete the following:
- A folder whose name is random characters, usually a long string of digits or letters that do not form a word, containing files named helper and pcyx.ver
- A folder whose name is the letters org. followed by another string of random characters in the same fashion, containing a file named app_assistant
Note that these files may be contained in a subfolder, and may not be named exactly as above.
- In Library, navigate to the LaunchAgents folder, and locate and delete a .plist file whose name is another string of random characters.
- Once these two folders and .plist file have been found and moved to Trash, take a screenshot of the Trash folder (so that Technology Services can see that you were successful) and then empty it again.
- Restart your computer, and check the Library folders described above to be sure the virus' files have not returned.
- Ask the Technology Services Help Desk or Security group to remove the block from your device, and show the screenshots of a clean antivirus scan and the Trash folder with the extra removed virus files.
If you have any questions, need any assistance with the above steps, or have successfully removed the virus and need your device to be unblocked from IllinoisNet, please contact the Help Desk by email at consult@illinois.edu or by phone at 217-244-7000.