Help Identify Malware Files from ~/Library/LaunchAgents

Per referenced entry linked below, I need help identifying which items are malware. About those " will damage your computer" … - Apple Community


Note that the reason I believe i have malware is because, safari will automatically open one to many pages/tabs. I finally discovered that if I go to system settings > security & privacy > privacy > automation and deselect the apps in there, then it will temporarily stop this activity. However, they get selected again somehow. Here is where I go to deselect them. For the sake of others finding this entry, those apps are wappo.app, innless.app, npb.


I have looked for the files in the applications folder with the intention of deleting them with no luck. So, I have finally found the document below to instruct me on how to get rid of this stuff. Thank you JG for sharing your knowledge freely.


Reference to: About those " will damage your computer" … - Apple Community


Also, I have purchased a new mbp, but have delayed transferring data to it because of this issue. I do not want to infect my newer mbp with these issues. If you have any advice to help me keep that from happening would be appreciated too.



Within ~/Library/LaunchAgents folder, I found files named the same as 3 of the .app files listed in the automation tab in the screen shot above. I moved those to the trash folder. I have not restarted my mbp yet. I will do a more recent backup before I restart.


Here are the screen shots of the 3 folders mentioned in the linked article above.


First, ~/Library/LaunchAgents folder. Note that I do not recognize anything in this list except the files referencing: adobe, cleanmymac, gotomeeting. Note that I have not used CMM in several years.



Second, /Library/LaunchAgents. Note that I no longer use the epson printer. I have used zoom lately. Not sure why adobe is in there from today.


The 3rd folder, /Library/LaunchDaemons.


Thank you for your help.



Earlier Mac models

Posted on Feb 19, 2025 6:49 PM

Reply

Similar questions

3 replies

Feb 20, 2025 7:12 AM in response to SaraJanie

Here are a couple of additional things to check:

  • Check the location of the ~/Library/LaunchAgents folder again to see if those 3 files that you had previously moved to the trash reappeared. If they are back or any new files, then start up in Safe Mode again and delete them.
  • Make sure you do not have any Extensions at Safari > Settings > Extensions. If you have any there, remove them.
  • Go to Safari > Settings > Search > Search Engine, and make sure it shows one of the normal search engines, such as Google.
  • Do the free scan using MalwareBytes. Click Free Download on the upper right corner of the link below and download MalwareBytes. When you install, it will ask if you want a subscription and you do not want one, so just click the "Later" or "Not Now" option, I can't remember exactly what it says. In any case, you do not need to pay for the free scan or add any payment information and it will remove most Malware.

https://www.malwarebytes.com

Feb 19, 2025 10:40 PM in response to Mac Jim ID

Thanks for the quick response.


I removed the files in safe mode & restarted. I will report back if the same issue occurs in the near future.


I did notice that same .app files appear in the automation tab as shown in my original post … I was hoping to get rid of those… it makes think there still in there somewhere.


My mbp wont allow a later iOS and the CMM app says it needs a later iOS version to operate, so its asking me download a new version … which I really don't want to do.


No issues with safari so far though. I will give it a few days to confirm. Thanks again.

Feb 19, 2025 7:14 PM in response to SaraJanie

Yes you have a lot of junk there. While I don't list CleanMyMac files to be deleted here, I strongly recommend you use their provided uninstaller to remove it. Then follow up in those same folder to make sure all macpaw files have been removed.


First, start up in Safe Mode.

Start up your Mac in safe mode - Apple Support


In the first screenshot, there is a lot, delete everything except the files that contain:

  • adobe
  • logmein
  • citrixonline
  • macpaw

In the second screenshot, everything is fine as far as Malware.

In the last screenshot, delete the one file called com.ryderd.plist.


Restart again and the reported issue should be gone. Don't forget to uninstall CleanMyMac, it is junk!

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Help Identify Malware Files from ~/Library/LaunchAgents

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.