Restoring My Mac: What I Learned

[jesse_the_k]

Thanks so much for all your good wishes, which calmed me down enough to do some net research. Best single resource is http://thesafemac.com

Many search results for "how to deal with Mac virus/malware/Trojans." Mostly step-by-step Terminal instructions, which make me nervous. I want to understand the big picture before I type Terminal commands, and the Safe Mac site provides this. (I took the leap of faith that the Safe Mac wasn't another social-engineering trick to gain control of my Mac (like the MacKeeper bullshit I was trying to eradicate).

I discovered ...

1. It wasn't really malware. MacKeeper does inject some Javascript that only permits their windows to display (and the Mac to yell at me to buy their software). OF NOTE: their software claims to have found a virus and you must use MacKeeper to fix the problem -- which they have caused. Some people claim MacKeeper is useful for that purpose; many more people say other, less printable, things.

2. Using Chrome and advice from The Safe Mac, I downloaded three free tools:
a. Easy Find from www.devon-technologies.com from Apple Store
EasyFind displays invisible files in its search results; turned out I didn't need this feature, but it's handy to have
b. ClamxAV virus checker from Apple Store
c. AdwareMedic adware deleter from The Safe Mac site

Then I made yet another bootable backup of my internal drive and ran ClamxAV and AdwareMedic on that latest backup until it was declared clean.

3.
a. Booted from Recovery partition of external drive (command R on boot)
b. Ran Disk Utility from external and formatted my internal drive
c. Ran "Install new OS" from external
d. Downloaded a fresh OS install, installed new Yosemite OS.
e. I'd planned on using Migration Assistant to restore data from my external drive, but surprisingly the OS install automagically copied that info from the external without asking.

3a took around 90 minutes (USB 3.0)
3c took around 120 minutes (on my 30 Mb/s broadband)

In all, with two hours' research it required 7 hours.

Here's hoping you never encounter adware. I am never downloading a file from a "helpful community service" site like MacUpdate, Download.com, CNET, or SourceForge again. If it's not on the Apple Store, or on the author's website (linked from a reputable source like Tidbits), I'm not getting it.
Old Goat Thoughts: I remember when I got all my software from the Info-Mac Archives. Which, it turns out, are still online
http://www.info-mac.org/viewforum.php?f=14
thanks to an enterprising person who's reusing the Info-Mac reputation for their products.

Comments

[branchandroot]

Thank goodness that worked out. And, yeah, I've been getting really leery of the repositories too. And, for that matter, any site that gives me any kind of "security update" message. Some of them are actually quite fiendish, and I've escaped at least one injection attack by the skin of my teeth and a sudden urge to examine raw headers on vague suspicion. It's a jungle out there.

[jesse_the_k]

Arooooo! Cheep. Cheep. Cheep.

This MacKeeper crap was actually using text to speech to harangue me, which totally overwhelmed my processing powers.

One more on my trustworthy list for Mac info is Macintouch.

[firecat]

Glad you wrested your computer back from those a-holes.

[davidgillon]

If it's stopping your computer from functioning normally, then it's absolutely malware!

[green_knight]

Seconded. Also, anything that injects code - rather than going through Apple's APIs - is malware in my book.


(So glad it's fixed. Saved the instructions, someone else might need them.)

[rhivolution]

Glad everything is okay.

[vass]

Congrats on fixing your Mac. And yeah, those 'helpful' sites. >:(