[the_deha]

Witam. 

Wydaje mi się, ze mam problem z jakimś złośliwym oprogramowaniem. Kiedy otwieram safari, mam kilka swoich kart nagle zwyczajnie się zamyka, w Docku wyskakuje kolejna ikonka Safari i dziwne rozszerzenia typu „Skilled Search”. Próbowałem odinstalować te rozszerzenia, ręcznie usunąć w Finderze ale na nic. Po kolejnym uruchomieniu komputera jest to samo rozszerzenie tylko o lekko zmienionej, tak samo kiczowatej nazwie.

 

Screen: https://imgur.com/a/1krYXDf

Edited by the_deha, 23 July 2020 - 13:11.

[cronopioverde]

Zechcesz puścić EtreChecka?

[the_deha]

EtreCheck version: 5.5.5 (5111)
Report generated: 2020-07-23 16:11:56
Download EtreCheck from https://etrecheck.com
Runtime: 1:59
Performance: Excellent
Sandbox: Enabled
Full drive access: Disabled

Problem: No problem - just checking

Major Issues:
  Anything that appears on this list needs immediate attention. 
  No Time Machine backup - Time Machine backup not found.
  Adware - Adware detected.
  Unsigned files - There are unsigned software files installed that could be adware and should be reviewed.

Minor Issues:
  These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. 
  Configuration profiles present - This machine has configuration profiles. These are sometimes used by adware and malware.
  Clean up - There are orphan files that could be removed.
  Unsigned files - There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system.
  32-bit Apps - This machine has 32-bits apps will not work on macOS 10.15 "Catalina".
  Limited drive access - More information may be available with Full Drive Access.
  Kernel extensions present - This machine has kernel extensions that may not work in the future.

Hardware Information:
  MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)
  MacBook Pro Model: MacBookPro15,4
  1,4 GHz Quad-Core Intel Core i5 (i5-8257U) CPU: 4-core
  8 RAM - Not upgradeable
    BANK 0/ChannelA-DIMM0 - 4 GB LPDDR3 2133  
    BANK 2/ChannelB-DIMM0 - 4 GB LPDDR3 2133  
  Battery: Health = Normal - Cycle count = 38

Video Information:
  Intel Iris Plus Graphics 645 - VRAM: 1536 MB
    Color LCD (built-in) 2880 x 1800

Drives:
  disk0 - APPLE SSD AP0128N 121.33 GB (Solid State - TRIM: Yes) 
  Internal PCI-Express 8.0 GT/s x4 NVM Express
    disk0s1 - EFI [EFI] 315 MB
    disk0s2 [APFS Container] 121.02 GB
      disk1 [APFS Virtual drive] 121.02 GB (Shared by 5 volumes)
        disk1s1 - M*****************e (APFS) [APFS Virtual drive] (Shared - 71.16 GB used)
        disk1s2 - Preboot (APFS) [APFS Preboot] (Shared)
        disk1s3 - Recovery (APFS) [Recovery] (Shared)
        disk1s4 - VM (APFS) [APFS VM] (Shared - 3.22 GB used)
        disk1s5 - Macintosh HD (APFS) (Shared - 11.13 GB used)

Mounted Volumes:
  disk1s1 - M*****************e [APFS Virtual drive]
    121.02 GB (Shared - 71.16 GB used, 37.82 GB available, 34.76 GB free)
    APFS
    Mount point: /System/Volumes/Data
    Encrypted

  disk1s4 - VM [APFS VM]
    121.02 GB (Shared - 3.22 GB used, 34.76 GB free)
    APFS
    Mount point: /private/var/vm
    Encrypted

  disk1s5 - Macintosh HD
    121.02 GB (Shared - 11.13 GB used, 37.82 GB available, 34.76 GB free)
    APFS
    Mount point: /
    Encrypted
    Read-only: Yes

Network:
  Interface en0: Wi-Fi
    802.11 a/b/g/n/ac
  Interface en4: Bluetooth PAN
  Interface bridge0: Thunderbolt Bridge

System Software:
  macOS Catalina 10.15.4 (19E266) 
  Time since boot: About 2 days

Configuration Profiles:
  This computer has configuration profiles installed.

Notifications:
  Notifications not available without Full Drive Access.

Security:
  System Status
  Gatekeeper: Enabled
  System Integrity Protection: Enabled

  Antivirus software: Apple

Adware:
  Launchd: /Library/LaunchDaemons/com.UltraSearchSystemDaemon.plist
    Executable: /Library/Application Support/com.UltraSearchSystemDaemon/UltraSearchSystem r
    Reason: Adware pattern match
  Launchd: ~/Library/LaunchAgents/com.UltraSearchSystem.plist
    Executable: ~/Library/Application Support/com.UltraSearchSystem/UltraSearchSystem r
    Reason: Adware pattern match

Unsigned Files:
  Launchd: ~/Library/LaunchAgents/com.google.keystone.agent.plist
    Executable: ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
    Details: Exact match found in the whitelist - probably OK

  Launchd: ~/Library/LaunchAgents/TapufindOd.plist
    Executable: /Users/***/App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004/Tapufind.app/Contents/MacOS/Tapufind DistributerName ChannelId DeviceId Country BarcodeId Domain Date
    Details: Domain name invalid - possibly adware

  Launchd: ~/Library/LaunchAgents/com.epicgames.launcher.plist
    Executable: /Applications/Epic Games Launcher.app --args -silent

  Launchd: ~/Library/LaunchAgents/com.google.keystone.xpcservice.plist
    Executable: ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost
    Details: Exact match found in the whitelist - probably OK

  Launchd: ~/Library/LaunchAgents/com.6050949257051537303.10372982976.plist
    Executable: ~/Library/Application Support/com.4776192613794494886/9438437800791496798 B93FB926-795F-4174-BAD8-469ACFB0D2DB 84E1EB54-FE56-437C-84F8-4117F7F9FCD3
    Details: Domain name invalid - possibly adware

  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware

  Apps: 2

32-bit Applications:
  11 32-bit apps

Kernel Extensions:
  /Library/Extensions
    Pen Tablet.kext (Pen Tablet 5.3.7-6 - SDK 10.12)

System Launch Agents:
  [Not Loaded]  16 Apple tasks
  [Loaded]  208 Apple tasks
  [Running]  88 Apple tasks
  [Other]  One Apple task

System Launch Daemons:
  [Not Loaded]  35 Apple tasks
  [Loaded]  211 Apple tasks
  [Running]  90 Apple tasks
  [Other]  One Apple task

Launch Agents:
  [Loaded] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2020-06-28)
  [Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2020-07-12)
  [Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2020-07-12)
  [Running] com.wacom.pentablet.plist (Wacom Technology Corp. - installed 2016-10-11)

Launch Daemons:
  [Other] com.UltraSearchSystemDaemon.plist (Adware - installed 2020-06-28)
  [Loaded] com.adobe.acc.installer.v2.plist (Adobe Systems, Inc. - installed 2020-03-24)
  [Loaded] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2020-07-12)
  [Loaded] com.adobe.fpsaud.plist (Adobe Inc. - installed 2020-06-23)
  [Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2020-01-23)

User Launch Agents:
  [Other] TapufindOd.plist (? 0  - installed 2020-06-28)
  [Other] com.6050949257051537303.10372982976.plist (? 0  - installed 2020-07-21)
  [Loaded] com.UltraSearchSystem.plist (Adware - installed 2020-06-28)
  [Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2020-03-24)
  [Loaded] com.adobe.ccxprocess.plist (Apple - installed 2020-03-24)
  [Other] com.epicgames.launcher.plist (? 0  - installed 2020-03-27)
  [Loaded] com.google.keystone.agent.plist (? 0  - installed 2020-04-08)
  [Loaded] com.google.keystone.xpcservice.plist (? 0  - installed 2020-04-08)

User Login Items:
  [Not Loaded] Messenger Login Helper (App Store - installed 2020-04-08)
    Modern Login Item
    /Applications/Messenger.app/Contents/Library/LoginItems/Messenger Login Helper.app

  [Loaded] StartUpHelper (Spotify - installed 2020-07-21)
    Modern Login Item
    /Applications/Spotify.app/Contents/Library/LoginItems/StartUpHelper.app

Internet Plug-ins:
  FlashPlayer-10.6: 32.0.0.403 (Adobe Inc. - installed 2020-07-16)
  Flash Player: 32.0.0.403 (Adobe Inc. - installed 2020-07-16)
  WacomTabletPlugin: WacomTabletPlugin 2.1.0.6 (Wacom Technology Corp. - installed 2016-10-11)
  AdobeAAMDetect: 3.0.0.0 (Adobe Systems, Inc. - installed 2020-06-28)

User Internet Plug-ins:
  User Internet Plug-ins need Full Drive Access

User Audio Plug-ins:
  User Audio Plug-ins need Full Drive Access

User iTunes Plug-ins:
  User iTunes Plug-ins need Full Drive Access

3rd Party Preference Panes:
  Flash Player (Adobe Inc. - installed 2020-06-23)
  PenTablet (Wacom Technology Corp. - installed 2020-06-30)

Time Machine:
  Time Machine Not Configured!

Performance:
  System Load: 4.61 (1 min ago) 2.72 (5 min ago) 2.06 (15 min ago)
  Nominal I/O speed: 0.29 MB/s
  File system: 21.26 seconds
  Write speed: 352 MB/s
  Read speed: 1222 MB/s

CPU Usage Snapshot:
  Type Overall
  System: 2 %
  User: 6 %
  Idle: 92 %

Top Processes Snapshot by CPU:
  Process (count) CPU (Source - Location)
  Other processes 47.54 % (?)
  EtreCheck 15.55 % (App Store)
  Safari 1.32 % (Apple)
  Spotify 0.43 % (Spotify)
  sharingd 0.07 % (Apple)

Top Processes Snapshot by Memory:
  Process (count) RAM usage (Source - Location)
  EtreCheck 212 MB (App Store)
  Adobe Photoshop CC 2019 108 MB (Adobe Systems, Inc.)
  Safari 86 MB (Apple)
  Finder 64 MB (Apple)
  Spotify 48 MB (Spotify)

Top Processes Snapshot by Network Use:
  Process (count) Input / Output (Source - Location)
  Other processes 2 MB / 1 MB (?)
  com.apple.WebKit.Networking.xpc 1 MB / 128 KB (Apple)
  Spotify 512 KB / 80 KB (Spotify)
  SystemUIServer 0 B / 1 KB (Apple)
  PowerChime 317 B / 586 B (Apple)

Virtual Memory Information:
  Physical RAM: 8 GB

  Free RAM: 25 MB
  Used RAM: 6.86 GB
  Cached files: 1.11 GB

  Available RAM: 1.14 GB
  Swap Used: 864 MB

Software Installs (past 30 days):
  Install Date Name (Version)
  2020-06-27 MRTConfigData (1.63)
  2020-06-28 Bitdefender Virus Scanner (3.15)
  2020-06-30 Wacom
  2020-07-11 Command Line Tools for Xcode (11.5)
  2020-07-16 Adobe Flash Player
  2020-07-16 XProtectPlistConfigData (2126)
  2020-07-23 EtreCheck (5.5.5)

Clean up:
  ~/Library/LaunchAgents/TapufindOd.plist
    /Users/***/App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004/Tapufind.app/Contents/MacOS/Tapufind
    Executable not found
  ~/Library/LaunchAgents/com.epicgames.launcher.plist
    /Applications/Epic Games Launcher.app
    Executable not found

Diagnostics Information (past 7-30 days):
  Directory /Library/Logs/DiagnosticReports is not accessible.
  Enable Full Drive Access to see more information.

End of report

Czy o to chodziło?

Zrobiłem szybkie skanowanie przy użyciu Clean My Mac i chyba znalazłem. Darmowa wersja nie usunie jednak tego oprogramowania. 

Czy wystarczy, że usunę ten folder w Finderze? 

 

[cronopioverde]

Czy o to chodziło?

 

Prawie. Wersja z Mac App Store to kastrat i nie pokaże wszystkiego, co w tym przypadku może być przydatne. Pobierz, proszę, najnowszą ze strony dewelopera i uruchom raz jeszcze. Wtedy pokaż nam wyniki. Dodatkowo poproszę o wynik komendy wpisanej w Terminal:

sudo launchctl list | grep -i -e 'search'; ls -ln /Library/Application\ Support/ /Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/PrivilegedHelperTools/ /Library/PreferencePanes/ /tmp/

Będzie potrzeba podania hasła admina ("po omacku", bo nie będzie widać znaków wpisywanych).

 

Czy wystarczy, że usunę ten folder w Finderze? 

 

 

Nie.

[the_deha]

Prawie. Wersja z Mac App Store to kastrat i nie pokaże wszystkiego, co w tym przypadku może być przydatne. Pobierz, proszę, najnowszą ze strony dewelopera i uruchom raz jeszcze. Wtedy pokaż nam wyniki. 

 

Strona przekierowuje do App Store, do pobranej wcześniej wersji.

Co do komendy z Terminala wygląda to następująco:

Last login: Tue Jul 21 11:12:40 on console

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
MacBook-Pro-Dominik-2:~ dominikhrycaj$ sudo launchctl list | grep -i -e 'search'; ls -ln /Library/Application\ Support/ /Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/PrivilegedHelperTools/ /Library/PreferencePanes/ /tmp/
Password:
-	78	com.UltraSearchSystemDaemon
228	0	com.apple.icloud.searchpartyd
/Library/Application Support/:
total 0
drwxr-xr-x  32 0  0   1024 28 cze 22:15 Adobe
drwxr-xr-x   3 0  80    96 24 mar 20:14 App Store
drwxr-xr-x  11 0  0    352 24 mar 20:14 Apple
drwx------   5 0  80   160 23 mar 13:51 ApplePushService
drwxrwxrwx   4 0  80   128 22 cze 19:22 Canon_Inc_IC
drwxrwxr-x   8 0  80   256 16 lip 00:36 CrashReporter
drwxrwxr-x   6 0  80   192 23 sie  2019 GarageBand
drwxrwxr-x   7 0  80   224  8 cze  2017 Logic
drwxr-xr-x   3 0  80    96 16 lip 01:31 Macromedia
drwxr-xr-x   3 0  0     96 14 gru  2019 Mica
drwxrwxr-t   2 0  80    64 13 gru  2019 ProApps
drwxr-xr-x   3 0  0     96 14 gru  2019 Script Editor
drwxr-xr-x   3 0  0     96 11 paź  2016 Tablet
drwxr-xr-x@  4 0  0    128 23 lip 16:37 com.apple.TCC
drwxrwx---   6 0  20   192 18 lip 13:36 com.apple.icloud.searchpartyd
drwxr-xr-x   3 0  0     96 14 gru  2019 iLifeMediaBrowser
drwxrwxrwx   2 0  80    64 23 mar 23:44 regid.1986-12.com.adobe

/Library/LaunchAgents/:
total 32
-rw-r--r--  1 0  0  661 28 cze 22:14 com.adobe.AdobeCreativeCloud.plist
-rw-r--r--  1 0  0  588 24 mar 00:51 com.adobe.GC.AGM.plist
-rw-r--r--  1 0  0  612 24 mar 00:51 com.adobe.GC.Invoker-1.0.plist
-rwxr-xr-x  1 0  0  739 11 paź  2016 com.wacom.pentablet.plist

/Library/LaunchDaemons/:
total 40
-rw-r--r--  1 0  0  512 28 cze 17:23 com.UltraSearchSystemDaemon.plist
-rw-r--r--  1 0  0  564 24 mar 00:40 com.adobe.acc.installer.v2.plist
-rwxr-xr-x  1 0  0  642 12 lip 08:53 com.adobe.agsservice.plist
-rw-r--r--  1 0  0  462 23 cze 20:38 com.adobe.fpsaud.plist
-rw-r--r--  1 0  0  632 23 sty  2020 com.apple.installer.osmessagetracing.plist

/Library/PreferencePanes/:
total 0
drwxr-xr-x  3 0  0  96 23 cze 20:52 Flash Player.prefPane
drwxr-xr-x  3 0  0  96 30 cze 18:19 PenTablet.prefpane

/Library/PrivilegedHelperTools/:
total 528
-r-xr--r--  1 0  0  268528 24 mar 00:40 com.adobe.acc.installer.v2
drwxr-xr-x  3 0  0      96 30 cze 18:20 com.wacom.TabletHelper.app

/tmp/:
total 112
drwxr-xr-x  3 501  0     96 23 lip 11:30 4C92AC46-A8C7-45FF-8273-467883742944
drwxr-xr-x  3 501  0     96 23 lip 11:30 4D1A6CB8-FF79-4F4C-ABF0-A870FA1F7C8F
drwxr-xr-x  3 501  0     96 23 lip 11:30 5F4B156F-F6AC-4FB0-A3A5-F28D7D6B8B35
drwxr-xr-x  3 501  0     96 23 lip 11:30 66D0B596-C7F0-4C97-A7C4-6370CE79FF13
drwxr-xr-x  3 501  0     96 22 lip 23:57 98CC23F6-6336-4C99-9989-139B2A996EDB
drwxr-xr-x  3 501  0     96 23 lip 11:31 A12DB804-BC45-4A05-BCBC-E6C1CFF1BA1A
drwxr-xr-x  3 501  0     96 23 lip 11:30 AB366EE6-81C9-4D49-86C7-D11E4A305A55
-rw-r--r--  1 0    0      0 21 lip 11:12 AlTest1.err
-rw-r--r--  1 0    0      0 21 lip 11:12 AlTest1.out
drwxr-xr-x  3 501  0     96 23 lip 11:31 D1D310AC-31FF-4EC9-BC6B-E3B71F203BBD
-rw-rw-rw-  1 501  0      0 21 lip 11:12 EOS_Apps
-rw-r--r--  1 501  0      0 21 lip 11:12 ExmanProcessMutex
-rw-rw-rw-  1 501  0  53362 24 lip 06:48 adobegc.log
srwx------  1 501  0      0 21 lip 11:12 com.adobe.AdobeIPCBroker.ctrl-dominikhrycaj
drwx------  3 501  0     96 21 lip 11:12 com.apple.launchd.IvH5QxXZ3p
drwxr-xr-x  2 501  0     64 23 lip 01:45 lilo.1739
drwxr-xr-x  2 0    0     64 21 lip 11:12 powerlog
MacBook-Pro-Dominik-2:~ deha$ 

Edited by the_deha, 24 July 2020 - 05:58.

[cronopioverde]

Strona przekierowuje do App Store, do pobranej wcześniej wersji.

 

 
Bardzo dziwne, bo powinna pokazać dwie wersje do wyboru – tę z MAS właśnie oraz bezpośrednio od twórcy. Proszę, bezpośredni link do pobrania najnowszej wersji ‘reżyserskiej’: http://cdn-gc.etrech...treCheckPro.zip  Tylko usuń wcześniej tę z App store’a.

Skoro to Catalina, nie zapomnij nadać aplikacji pełnego dostępu do dysku, którego na załączonym wcześniej raporcie nie miała. Bez tego nie będzie można poznać wszystkich potrzebnych informacji. 

 

Druga opcja: pobrać MalwareBytes; trialowa wersja chyba też powinna automatycznie usuwać adware’y (o ile coś się ostatnio w ich polityce nie zmieniło). Będzie prościej dla osoby, która nie ma wiedzy lub ochoty, by usuwać wszystkie elementy ręcznie. Potem możesz się MB pozbyć. W sumie wspomnianego CMM też – są jego zwolennicy, ale imho nie robi nic, czego nie można by zrobić bez niego, a jakieś bajty zajmuje nie wiadomo, po co. Prywatna opinia; jak Ci pasuje, to ok, krzywdy – póki co – nie robi.

 

Powodzenia.

[the_deha]

Masz racje, wcześniej nie zaznaczyłem pełnego dostępu. 

 

Raport

EtreCheckPro version: 6.2.6 (6C020)
Report generated: 2020-07-28 07:10:20
Download EtreCheckPro from https://etrecheck.com
Runtime: 2:19
Performance: Excellent

Problem: No problem - just checking

Major Issues:
  Anything that appears on this list needs immediate attention. 
  No Time Machine backup - Time Machine backup not found.
  Adware - Adware detected.
  Unsigned files - There are unsigned software files installed that could be adware and should be reviewed.

Minor Issues:
  These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. 
  Apps crashing - There have been numerous app crashes.
  Unsigned files - There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system.
  32-bit Apps - This machine has 32-bits apps will not work on macOS 10.15 "Catalina".
  Kernel extensions present - This machine has kernel extensions that may not work in the future.

Hardware Information:
  MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)
  MacBook Pro Model: MacBookPro15,4
  1,4 GHz Quad-Core Intel Core i5 (i5-8257U) CPU: 4-core
  8 RAM - Not upgradeable
    BANK 0/ChannelA-DIMM0 - 4 GB LPDDR3 2133  
    BANK 2/ChannelB-DIMM0 - 4 GB LPDDR3 2133  
  Battery: Health = Normal - Cycle count = 39

Video Information:
  Intel Iris Plus Graphics 645 - VRAM: 1536 MB
    Color LCD (built-in) 2880 x 1800

Drives:
  disk0 - APPLE SSD AP0128N 121.33 GB (Solid State - TRIM: Yes) 
  Internal PCI-Express 8.0 GT/s x4 NVM Express
    disk0s1 - EFI [EFI] 315 MB
    disk0s2 [APFS Container] 121.02 GB
      disk1 [APFS Virtual drive] 121.02 GB (Shared by 5 volumes)
        disk1s1 - M*****************e (APFS) [APFS Virtual drive] (Shared - 66.07 GB used)
        disk1s2 - Preboot (APFS) [APFS Preboot] (Shared - 92 MB used)
        disk1s3 - Recovery (APFS) [Recovery] (Shared - 528 MB used)
        disk1s4 - VM (APFS) [APFS VM] (Shared - 5.37 GB used)
        disk1s5 - Macintosh HD (APFS) (Shared - 11.13 GB used)

Mounted Volumes:
  disk1s1 - M*****************e [APFS Virtual drive]
    121.02 GB (Shared - 66.07 GB used, 40.79 GB available, 37.71 GB free)
    APFS
    Mount point: /System/Volumes/Data
    Encrypted

  disk1s3 - Recovery [Recovery]
    121.02 GB (Shared - 528 MB used, 37.71 GB free)
    APFS
    Mount point: /Volumes/Recovery

  disk1s4 - VM [APFS VM]
    121.02 GB (Shared - 5.37 GB used, 37.71 GB free)
    APFS
    Mount point: /private/var/vm
    Encrypted

  disk1s5 - Macintosh HD
    121.02 GB (Shared - 11.13 GB used, 40.79 GB available, 37.71 GB free)
    APFS
    Mount point: /
    Encrypted
    Read-only: Yes

Network:
  Interface en0: Wi-Fi
    802.11 a/b/g/n/ac
  Interface en4: Bluetooth PAN
  Interface bridge0: Thunderbolt Bridge
  iCloud Quota: 53 MB available
  iCloud Status: one pending file

System Software:
  macOS Catalina 10.15.4 (19E266) 
  Time since boot: About 7 days

Security:
  System Status
  Gatekeeper: App Store and identified developers
  System Integrity Protection: Enabled

  Antivirus software: Apple

Adware:
  Launchd: /Library/LaunchDaemons/com.UltraSearchSystemDaemon.plist
    Executable: /Library/Application Support/com.UltraSearchSystemDaemon/UltraSearchSystem r
    Reason: Adware pattern match

Unsigned Files:
  Launchd: ~/Library/LaunchAgents/com.google.keystone.agent.plist
    Executable: 
    Details: Exact match found in the whitelist - probably OK

  Launchd: ~/Library/LaunchAgents/com.6050949257051537303.10372982976.plist
    Executable: 
    Details: Domain name invalid - possibly adware

  Launchd: ~/Library/LaunchAgents/com.epicgames.launcher.plist
    Executable: 

  Launchd: /Library/LaunchDaemons/com.adobe.acc.installer.v2.plist
    Executable: /Library/PrivilegedHelperTools/com.adobe.acc.installer.v2

  Launchd: ~/Library/LaunchAgents/com.adobe.ccxprocess.plist
    Executable: 

  Launchd: ~/Library/LaunchAgents/com.UltraSearchSystem.plist
    Executable: 
    Details: Domain name invalid - possibly adware

  Launchd: /Library/LaunchDaemons/com.adobe.fpsaud.plist
    Executable: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud
    Details: Exact match found in the whitelist - probably OK

  Launchd: ~/Library/LaunchAgents/TapufindOd.plist
    Executable: 
    Details: Domain name invalid - possibly adware

  Launchd: ~/Library/LaunchAgents/com.google.keystone.xpcservice.plist
    Executable: 
    Details: Exact match found in the whitelist - probably OK

  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /Applications/CleanMyMac-MAS.app/Contents/MacOS/CleanMyMac-MAS
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /Applications/Epic Games Launcher.app --args -silent
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /Users/***/App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004/Tapufind.app/Contents/MacOS/Tapufind DistributerName ChannelId DeviceId Country BarcodeId Domain Date
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: S8EX82NJP6.com.macpaw.CleanMyMac-mas.HealthMonitor
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /Library/Application Support/Tablet/PenTabletDriver.app/Contents/Resources/ConsumerTouchDriver.app/Contents/MacOS/ConsumerTouchDriver -psn_0_766139
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: /private/tmp/Safari.app/Contents/MacOS/Safari
    Details: Executable file is hidden - possibly adware
  Running app: ~/Library/Application Support/com.4776192613794494886/9438437800791496798 B93FB926-795F-4174-BAD8-469ACFB0D2DB 84E1EB54-FE56-437C-84F8-4117F7F9FCD3
  Running app: ~/Library/Application Support/com.UltraSearchSystem/UltraSearchSystem r

  Apps: 3

32-bit Applications:
  11 32-bit apps

Kernel Extensions:
  /Library/Extensions
    [Not Loaded] Pen Tablet.kext (Pen Tablet 5.3.7-6 - SDK 10.12)

System Launch Agents:
  [Not Loaded]  16 Apple tasks
  [Loaded]  158 Apple tasks
  [Running]  138 Apple tasks
  [Other]  One Apple task

System Launch Daemons:
  [Not Loaded]  35 Apple tasks
  [Loaded]  177 Apple tasks
  [Running]  124 Apple tasks
  [Other]  One Apple task

Launch Agents:
  [Loaded] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2020-06-28)
  [Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2020-07-12)
  [Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2020-07-12)
  [Running] com.wacom.pentablet.plist (Wacom Technology Corp. - installed 2016-10-11)

Launch Daemons:
  [Other] com.UltraSearchSystemDaemon.plist (Adware - installed 2020-06-28)
  [Loaded] com.adobe.acc.installer.v2.plist (? 7ccff5f5  - installed 2020-03-24)
  [Loaded] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2020-07-12)
  [Loaded] com.adobe.fpsaud.plist (? 2afb3af7  - installed 2020-06-23)
  [Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2020-01-23)

User Launch Agents:
  [Not Loaded] TapufindOd.plist (? 0  - installed )
  [Not Loaded] com.6050949257051537303.10372982976.plist (? 0  - installed )
  [Not Loaded] com.UltraSearchSystem.plist (? 0  - installed )
  [Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2020-07-25)
  [Not Loaded] com.adobe.ccxprocess.plist (? 0  - installed )
  [Not Loaded] com.epicgames.launcher.plist (? 0  - installed )
  [Not Loaded] com.google.keystone.agent.plist (? 0  - installed )
  [Not Loaded] com.google.keystone.xpcservice.plist (? 0  - installed )

User Login Items:
  [Loaded] EOS Utility (Canon Inc. - installed 2020-01-20)
    Application
    /Applications/Canon Utilities/EOS Utility/EOS Utility.app

  [Not Loaded] Messenger Login Helper (App Store - installed 2020-04-08)
    Modern Login Item
    /Applications/Messenger.app/Contents/Library/LoginItems/Messenger Login Helper.app

  [Loaded] StartUpHelper (Spotify - installed 2020-07-21)
    Modern Login Item
    /Applications/Spotify.app/Contents/Library/LoginItems/StartUpHelper.app

Internet Plug-ins:
  FlashPlayer-10.6: 32.0.0.403 (Adobe Inc. - installed 2020-07-16)
  Flash Player: 32.0.0.403 (Adobe Inc. - installed 2020-07-16)
  WacomTabletPlugin: WacomTabletPlugin 2.1.0.6 (Wacom Technology Corp. - installed 2016-10-11)
  AdobeAAMDetect: 3.0.0.0 (Adobe Systems, Inc. - installed 2020-06-28)

3rd Party Preference Panes:
  Flash Player (Adobe Inc. - installed 2020-06-23)
  PenTablet (Wacom Technology Corp. - installed 2020-06-30)

Time Machine:
  Time Machine Not Configured!

Performance:
  System Load: 2.32 (1 min ago) 1.93 (5 min ago) 1.65 (15 min ago)
  Nominal I/O speed: 0.30 MB/s
  File system: 13.66 seconds
  Write speed: 387 MB/s
  Read speed: 1335 MB/s

CPU Usage Snapshot:
  Type Overall
  System: 2 %
  User: 5 %
  Idle: 93 %

Top Processes Snapshot by CPU:
  Process (count) CPU (Source - Location)
  mdworker (2) 36.00 % (Apple)
  EtreCheckPro 14.34 % (Etresoft, Inc.)
  WindowServer 12.90 % (Apple)
  syncdefaultsd 8.68 % (Apple)
  coreaudiod 8.58 % (Apple)

Top Processes Snapshot by Memory:
  Process (count) RAM usage (Source - Location)
  com.apple.WebKit.WebContent (4) 710 MB (Apple)
  EtreCheckPro 509 MB (Etresoft, Inc.)
  Adobe Photoshop CC 2019 453 MB (Adobe Systems, Inc.)
  kernel_task 313 MB (Apple)
  Spotify Helper (Renderer) 141 MB (Spotify)

Top Processes Snapshot by Network Use:
  Process (count) Input / Output (Source - Location)
  mDNSResponder 3 MB / 2 MB (Apple)
  Spotify 602 KB / 261 KB (Spotify)
  biometrickitd 665 KB / 140 KB (Apple)
  UserEventAgent 271 KB / 377 KB (Apple)
  apsd 124 KB / 44 KB (Apple)

Top Processes Snapshot by Energy Use:
  Process (count) Energy (0-100) (Source - Location)
  WindowServer 6 (Apple)
  coreaudiod 5 (Apple)
  Spotify 2 (Spotify)
  com.apple.WebKit.WebContent (4) 1 (Apple)
  PerfPowerServices 0 (Apple)

Virtual Memory Information:
  Physical RAM: 8 GB

  Free RAM: 265 MB
  Used RAM: 6.81 GB
  Cached files: 950 MB

  Available RAM: 1.19 GB
  Swap Used: 2.70 GB

Software Installs (past 30 days):
  Install Date Name (Version)
  2020-06-28 Bitdefender Virus Scanner (3.15)
  2020-06-30 Wacom (0)
  2020-07-11 Command Line Tools for Xcode (11.5)
  2020-07-16 Adobe Flash Player (32.0.0.403)
  2020-07-23 EtreCheck (5.5.5)
  2020-07-23 CleanMyMac X (4.6.9)
  2020-07-25 MRTConfigData (1.64)
  2020-07-25 XProtectPlistConfigData (2127)

Diagnostics Information (past 7-30 days):
  2020-07-25 17:31:48 Adobe Photoshop CC 2019.app High CPU Use
    Executable: /Applications/Adobe Photoshop CC 2019/Adobe Photoshop CC 2019.app

  2020-07-23 16:35:35 Instalacja.app Crash (2 times)
    Executable: /private/var/folders/*/Instalacja.app

  2020-07-23 12:18:09 syspolicyd High CPU Use
    Executable: /usr/libexec/syspolicyd

  2020-07-23 11:26:32 com.apple.WebKit.WebContent High CPU Use
    Executable: /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent

  2020-07-21 11:25:11 PenTabletDriver.app Crash (20 times)
    Executable: /Library/Application Support/Tablet/PenTabletDriver.app
    Details:
      objc_msgSend() selector name: length

  2020-07-21 11:12:55 Creative Cloud.app Crash
    Executable: /Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app


End of report

Tak jeszcze dodając. Główny problem to duplikujące się fejkowe Safari a przy tym od czasu do czasu wyskakuje okienko z komunikatem żądania dostępu. Z tego co pamiętam to brzmi jakoś ''Apple prosi o dostęp..." a obok ikonka Terminala. Postaram się zrobić screena kolejnym razem.
Poprzednio zapytałem czy zwyczajne usunięcie folderu w Finderze pomoże. Pomimo odpowiedzi instynktownie usunąłem i póki co nie otwiera mi sie samoistnie Safari. Widzę natomiast, że ciągle co jakiś czas wymaga ode mnie dostępu. Także znów przyznaje racje, problem wydaje się tkwić nieco głębiej. Dziękuje za pomoc już w tym momencie, mam nadzieje, że czegoś się przy okazji nauczę.

Edited by the_deha, 28 July 2020 - 06:29.

[cronopioverde]

Dzięki za podzielenie się raportem.

Wygląda na to, że masz więcej niż jeden adware. Nie chcę wnikać w ten konkretny przypadek, ale przypominam tylko wszystkim czytającym, że podobnej, powiedzmy, infekcji można się często nabawić instalując popularne płatne aplikacje z „darmowych” źródeł. Kolejny powód, by tego nie robić.

 

Ad hoc: celem doprecyzowania poproszę jeszcze tylko o output (wymaga potwierdzenia hasłem):

{ sudo launchctl list; launchctl list } | grep -v apple; ls -nO@ /Users/Shared

i będziemy próbowali coś zaradzić, a dokładnie – usunąć, co niepotrzebne.

[the_deha]

Co konkretniej zrobić z tą linijką / komendą mam zrobić? Mam na myśli gdzie bądź kiedy wpisać?

[ftpd]

W Terminal.

[the_deha]

Zero reakcji. Skopiowałem zwyczajnie cały kod ale brak jakiejkolwiek reakcji. Nie powinienem czymś najpierw poprzedzić ten kod?

[cronopioverde]

Przepraszam najmocniej. Zapomniałem, zdaje się, na chwilę, że nadal, pomimo posiadania Cataliny, używasz domyślnie powłoki bash. Zatem zamknij poprzednie okno Terminala albo wciśnij ctrl+C, by zakończyć proces i wklej w tej postaci:

{ sudo launchctl list; launchctl list; } | grep -v apple; ls -nO@ /Users/Shared

Tak zadziała do końca.

[the_deha]

Proszę

Last login: Wed Jul 29 21:38:15 on ttys000

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
MacBook-Pro-Dominik-2:~ dominikhrycaj$ { sudo launchctl list; launchctl list; } | grep -v apple; ls -nO@ /Users/Shared
Password:
PID	Status	Label
-	78	com.UltraSearchSystemDaemon
-	0	org.cups.cupsd
-	0	Adobe_Genuine_Software_Integrity_Service
-	0	com.vix.cron
-	78	com.adobe.fpsaud
-	0	com.adobe.acc.installer.v2
PID	Status	Label
-	0	com.google.keystone.user.xpcservice
-	0	com.800E4911.A67A.4D7C.A5DF.38F05C85AC36
418	0	com.adobe.GC.AGM
15961	0	com.adobe.Photoshop.3556
8012	0	com.coconut-flavour.coconutBattery-Menu.6296
-	78	com.search.TapufindOd
-	0	S8EX82NJP6.com.macpaw.CleanMyMac-mas.HealthMonitor
-	0	com.UltraSearchSystem
-	-5	com.adobe.AdobeCreativeCloud
-	0	com.openssh.ssh-agent
2529	0	com.adobe.CCLibrary.2164
-	0	com.macpaw.CleanMyMac-mas.6200
-	0	com.spotify.client.startuphelper
-	0	com.adobe.GC.Scheduler-1.0
460	0	com.adobe.CCXProcess.4788
16034	0	com.adobe.illustrator.4776
-	0	com.adobe.ccxprocess
-	0	com.google.keystone.user.agent
-	1	com.epicgames.launcher
-	3	com.6050949257051537303.10372982976
968	-11	com.wacom.pentablet
total 11392
-rw-r--r--@ 1 501  0  -         2471 28 cze 15:25 2020-28-06-installer.txt
	com.apple.TextEncoding	     15 
drwxrwxrwx  4 501  0  -          128 24 mar 00:40 Adobe
drwxrwxrwx  4 0    0  -          128  1 sie 12:45 AdobeGCData
drwxr-xr-x  2 501  0  -           64 28 cze 15:28 App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004
-rw-r--r--@ 1 501  0  -      4782868 30 cze 15:25 App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004.tar.gz
	com.apple.quarantine	     38 
drwxrwxrwx  4 501  0  -          128 22 cze 19:21 Canon_Inc_IC
drwxr-xr-x  3 501  0  -           96 27 mar 15:08 Epic Games
drwxr-xr-x  5 0    0  -          160 24 mar 19:04 Previously Relocated Items
drwxrwxrwx@ 2 501  0  hidden      64 23 mar 19:20 SC Info
	com.apple.FinderInfo	     32 
drwxr-xr-x  3 501  0  -           96 27 mar 15:06 UnrealEngine
drwxrwxrwx@ 2 265  0  hidden      64 29 lis  2019 adi
	com.apple.FinderInfo	     32 
	com.apple.metadata:com_apple_backup_excludeItem	     61 
-rw-r--r--  1 501  0  -            0 28 cze 15:20 fl
-rw-r--r--@ 1 501  0  -            0 28 cze 15:20 sf.plist
	com.apple.TextEncoding	     15 
MacBook-Pro-Dominik-2:~ dominikhrycaj$ 

[cronopioverde]

Upchało się tego trochę po kątach. Na pewno najwygodniej byłoby wywalić dziadostwo trialową wersją Malwarebytes, ale jeśli zechcesz się pobawić, to przekopiuj:

sudo launchtcl unload -w /Library/LaunchDaemons/com.UltraSearchSystemDaemon.plist ~/Library/LaunchAgents/com.6050949257051537303.10372982976.plist ~/Library/LaunchAgents/com.UltraSearchSystem.plist ~/Library/LaunchAgents/TapufindOd.plist; sudo rm -rf /Library/Application Support/com.UltraSearchSystemDaemon/ ~/Library/Application Support/com.UltraSearchSystem/ /Library/LaunchDaemons/com.UltraSearchSystemDaemon.plist ~/Library/LaunchAgents/com.UltraSearchSystem.plist ~/Library/LaunchAgents/TapufindOd.plist ~/Library/LaunchAgents/com.6050949257051537303.10372982976.plist ~/Library/Application Support/com.4776192613794494886/ /Users/Shared/2020-28-06-installer.txt /Users/Shared/App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004* /Users/Shared/fl /Users/Shared/*.plist /private/tmp/*; sudo find /private/var/folders -name ‘Instalacja.app’ -exec rm -rf {} \; 

Podziel się wynikiem z okna Terminala po zakończeniu działania komend, proszę. Sam jestem ciekaw błędów, które wyrzuci. Powodzenia!

[the_deha]

Last login: Thu Aug  6 14:14:42 on console

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
MacBook-Pro-Dominik-2:~ dominikhrycaj$ sudo launchtcl unload -w /Library/LaunchDaemons/com.UltraSearchSystemDaemon.plist ~/Library/LaunchAgents/com.6050949257051537303.10372982976.plist ~/Library/LaunchAgents/com.UltraSearchSystem.plist ~/Library/LaunchAgents/TapufindOd.plist; sudo rm -rf /Library/Application Support/com.UltraSearchSystemDaemon/ ~/Library/Application Support/com.UltraSearchSystem/ /Library/LaunchDaemons/com.UltraSearchSystemDaemon.plist ~/Library/LaunchAgents/com.UltraSearchSystem.plist ~/Library/LaunchAgents/TapufindOd.plist ~/Library/LaunchAgents/com.6050949257051537303.10372982976.plist ~/Library/Application Support/com.4776192613794494886/ /Users/Shared/2020-28-06-installer.txt /Users/Shared/App_14AD2BFD-1932-481D-9678-1C6CAA255D7B-52545-00018FCFA695E004* /Users/Shared/fl /Users/Shared/*.plist /private/tmp/*; sudo find /private/var/folders -name ‘Instalacja.app’ -exec rm -rf {} \;
Password:
sudo: launchtcl: command not found
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.ScreenTimeAgent/Store: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.lockoutagent: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.progressd/ClassKit: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.Safari/SafariFamily: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.LaunchServices.dv: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/dmd: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.nsurlsessiond: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.SharedWebCredentials: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/0/com.apple.routined/dv: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.touristd/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.WeatherKitService/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.photolibraryd/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.Safari/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.iChat/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.appstoreagent/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.nsurlsessiond/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.parsecd/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.identityservicesd/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.geod/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.cloudd/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/com.apple.corerecents.recentsd/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/T/homed/TemporaryItems: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/C/com.apple.WebKit.WebContent.Sandbox: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/C/com.apple.QuickLook.thumbnailcache: Operation not permitted
find: /private/var/folders/wm/l5r4qtc96xx8h908d437_6_c0000gn/C/com.apple.WebKit.Networking.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/0: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/T/com.apple.nsurlsessiond/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.nsurlsessiond: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.routined/dv: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/C/com.apple.WebKit.WebContent.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/C/com.apple.WebKit.Networking.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/0/com.apple.LaunchServices.dv: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.mobileassetd/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.revisiond/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.geod/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.nehelper/TemporaryItems: Operation not permitted
MacBook-Pro-Dominik-2:~ dominikhrycaj$ 

[cronopioverde]

Ups. Tak to jest, jak się pisze, zamiast wklejać. Oczywiście, że ‘command not found’, bo powinno być launchctl. Przepraszam. No ale odnośne pliki usunięte tak czy inaczej; w ten sposób byłoby po prostu bardziej elegancko. Żeby nie wisiały żadne procesy-zombie, można ewentualnie całkowicie zresetować i odbudować launch services, co na pewno nie zaszkodzi, czyli: 

sudo /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -kill -seed -R -domain s -domain l -domain u -v

a następnie restart.

Ponadto dodatkowo zerknij do katalogu Aplikacje, czy nie ma czegoś tak oczywistego jak jakaś aplikacja od tego reklamowego śmiecia. Zwracaj uwagę na wszystko, czego świadomej instalacji nie kojarzysz, podejrzane usuwaj. Oraz upewnij się raz jeszcze, czy nie masz w Preferencjach systemowych aktywnego panelu „Profile” (w Twoim pierwszym raporcie EtreCheck coś było, w drugim już nie; warto sprawdzić). Ponownie – jeśli jest, usuń.

No i obserwuj, czy problem już zniknął. Powodzenia!

[the_deha]

Okej, zrobiłem wszystko jak napisałeś. Po komendzie Terminal rzucał linijkami jak szalony, poźniej restart, następnie śmieci w aplikacjach i profile... W profilach sam syf, dodam niżej screena.

 

 

A teraz coś bardzo ważnego...  wielkie dzięki, bo bez Ciebie i tego forum za nic w świecie sam bym tego nie ''wygooglował'! Prowadziłeś mnie jak pies przewodnik niewidomego. 

Jakieś 6-7 lat temu zacząłem używać iOS, MacOS i w takich technicznych sprawach (terminal, napisanie linijki kodem) jestem kompletnie zielony.

Dziękuje

Edited by the_deha, 08 August 2020 - 19:02.

[cronopioverde]

Do usług. Ale pomonitoruj jeszcze zachowanie Safari i okolic przez jakiś czas, proszę. Sam spotkałem się z tym akurat szkodliwym oprogramowaniem po raz pierwszy, więc też działałem nieco „po omacku”, aby kontynuować Twoją metaforę. W razie czego, odzywaj się.