3

Running an Early '09 iMac with Mavericks. Earlier this month I began to see a pop up referencing a 'malware cleaner'. Below is a copy of items dated May 4th in the Launch Agents and Launch Daemons folders. Any thoughts on resolving this issue?

Here are the May 4th items:

Launch Agents folder

  • com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist

Launch Daemons Folder

  • com.adobe.ARMDC.Communicator.plist
  • com.adobe.ARMDC.SMJobBlessHelper.plist
  • ARMDC is part of the Adobe Updater mechanism. Have you tried AdwareMedic? – IconDaemon May 24 '15 at 23:14
3

These are probably real Adobe files, but I'm deleting them because I didn't authorize their installation and they're useless daemons running at launch. The "ARM" ones are apparently for alerting you to updates of Adobe Reader... and who uses that anymore?

Another one is com.adobe.fpsaud, 32-bit junk that's still lingering around to warn you about Flash player updates. It prompts warnings from Mac OS about being "not optimized," because 32-bit support is deprecated.

One guy took the time to write up his exploration of these files and shows how to remove them here.

1

I cannot speak of the ARMDC Launch Agents or Daemon specifically, but it could be the culprit. It could also be a revenant of a legitimate prior Adobe installation, as Adobe CC leaves A LOT of remaining files, even after running the uninstaller.

I suspect there is advanced Mac malware in the wild that mascaradas as Adobe. I encountered something less blatant than pop ups, but I’m certain it’s no longer the obvious Update Adobe Flash malware that tricks uninformed users. I believe the use Adobe to mask thier malware because Adobe CC has massive bloat and is constantly updating, so it’s easier to hide if they have managed to get remote access.

You could delete them since you’re no longer using Adobe and see if the pop-ups disappear, but even then you wouldn’t know if your system has been compromised further.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .