1

I found a curious little .plist in my LaunchAgents, and I'm worried it could be a rootkit or other backdoor. Here are its contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>Label</key>
   <string>com.asdasdasd</string>
   <key>ProgramArguments</key>
   <array>
      <string>/Library/Java/JavaVirtualMachines/jdk1.8.0_73.jdk/Contents/Home/jre/bin/java</string>
      <string>-Dapple.awt.UIElement=true</string>
      <string>-jar</string>
      <string>/Users/LoganDark/.asdasd/asda.jar</string>
   </array>
   <key>RunAtLoad</key>
   <true/>
</dict>
</plist>

Can anyone assist me in figuring out what this is? Should I be worried?

  • 4
    Given this is in your ~/Library/LaunchAgents the associated Java process is running as you and not superuser. This limits the scope of harm. Try removing the launchd file and restarting. Does anything break? Does the file reappear? Personally I would remove the file and associated invisible ~/.asadasd folder. – Graham Miln Jun 25 '18 at 7:48
  • 2
    I second @GrahamMiln's idea but instead of removing the file you could simply add <key>Disabled</key> <true/> to the plist and use launchctl unload ~/Library/LaunchAgents/asdasdasd.plist (or whatever it's called) and it won't re-load itself unless you remove the Disabled key. – Iain Jun 25 '18 at 16:41
  • The jar file appears to be a component of malware. See reverse.it/sample/… and reverse.it/sample/… – user90735 Jun 26 '18 at 3:24
  • macOS != Windows – Dev Jun 26 '18 at 4:46
  • Since when did Java care? – user90735 Jun 26 '18 at 10:03
3

The file name does not match an Apple-supplied program, nor is it a well-known Mac program (i.e. very popular program).

However, it might still be legimate. The name sounds like something you would come up with if you were just typing any random name. It could be someone that you have loaned your computer to that were playing with creating their own program.

Make note of the time stamps of the files involved to see if that can give you a clue to remember what happened around that time. Perhaps you have created it yourself and forgotten about it?

I would check the contents of the asda.jar file to find out more about what it is. Take a copy of the file and rename it to asda.zip. Unzip it to find out what it contains. It might possible give you a clue as to what it is.

And ofcourse - if you still don't know what it is, consider your computer to have been compromised. In that case you should format the computer and restore from a backup from before the file was introduced, or alternatively do a clean install of macOS.

  • The jar file had disappeared, so I deleted the directory. – Dev Jun 26 '18 at 0:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .