I know I should have cautioned when I first download unwarranted stuffs, but things happen.

Removing them from /Library/LaunchDaemons or settings of each browsers, anything manually are done. Profile cleared, but from this particular section:


- at the bottom of the right window will not work. It will not respond to the mouse click. As you can see, I have already unlocked.

Please someone let me know. I need these eradicated.


2 Answers 2


Try Apple's command line tool tccutil! The general usage is:

tccutil command service bundleIdentifier

Only one command (reset) is implemented right now. The service is the protected item (e.g. Microphone or Photos). The bundleIdentifier is the bundle identifier of the app given access to protected services.

  1. Open Terminal
  2. Get the bundleIdentifier of the apps to remove:

    mdls -name kMDItemCFBundleIdentifier -r /Applications/Some.app #Some.app is just an example.app

    Real example:

    host:~ user$ mdls -name kMDItemCFBundleIdentifier -r /Applications/Utilities/Terminal.app

    More methods to get the bundleIdentifier: Getting the bundle identifier of an OS X application in a shell script. The app to remove is not necessarily in /Applications or /Applications/Utilities/.

  3. Remove all permissions for the app:

    tccutil reset All bad.axisofevil.randomwhere #bad.axisofevil.randomwhere is just an examplary bundleIdentifier

RansomWhere?'s exec has a (null) bundleIdentifier. The associated launch daemon plist contains a com.objective-see.ransomwhere though, which looks like a typical bundleIdentifier. I would try this one first.

BTW: RansomWhere? is no ransomware but a sec tool available here: RansomWhere?

Alternative approach:

Download tccutil (v1.2.5) from github. It's not related to Apple's command line tool though having the same name. It's also available via brew but apparently outdated there (v1.2.2) and won't work with Catalina.

  1. Disable SIP
  2. Download tccutil from github.com/jacobsalmela/tccutil (direct link: tccutil)
  3. Unzip the downloaded tccutil-master.zip
  4. tccutil is a Python script.
  5. In the command line enter (in the example below I d/led the zip to Downloads and unzipped it there - apply the path below to your environment respectively):

    -h to get a short help text

    sudo python $USER/Downloads/tccutil-master/tccutil.py -h

    -l to list all items in the accessibility database

    sudo python $USER/Downloads/tccutil-master/tccutil.py -l

    -r to remove an app/entry

    sudo python $USER/Downloads/tccutil-master/tccutil.py -r /path/to/example.app|bundleIdentifier
  6. Enable SIP
  • This may be a dumb question, but am I supposed to write the term of malware in place of Some? I get the error Some.app: could not find Some.app. lol Dec 16, 2019 at 21:45
  • You have to get the bundleIdentifier of LeadingSignSearch and RansomWhere?. Some.app is just an example app. I can tell you the bundle identifier of the latter in a few minutes (after installing it in a VM). LeadingSignSearch is apparently not installed on any of my machines but I may get it (and its bundleIdentifier) soon - takes several ten minutes up to some hours.
    – klanomath
    Dec 16, 2019 at 22:00
  • removing from all the LaunchAgents and Daemons itself resolved most of the issue that I came back to trying your suggestion a little late. thank you for your help, it was just a little more complicated than the other.. Hope you dont get infected! @klanomath Dec 18, 2019 at 14:12
  • @user12431122 The only reference to LeadingSignSearch I get (via Google) is your question. So no chance right now to fetch a possible bundleIdentifier for it.... I still have to look into another tccutil (provided by homebrew>github.com/jacobsalmela/tccutil) whether it offers more than Apple's tccutil
    – klanomath
    Dec 18, 2019 at 14:33
  • Thank you for sharing. Seems like it will be my intro to anti-virus setup of Mac Dec 18, 2019 at 15:09
tccutil reset SystemPolicyAllFiles

will reset all Full Disk Access apps' permissions. You'll have allow them once again.


  • gosh, where do people locate these resources? do you happen to know how to toggle between web search results? A friend of mine showed how to do that, with arrows (>) appearing at the left of each item but it's not recreated nor searched.. Dec 17, 2019 at 20:46
  • Oh that’s kind:) I just browse this site. // Tab would do that. And to go back and forth in history, CMD and square brackets.
    – anki
    Dec 18, 2019 at 6:22
  • No thats not what Im looking for Dec 18, 2019 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .