2

I know I should have cautioned when I first download unwarranted stuffs, but things happen.

Removing them from /Library/LaunchDaemons or settings of each browsers, anything manually are done. Profile cleared, but from this particular section:

error

- at the bottom of the right window will not work. It will not respond to the mouse click. As you can see, I have already unlocked.

Please someone let me know. I need these eradicated.

2
1

Try Apple's command line tool tccutil! The general usage is:

tccutil command service bundleIdentifier

Only one command (reset) is implemented right now. The service is the protected item (e.g. Microphone or Photos). The bundleIdentifier is the bundle identifier of the app given access to protected services.

  1. Open Terminal
  2. Get the bundleIdentifier of the apps to remove:

    mdls -name kMDItemCFBundleIdentifier -r /Applications/Some.app #Some.app is just an example.app
    

    Real example:

    host:~ user$ mdls -name kMDItemCFBundleIdentifier -r /Applications/Utilities/Terminal.app
    com.apple.Terminal
    

    More methods to get the bundleIdentifier: Getting the bundle identifier of an OS X application in a shell script. The app to remove is not necessarily in /Applications or /Applications/Utilities/.

  3. Remove all permissions for the app:

    tccutil reset All bad.axisofevil.randomwhere #bad.axisofevil.randomwhere is just an examplary bundleIdentifier
    

RansomWhere?'s exec has a (null) bundleIdentifier. The associated launch daemon plist contains a com.objective-see.ransomwhere though, which looks like a typical bundleIdentifier. I would try this one first.

BTW: RansomWhere? is no ransomware but a sec tool available here: RansomWhere?


Alternative approach:

Download tccutil (v1.2.5) from github. It's not related to Apple's command line tool though having the same name. It's also available via brew but apparently outdated there (v1.2.2) and won't work with Catalina.

  1. Disable SIP
  2. Download tccutil from github.com/jacobsalmela/tccutil (direct link: tccutil)
  3. Unzip the downloaded tccutil-master.zip
  4. tccutil is a Python script.
  5. In the command line enter (in the example below I d/led the zip to Downloads and unzipped it there - apply the path below to your environment respectively):

    -h to get a short help text

    sudo python $USER/Downloads/tccutil-master/tccutil.py -h
    

    -l to list all items in the accessibility database

    sudo python $USER/Downloads/tccutil-master/tccutil.py -l
    

    -r to remove an app/entry

    sudo python $USER/Downloads/tccutil-master/tccutil.py -r /path/to/example.app|bundleIdentifier
    
  6. Enable SIP
6
  • This may be a dumb question, but am I supposed to write the term of malware in place of Some? I get the error Some.app: could not find Some.app. lol – user12431122 Dec 16 '19 at 21:45
  • You have to get the bundleIdentifier of LeadingSignSearch and RansomWhere?. Some.app is just an example app. I can tell you the bundle identifier of the latter in a few minutes (after installing it in a VM). LeadingSignSearch is apparently not installed on any of my machines but I may get it (and its bundleIdentifier) soon - takes several ten minutes up to some hours. – klanomath Dec 16 '19 at 22:00
  • removing from all the LaunchAgents and Daemons itself resolved most of the issue that I came back to trying your suggestion a little late. thank you for your help, it was just a little more complicated than the other.. Hope you dont get infected! @klanomath – user12431122 Dec 18 '19 at 14:12
  • @user12431122 The only reference to LeadingSignSearch I get (via Google) is your question. So no chance right now to fetch a possible bundleIdentifier for it.... I still have to look into another tccutil (provided by homebrew>github.com/jacobsalmela/tccutil) whether it offers more than Apple's tccutil – klanomath Dec 18 '19 at 14:33
  • Thank you for sharing. Seems like it will be my intro to anti-virus setup of Mac – user12431122 Dec 18 '19 at 15:09
0
tccutil reset SystemPolicyAllFiles

will reset all Full Disk Access apps' permissions. You'll have allow them once again.

https://c-command.com/spamsieve/help/security-privacy-acce

3
  • gosh, where do people locate these resources? do you happen to know how to toggle between web search results? A friend of mine showed how to do that, with arrows (>) appearing at the left of each item but it's not recreated nor searched.. – user12431122 Dec 17 '19 at 20:46
  • Oh that’s kind:) I just browse this site. // Tab would do that. And to go back and forth in history, CMD and square brackets. – anki Dec 18 '19 at 6:22
  • No thats not what Im looking for – user12431122 Dec 18 '19 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .