1

On the terminal, I search for the file com.pplauncher.plist on the directory

/Library/LaunchDaemons/

through the command ls -a, but such a file wasn't found. Later, I installed Malwarebytes and ran it. Then, it detected the file com.pplauncher.plist as a malware exactly in the same directory I was looking at.

My question is: why this has happened? I thought every file on my computer could be shown on the terminal.

PS: I was trying to delete this file because I found mshelper running on my iMac, which turns out to be a malware used to mine cryptocurrency.

  • 1
    Welcome on Ask ≠. •••• Your use of ls is correct and you are fully right: ls -a will show you all files whatever their hidden status for the Finder might be. •••• I suggest you to add the -B flag to your ls in case this file name contained some special characters to hide it (for example with a "\r" inside of a file-name, its printing in Terminal will hide the beginning of the name): •••• ls -aB /Library/LaunchDaemons/. – dan Aug 1 at 18:44
  • Thanks, @dan =) can you give me a reference where I can find a list of these special characters that can hide parts of a file-name? – leticia Aug 1 at 19:30
  • You should try using Spotlight Search for this file or download a free app called EasyFind. macupdate.com/app/mac/11076/easyfind – jmh Aug 1 at 19:35
  • Just do a ls -aBl /Library/LaunchDaemons and include the text output to your original question to check if my hypothesis is of any help. – dan Aug 1 at 22:22
  • Please tell us the full command that you ran. – anki Aug 1 at 22:41
-1

I would do the directory listing as root or with a sudo. It is possible that the malware changed permissions on the plist file.

| improve this answer | |
  • I think that is the most reasonable answer for what could've happened. Unfortunately, I cannot test it... but you're probably right! Thanks! – leticia Aug 4 at 17:39
  • @leticia : however the plist mode could have been changed, any user in this directory should see it with ls -aBl. – dan Aug 5 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .