1

My MacBook Pro has had a common adware virus on it ExploreSearchResults. I have already gone through all of my extensions and deleted anything related. Anything in the Applications folder that did not belong has been deleted. I also know this virus is common through fake flash player updates so I went through and deleted all of them. I also went through these folders and deleted anything suspicious or included the ExploreSearchResults name

/Users/Shared/
/Library/LaunchDaemons/
~/Library/LaunchAgents/
/Library/LaunchAgents/

I then shutdown the computer and restarted in Safe mode. I ran the activity monitor and found both ExploreSearchResults and ExploreSearchResultsDaemon running. When I force quit both they would reappear so I ran a sample to find the parent folder /Private/var/root/.ExploreSearchResults. I then ran a sudo ls -l /var/root command in Terminal to find this list of files.

total 8  
-rw-r--r--   1 root  wheel    3 Mar 29  2014 .CFUserTextEncoding   
drwxr-xr-x   6 root  wheel  192 Jan  6 05:46 .ExploreSearchResults  
drwx------  24 root  wheel  768 Jan  6 04:02 .Trash  
-r--r--r--   1 root  wheel   10 Sep  9  2014 .forward  
drwxr-xr-x   8 root  wheel  256 Dec 26 13:52 .mitmproxy  
drwxr-xr-x   3 root  wheel   96 Jun 26  2019 .oracle_jre_usage  
drwx------  17 root  wheel  544 Apr 21  2020 Library

Three questions here first is can I safely delete the .ExploreSearchResults file with sudo rm /var/root/.ExploreSearchResults command? The second question is that is this the origin of this adware virus or could it be hidden elsewhere? Last question are all the other files in the root folder safe a supposed to be there? I know that the root folder is extremely important to the system so I am treading lightly while accessing this folder I know MacOS blocks access from it for a reason.

sw_vers ProductName: Mac OS X
ProductVersion: 10.14.6
BuildVersion: 18G5033

Improve this question
3
  • You could be save deleting everything in /var/root after backing up your data files since macOS is designed to never need the root user enabled. Do you run software or tools on your Mac under root user or the command line intentionally?
    – bmike ♦
    Commented Jan 6, 2022 at 12:41
  • no i usually do not run under root so i could delete everything after a backup.
    – Will K
    Commented Jan 6, 2022 at 12:48
  • Yes - can you edit in the post your sw_vers and also disable root if it got enabled - support.apple.com/en-us/HT204012
    – bmike ♦
    Commented Jan 6, 2022 at 12:58

1 Answer 1

Reset to default
2

Yes, you can safely delete the file.

As with any virus, this could be a decoy or a secondary installation - so there might be stuff hidden elsewhere also.

In general, after a virus infection, it is best to simply start over from fresh with a known-good installation (i.e. for example restoring from a backup from before the virus infected the system). You will never be able to be 100% sure that you've undone every change made by the virus if you do not follow that method.

Improve this answer
2
  • Great I will delete the file and see if it fixes it. Unfortunately i know you are right. The malware could have gone in an endless amount of directions and hid itself. the only way to guarantee a true fix would be to start fresh. I unfortunately do not have a backup before the virus has been installed so I may be looking at a factory reset
    – Will K
    Commented Jan 6, 2022 at 12:06
  • It’s worthwhile making a backup now @WillK since time machine copies the files and settings and apps, but once you wipe your Mac, you can choose to only reinstall user files and test if you’re clean. Best case you’re now good - worst case you erase a second time and hand copy back just the data files you need and know are clean.
    – bmike ♦
    Commented Jan 6, 2022 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .