I've got a malicious process which I'm trying to remove. I've tried the following but each time it gets regenerated/restarted:

  • kill -9
  • deleting the plist file
  • launchctl disable
  • launchctl unload

Is there a way I can stop the loop of the process reinstating itself.

  • 1
    What’s the process? How do you know it’s malicious?
    – Allan
    Aug 11, 2023 at 3:50
  • 3
    It's called Hatier360. It's modifying the browsers to redirect all searches to it's mock search engine so it can open tab etc it wants to. Search Marquis is the search engine
    – George
    Aug 11, 2023 at 4:23

1 Answer 1


I solved this by manually modifying the plist file and setting KeepAlive & LoadOnStart to false. Then restarting the machine meant the process wasn't running and I was free to then unload the service and delete corresponding files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .