Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
MacHook (a.k.a. WireLurker) Removal Script
#!/bin/bash
mkdir -p ~/ppappinstaller/Library/LaunchDaemons ~/ppappinstaller/usr/bin ~/ppappinstaller/usr/local
sudo launchctl unload /Library/LaunchDaemons/com.apple.globalupdate.plist
sudo mv /Library/LaunchDaemons/com.apple.globalupdate.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/bin/globalupdate ~/ppappinstaller/usr/bin
sudo launchctl unload /Library/LaunchDaemons/com.apple.itunesupdate.plist
sudo mv /Library/LaunchDaemons/com.apple.itunesupdate.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/bin/itunesupdate ~/ppappinstaller/usr/bin
sudo launchctl unload /Library/LaunchDaemons/com.apple.machook_damon.plist
sudo mv /Library/LaunchDaemons/com.apple.machook_damon.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/local/machook ~/ppappinstaller/usr/local/machook
sudo launchctl unload /Library/LaunchDaemons/com.apple.watchproc.plist
sudo mv /Library/LaunchDaemons/com.apple.watchproc.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/bin/WatchProc ~/ppappinstaller/usr/bin
sudo mv /usr/local/ipcc ~/ppappinstaller/usr/local/ipcc
echo -e "Done!"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.