Skip to content

Instantly share code, notes, and snippets.

@haircut
Created April 3, 2015 18:39
Show Gist options
  • Save haircut/1ed6ea97671ebf76fb33 to your computer and use it in GitHub Desktop.
Save haircut/1ed6ea97671ebf76fb33 to your computer and use it in GitHub Desktop.
SavingThrow supplemental adf gathered from AdwareMedic
# FkCodec
# INCOMPLETE: Browser extension components
# codec-?m
/Users/*/Library/Application Support/Codec-M
/Users/*/Library/LaunchAgents/com.codecm.uploader.plist
/Applications/Codec-M.app
####################
# Yontoo
# INCOMPLETE: Browser extension components
# (yontoo)|(torrenthandler)
/Users/*/Library/Application Support/Google/Chrome/YontooLayers.crx
# AGGRESSIVE: Modifies or creates Firefox user.js
# Uncomment for aggressive remediation
#/Users/*/Library/Application Support/Firefox/Profiles/*.default/user.js
####################
# ClickAgent
# INCOMPLETE: Browser extension components
# (flash ?player)|(clickagent)
####################
# ChatZum
# INCOMPLETE: Browser extension components
# chatzum
/Applications/ChatZumUninstaller.pkg
/Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
/Library/Internet Plug-Ins/uid.plist
/Library/Internet Plug-Ins/zako.plugin
####################
# Spigot
# INCOMPLETE: Browser extension components
# (searchme)|(slick ?savings)|(amazon ?shopping ?assistant)|(ebay ?shopping ?assistant)|(domain ?error ?assistant)
/Users/*/Library/Application Support/Spigot/
####################
# SaveKeep
# INCOMPLETE: Browser extension components
# su?ave ?k+e+p(o|a)*
/Applications/Savekeep.app
####################
# Jollywallet
# INCOMPLETE: Browser extension components
# jollywallet
####################
# Conduit
# INCOMPLETE: Browser extension components
# (conduit)|(searchext)|(mybrand)|( Community Toolbar)|(search ?protect)|(trovi)
/Users/*/Library/Application Support/Google/Chrome/Default/Extensions/cbmjmfcldbpelhknnfjbkobmabafpoed
/Library/InputManagers/CTLoader/
/Library/LaunchAgents/com.conduit.loader.agent.plist
/Library/LaunchDaemons/com.perion.searchprotectd.plist
/Library/Application Support/SIMBL/Plugins/CT2285220.bundle
/Library/Application Support/Conduit/
/Applications/SearchProtect.app
/Applications/SearchProtect/
/Users/*/Conduit
/Users/*/Trovi
/Users/*/Library/Application Support/Conduit
/Users/*/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
/Users/*/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
/Users/*/Library/Application Support/Firefox/Profiles/*.default/searchplugins/conduit.xml
/Users/*/Library/Application Support/Firefox/Profiles/*.default/searchplugins/MyBrand.xml
/Users/*/Library/Application Support/Firefox/Profiles/*.default/searchplugins/Conduit Customized Web Search.xml
/Users/*/Library/Application Support/Firefox/Profiles/*.default/takeOverNewTab.txt
/Users/*/Library/Application Support/Firefox/Profiles/*.default/abstraction.js
####################
# Downlite
# INCOMPLETE: randomized plist of format com.*.agent.plist require special processing handled by SavingThrow
/Library/Application Support/VSearch
/Library/LaunchAgents/com.vsearch.agent.plist
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
/System/Library/Frameworks/v.framework
####################
# GoPhoto
# INCOMPLETE: Browser extension components
# (gophoto[-\.]?it)|(freehdsport)
/Users/*/Library/Application Support/Google/Chrome/External Extensions/ccfjbdjailljfihgkoccfbiljjapiijb.json
# AGGRESSIVE: Modifies or creates Firefox user.js
# Uncomment for aggressive remediation
#/Users/*/Library/Application Support/Firefox/Profiles/*.default/user.js
# AGGRESSIVE: Modifies Firefox prefs.js
# Uncomment for aggressive remediation
#/Users/*/Library/Application Support/Firefox/Profiles/*.default/prefs.js
####################
# Genio
# INCOMPLETE: Needs to purge references from /etc/launchd.conf
# lib(gen|imc)kit(sa)?\.dylib
# Browser extension components
# (genieo)|(installmac)
/Users/*/Library/LaunchAgents/com.genieo.completer.download.plist
/Users/*/Library/LaunchAgents/com.genieo.completer.update.plist
/Users/*/Library/LaunchAgents/com.genieo.completer.ltvbit.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Applications/Genieo.app
/Applications/InstallGenieo.app
/Applications/Reset Search.app
/Applications/Uninstall Genieo.app
/Applications/Uninstall IM Completer.app
/Applications/InstallMac
/Applications/InstallGenieo
/Users/*/Library/Application Support/com.genieoinnovation.Installer
/Users/*/Library/Application Support/Genieo
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/Library/Frameworks/GenieoExtra.framework
/Users/*/Library/Application Support/Firefox/Profiles/*.default/searchplugins/my-homepage.xml
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
####################
# Vidx/MacVX
# INCOMPLETE: Browser extension components
# (vi+[aeiou]*d+[aeiou]*x+)|(macv[aeiou]?x[aeiou]?)|(mac ?captain)|(mac ?price ?cut)|(save ?on ?mac)|(mac ?global ?deals)|(^macster)|(macdeals)|(s+hop ?bra+i+n)
/Applications/Vidx.app
/Users/*/Library/Safari/Extensions/extension.safariextz
####################
# Awesome Screenshot
# INCOMPLETE: Browser extension components
# awesome ?screenshot
####################
# MacShop
# INCOMPLETE: Browser extension components
# mac[- ]?shop
####################
# MacSmart
# INCOMPLETE: Browser extension components
# macsmart
####################
# News Ticker Remover
# INCOMPLETE: Browser extension components
# news ?ticker ?remover
####################
# PhotoZoom
# INCOMPLETE: Browser extension components
# photo[- ]?zoom
####################
# Shopper Helper Pro
# INCOMPLETE: Browser extension components
# shopper[- ]?helper[- ]?pro
####################
# Best YouTube Downloader
# INCOMPLETE: Browser extension components
# best ?youtube ?downloader
/Users/*/Library/LaunchAgents/com.moeppfdpoohhdcaefbfpmabjipnohiif.updater.plist
####################
# ArcadeYum
# INCOMPLETE: Browser extension components
# arcade ?yum
####################
# Buca Apps
# INCOMPLETE: Browser extension components
# (cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)
# (shopp?y ?mate)|(flashmall)|(palmall)
/Users/*/Library/Application Support/Google/Chrome/External Extensions/phpdijfdkggndfmgcfdhcimlflflnega.json
/Users/*/Library/LaunchAgents/Safari Security
/Users/*/Library/LaunchAgents/WebSocketServerApp
/Users/*/Library/LaunchAgents/com.webhelper.plist
/Users/*/Library/LaunchAgents/com.webtools.update.agent.plist
/Users/*/Library/Application Support/webHelperApp/
/Users/*/Library/WebTools/
# Kill modified user.js file - comment out for less aggressive cleaning/detection
# This file does not exist by default so unless required in your environment
# this may be a good indicator of infection
/Users/*/Library/Application Support/Firefox/Profiles/*.default/user.js
####################
# DreamsAdNetwork
# INCOMPLETE: Browser extension components
# (extended ?protection)|(video ?download ?helper)
####################
# searchtab
# INCOMPLETE: Browser extension components
# set search settings
####################
# FlashFree
# INCOMPLETE: Browser extension components
# FlashFree
####################
# PremierOpinion
# INCOMPLETE: Browser extension components
# PremierOpinion
/Applications/PremierOpinion
/Library/LaunchDaemons/PremierOpinion.plist
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment