Skip to content

Instantly share code, notes, and snippets.

@quchao

quchao/machook_removal.sh

Created January 18, 2016 09:48
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save quchao/ea71ac1aa82543e45271 to your computer and use it in GitHub Desktop.
Save quchao/ea71ac1aa82543e45271 to your computer and use it in GitHub Desktop.
Download ZIP
MacHook (a.k.a. WireLurker) Removal Script
Raw
machook_removal.sh
#!/bin/bash
mkdir -p ~/ppappinstaller/Library/LaunchDaemons ~/ppappinstaller/usr/bin ~/ppappinstaller/usr/local
sudo launchctl unload /Library/LaunchDaemons/com.apple.globalupdate.plist
sudo mv /Library/LaunchDaemons/com.apple.globalupdate.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/bin/globalupdate ~/ppappinstaller/usr/bin
sudo launchctl unload /Library/LaunchDaemons/com.apple.itunesupdate.plist
sudo mv /Library/LaunchDaemons/com.apple.itunesupdate.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/bin/itunesupdate ~/ppappinstaller/usr/bin
sudo launchctl unload /Library/LaunchDaemons/com.apple.machook_damon.plist
sudo mv /Library/LaunchDaemons/com.apple.machook_damon.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/local/machook ~/ppappinstaller/usr/local/machook
sudo launchctl unload /Library/LaunchDaemons/com.apple.watchproc.plist
sudo mv /Library/LaunchDaemons/com.apple.watchproc.plist ~/ppappinstaller/Library/LaunchDaemons
sudo mv /usr/bin/WatchProc ~/ppappinstaller/usr/bin
sudo mv /usr/local/ipcc ~/ppappinstaller/usr/local/ipcc
echo -e "Done!"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment