Getting rid of Mughthesec and Adloadr

[Mhig]

I have Sophos Home installed. At the moment, once or twice a day it finds the 'potentially unwanted applications' Mughthesec and Adloadr.

They are always within a directory within /private/tmp/ (and within that within nested directories with long alphanumeric names).

Sophos enables me to clean these up each time – but I don't know why they keep appearing. I'm assuming there is a root cause I haven't identified. Any ideas?

I'm on Catalina.

 

[tyc0746]

Do you use any of the freeware Mac System Cleaners like 'Advanced Mac Cleaner' or 'Mac Cleaner' etc? These are know to install lots of other crap alongside a mostly useless cleaning utility - also installed by some of the 'Flash Player Download' pop-up ads you may have seen.

If you keep using the app, then it keeps reinstalling the malware.

I couldn't find any up to date info on it, but here's one of the original reports on this malware.

 

[Mhig]

Thanks for that. I'm not the only family member using this machine, so I'll check what the others have done behind my back...

 

[tyc0746]

Check the download folder, and see if anything's been left there from a dodgy download.

...and if it's a multi-user computer, make sure there's only 1 admin account (e.g. your's) and everyone else has a more locked down version.