Jump to content

uTorrent installer AdWare?


Recommended Posts

Hi,

After installing uTorrent, I noticed a new Login Item alongside uTorrent itself called "runchmm" (which is in ~/Library/Application Support/runchmm).  I have no idea what this actually does, but I have managed to narrow it down to a step in the Installer I missed that offers to install something called "Search Offer".  I noticed that Chromium Browser has been installed and also when I start Google Chrome, it warns me that a new Search Engine has been installed.  Safari seems unaffected.

So, I have lots of questions:

  • How worried should I be? Do I need to reformat my hard drive and reinstall MacOS?
  • Malwarebytes doesn't flag this as AdWare... should it?
  • Can I just remove runchmm from Login Items and from the filesystem (along with Chromium) and be ok?
  • How can I find out whether or not the presence of this item is dangerous (rather than just suspicious)?

Here's the installer screen that describes "Search Offer":

5ab9460caaa50_ScreenShot2018-03-25at17_24_41.png.19a7a4d91755d1e68f68c5de7ce1c5cb.png

 

Link to post
Share on other sites

From the description, I would have to guess that this is just a new variant of some form of adware that MBAM isn't currently aware of, and not anything dangerous, but in either case you should submit the two files you found along with the uTorrent installer (if you still have it) in the Newest Mac Threats forum.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.