"Central Locator" on iMac

[Johnfromtexas]

On new iMac an application called Central Locator showed up on the dock.  I was confused about what it was, but just ignored it.  But, when using Safari, Chome, or Firefox, my google searches were redirected to Yahoo searches and Bing.com.  I am using Malwarebytes Premium and it found nothing.  I did some research referring me to Safari/Preferemces/Extensions.  The only item in Extensions was this "Central Locator".  I unselected it, and my problems went away.  I removed the application from my computer.  What is this App and where did it come from?  What is its purpose?  Is it a virus?

thanks for any help.

 

[alvarnell]

I’ve not heard of it, but I and I’m sure the staff here would like to examine it. If you still have it, please upload it to the Newest Mac Threats forum.

[Johnfromtexas]

I am not sure what you mean.  The App is still in my trash bin.  Is that what you mean?  If so, how do I upload the application to the forum.  Sorry for my ignorance.

[alvarnell]

Yes, the app in your Trash, please, but not in this forum. The forum I mentioned above only allows Malware Hunters and the staff to download.

Look at the bottom of the posting window, where the paperclip is for instructions on attachments. You may have to compress the app in order to meet the 58.59MB limit.

[Johnfromtexas]

sorry, i am dumber than a stump.  i do not know how to do that.  i tried dragging the app from the trash and nothing happens.  also, this item has extension of .app - i do not see that listed as an accepted type file.  file is 11.9 mb, so should be no problem if i knew how to upload it.

[alvarnell]

Another user has reported finding Central Locator and has uploaded it to the Newest Mac Threats forum. You can follow the progress at 

 

[Johnfromtexas]

Visited with Malwarebytes and they have solved the problem.  The application now finds the Adware and removes it.  I still do not know what I downloaded that brought this app along.

[treed]

If you want to try to figure it out, you can check the download history for all your browsers. This requires a long and rather complex command to be executed in the Terminal app (found in the Utilities folder in your Applications folder).

Select and copy the following single line (being sure to select the entire line!). Triple-clicking that line should select the whole thing.

sqlite3 -separator ',' ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 "select strftime('%Y-%m-%d %H:%M:%S', datetime((strftime('%s','2001-01-01 00:00:00') + LSQuarantineTimeStamp), 'unixepoch'), 'utc'), LSQuarantineAgentBundleIdentifier, LSQuarantineDataURLString, LSQuarantineOriginURLString from LSQuarantineEvent where LSQuarantineDataURLString is not null;" > ~/Desktop/downloads.csv

Next, open the Terminal app and paste that line in, then press return. It should create a file on your desktop called downloads.csv. Open that in something like Numbers or Excel, and you'll see a table listing all the files you've downloaded recently, by date, including what browser was used to download, the URL to the file that was downloaded, and the URL of the referring page. The first URL is the one you'd be interested in. If you see any that look strange - especially something like an Adobe Flash Player download - or that occurred close to the time the problem started, I'd be very interested to see those URLs.

[Boessel]

Thank y'all for the help. @treed I tried doing it, but the list just contains two downloads. One is the application of SkyGo and the other one is a file of my university (my attestation of grades). Both downloads were in 2018.

[treed]

Thanks for checking that.

Unfortunately, the data in that database isn't always reliable, especially (and ironically) for Safari. But you'll never find things if you don't look, so I do appreciate that you were able to do so and report your results.