Disable / Remove bsecured OS X

Question

I just picked up a laptop second hand off of eBay and I noticed that it's doing some very weird proxy / routing things. I narrowed it down to an executable called bsecured. Short of reinstalling everything (I don't have Leopard disks), how can I disable / remove this?

Answer 1

First of all, you should find out what originally launched bsecured. Open up Activity Monitor and find bsecured in the list. Click 'inspect' and look at the parent process. If it's launchd(1), it was launched on boot. If it's launchd(coupleOfHundred), it was launched when you logged in.

To stop it coming back download Lingon and look through the different categories of job (if it started on boot, Users Daemons is probably the place to start) until you find a job that references it, and unload it. Then go to the 'View' menu and under 'Folder in Finder' select the category the job was in, find the .plist that corresponds to it and delete it.

Then, do sudo killall bsecured in the Terminal to kill it. Finally, check that it hasn't recreated the launchd job.

This'll work if it's using launchd to start it. If it's using something else (a hacked executable, for instance), then all bets are off.

If you have security worries about your operating system I strongly recommend formatting the hard drive and re-installing from scratch (in fact, I'd do it as a matter of course when buying a second-hand computer). You've found bsecured, but who knows what other nasties are lurking in places you haven't looked? A set of Leopard disks shouldn't set you back that much second hand, and even Snow Leopard is only £26 from Apple (you can do a wipe and install with even the SL upgrade).