Re: I got a malware, how do I get rid of it?

Question

I got my MacBook Air corrupted by pop up warm and probably other things through Safari, and decided to go to Genius Bar on Friday the 13th, and asked to do hard reset (or clean install), thinking that I could recover from my Time Machine backup. However, the Time Machine was black before the date I did reset, and it did recover along with the virus and warms when I did with the restore by migration assistant.  So, I went in on Monday the 16th, to reset again. I decided to get the whole backup spars-bundle thing copied to another backup disk. It gave me an error saying my other backup disk does not capacity, so I went to Staple to get the 1TB cheapest backup drive.  Unfortunately, it is spinning hard drive and copy took three to four days because I did not realize that the reset default was to sleep in every 30 min, or something.  After finally copied the total 450GB or so, I copied the "Document" folder of June 10th from the copied files in the new backup drive to my newly restored computer.  Here is my current problem on Monday the 23rd.
The copied files had permissions that does not have me (administrator of my computer) as user, rather Fetch as user. so I did this after reading https://discussions.apple.com/message/17158710
I ran the code on Terminal.
chflags -R nouchg ~/Documents
However, one of my application AccountEdge gives me permissions errors and other things.  "Numbers" let me open the existing excel file, but won't let me save the modified file in numbers. Apparently all the permissions in the subfolders are not corrected.  I hope it is only the permission issues.
How can I change the permissions in Document folder globally accessible by me the user?
The diagnostics says here:
System Version: OS X 10.9.3 (13D65)
Kernel Version: Darwin 13.2.0
Boot Mode: Normal
Model: MacBookAir4,2
USB
   My Passport 07B8 (Western Digital Technologies, Inc.)
System diagnostics
   2014-06-16 installd spin
Kernel messages
   Jun 18 08:32:00   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/ backup disk
   Jun 18 08:32:00   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data-1
   Jun 18 08:32:04   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data
   Jun 18 08:32:04   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data-1
   Jun 18 08:32:04   ASP_TCP CancelOneRequest: cancelling slot 16 error 35 reqID 35786 flags 0x29 afpCmd 0x44 so 0xffffff803ef93650
   Jun 18 09:00:53   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data-1
   Jun 18 09:00:53   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/ backup disk
   Jun 18 09:00:57   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data
   Jun 18 09:00:57   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data-1
   Jun 18 09:00:57   ASP_TCP CancelOneRequest: cancelling slot 25 error 35 reqID 36062 flags 0x29 afpCmd 0x22 so 0xffffff803ef93650
   Jun 18 09:20:53   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data-1
   Jun 18 09:20:54   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/ backup disk
   Jun 18 09:20:54   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data
   Jun 18 10:13:06   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data-1
   Jun 18 10:13:06   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/ backup disk
   Jun 18 10:13:06   AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Data
   Jun 18 10:13:09   ASP_TCP CancelOneRequest: cancelling slot 18 error 35 reqID 40614 flags 0x29 afpCmd 0x45 so 0xffffff803ef93650
   Jun 18 12:41:07   wl0: Roamed or switched channel, reason #1, bssid 00:1b:63:18:04:c5
   Jun 18 12:41:10   wl0: Roamed or switched channel, reason #8, bssid 00:1b:63:18:04:c5
   Jun 18 15:45:35   msdosfs_fat_uninit_vol: error 6 from msdosfs_fat_cache_flush
   --- last message repeated 11 times ---
   Jun 21 07:48:58   wl0: Roamed or switched channel, reason #8, bssid 00:1b:63:18:04:c5
   Jun 22 12:22:44   jnl: disk5s2: write_journal_header: error writing the journal header!
   Jun 22 12:22:44   hfs: Runtime corruption detected on Time Machine Backups, fsck will be forced on next mount.
   --- last message repeated 10 times ---
Pageouts (MiB): 1723
Extrinsic daemons
   com.adobe.fpsaud
launchd items
   /Library/LaunchDaemons/com.adobe.fpsaud.plist
   (com.adobe.fpsaud)
Extrinsic loadable bundles
   /Library/Internet Plug-Ins/Flash Player.plugin
   (com.macromedia.Flash Player.plugin)
   /Library/PreferencePanes/Flash Player.prefPane
   (com.adobe.flashplayerpreferences)
User login items
   iTunesHelper
Restricted user files: 20870
Elapsed time (s): 100
Now my approach is to try to get the June 10th backup folder from Time Machine Backups, which was not available to see from my MacBook Air last week, but now it seems visible, try to go back there in TimeMachine, and restore and override the new installs or any other.  I think mail will reload the last week and everything is going to be there.  Then I have to go back uninstall MacKeeper and other things if there is using The SafeMac.com instructions, to get around the permission issues.  I will not copy the Applications and other folders. 
IF it works, it's like there was no reason to buy this backup hard disk.  I wasted one week.
I will let you know if anything goes wrong...

Answer 1

Some of your user files (not system files) have incorrect permissions or are locked. This procedure will unlock those files and reset their ownership, permissions, and access controls to the default. If you've intentionally set special values for those attributes, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it, but you do need to follow the instructions below.
Back up all data.
Step 1
If you have more than one user, and the one in question is not an administrator, then go to Step 2.
Enter the following command in the Terminal window in the same way as before (triple-click, copy, and paste):
sudo find ~ $TMPDIR.. -exec chflags nouchg,nouappnd {} + -exec chown $UID {} + -exec chmod +rw {} + -exec chmod -N {} + -type d -exec chmod +x {} + 2>&-
This time you'll be prompted for your login password, which won't be displayed when you type it. Type carefully and then press return. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.
The command may take several minutes to run, depending on how many files you have. Wait for a new line ending in a dollar sign ($) to appear, then quit Terminal.
Step 2 (optional)
Take this step only if you have trouble with Step 1, if you prefer not to take it, or if it doesn't solve the problem.
Start up in Recovery mode. When the OS X Utilities screen appears, select
Utilities ▹ Terminal
from the menu bar. A Terminal window will open. In that window, type this:
res
Press the tab key. The partial command you typed will automatically be completed to this:
resetpassword
Press return. A Reset Password window will open. You’re not going to reset a password.
Select your startup volume ("Macintosh HD," unless you gave it a different name) if not already selected.
Select your username from the menu labeled Select the user account if not already selected.
Under Reset Home Directory Permissions and ACLs, click the Reset button
Select
 ▹ Restart
from the menu bar.