Was able to clean the malware after following a couple post etc etc. Before you start, download Find Any File from the app store. This is a free utility allowing you to search the system files (among others) through a GUI interface. Also it allows you to easily delete the files too.
Note: your malware may have different file names, however, the resource locations should be the same.
Then try the following (credit to Linc Davis linc davis profile):
Step 1:
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2 (or use Find Any File search bar):
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected.
Drag the selected item to the Trash. You may be prompted for your administrator login password. Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Step 3:
Restart the computer and empty the Trash.
Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
I had to do the following in addition to Linc D. above. Your situation may have different name, but the process and where the malware files are located will likely be the same.
Step 1:
sudo rm -f ~/Library/Cookies/Cookies.binarycookies
enter password
Step 2:
Select Clear History and Website Data from Safari menu; click Clear History button in dialog box. This resets Safari
Step 3:
Then force quit Safari from the context menu by clicking Cnt + icon in the dock.
Step 4:
Finally, fully power down (Shut Down not Restart) the machine and then restart.
Best Answer
Based on the error message, it sounds like MobileDevice.Framework is necessary for iPhoto (probably because of its ability to pull photos from a mobile device.) I'm inclined to believe that since it's crashing at launch, this library needs to be loaded at start time. While it might be possible to maintain two different versions in a separate location, figuring out how to point each application to the right version really doesn't seem like the best idea to me. My recommendation would be one of the following: