“qnmqkmkrqwfq” is damaged and can’t be opened , even though i set Allow applications downloaded from: Anywhere

Question

i just finished updating my Macbook pro to macOS Catalina and after the installation finished i got this error message that keeps reappearing. i do not know or have a file named "qnmqkmkrqwfq" (i tried searching for it) and when i press show in finder or ok it disappears for a second and then pops up again for no reason and i am not trying to open any files or apps. i searched and the only solution i found was setting "Allow applications downloaded from: Anywhere" but it did not work. Please Help.

Answer 1

The first step is to run all Apple software updates since this appears to be malware or adware and Apple will block that if it’s prevalent or spreading.

The name is generated, so your Mac might have a different inscrutable name popping up. (e.g. urhsuneqbbth, geohxjhmvzab, qnmqkmkrqwfq, or jjfnurchyhas )

This isn’t likely a harmless error, so I would connect a new drive and back up your critical files (keeping any older backups safely offline) and then boot to internet recovery and reinstall the OS, run Disk Utility to check for filesystem errors.

When that’s done, you want to scan for malware with a tool like Malwarebytes for Mac.

• the name is suspicious unless you know why you’d have an app named that
• It launching itself is suspicious
• It’s not being indexed by spotlight is suspicious

I would also disable all apps not signed and apply any security patches you don’t have as well if you can or don’t want to run the reinstall today to buy a little extra security from any new apps that get installed or downloaded. The ones that ran before won’t be stopped, but it’s looking less likely this is just a corruption of your OS and one bad app.

If you can get the finder window open, control click and show package contents and consider uploading the file to https://www.virustotal.com/gui/home/upload if you’re not comfortable using terminal to type the command file and drag the bookmark “file” into the terminal window to check if the file is deceiving you - named like a text file but actually a program.