How to Remove a Suspicious Cron Entry on macOS

Applies to: macOS (all versions)
Skill level: Beginner
Time required: ~5 minutes

Background

Malware and potentially unwanted applications (PUAs) will create a scheduled task (called a "cron job") on the Mac to automatically execute the malware/PUAs. These tasks should be removed as part of the remediation process.

The malicious entry will look similar to this, though the exact command will differ:

/bin/sh -c /Users/user/Library/Application\ Support/40B02B38-9EA8-422A-8896-C8070BCD2E6B/1340F28F-ECDA-48CA-9D18-E6F3ABB144B0 h >/dev/null 2>&1

What is a crontab?

A crontab is a hidden list of scheduled tasks your Mac runs automatically, usually silently in the background. Legitimate software sometimes uses cron jobs, but malicious software can also add entries here to run itself repeatedly — even after you think you've removed it.

Steps to Take

⚠️ Important — Run these steps as the correct user

Each user account on a Mac has its own separate crontab. All steps in this guide should be carried out while logged in as the user where the malicious crontab entry was found. If you are logged in as a different account (for example, an administrator account), the commands will either show an empty crontab or affect the wrong account entirely.

To confirm which account you are currently logged in as, open Terminal and type `whoami` then press Return. The output should match the username included in the incident report.

Step 1 — Open Terminal

Terminal is the application you use to type commands directly to your Mac.

1. Press Command (⌘) + Space to open Spotlight Search.
2. Type `Terminal` and press Return.
3. A window with a text prompt will open. This is normal.

Step 2 — View Your Current Crontab

Type the following command and press Return:

crontab -l

Your Mac will display your current list of scheduled tasks. Read through the output carefully before proceeding.

Note: If you see the message `no crontab for [your username]`, the entry may have already been removed. You can skip ahead to Step 6.

There are two possible situations. Find yours below and follow the matching path.

Step 3 — Determine Which Path to Take

Look at the output from Step 2 and ask: Is the suspicious entry the only line in the file, or are there other lines too?

Lines that are blank or that start with `#` (a comment) do not count as real entries — ignore those when making your decision.

Path A — The suspicious entry is the ONLY real entry → Remove the entire crontab file

This is the simpler option. Because there is nothing else worth keeping, you can delete the whole crontab file in one command.

Type the following and press Return:

crontab -r

There will be no confirmation message — that is normal. The entire crontab file has been removed.

Verify it is gone by typing:

crontab -l

You should see `no crontab for [your username]`. That confirms the file has been deleted. Skip Path B and continue to Step 4.

Path B — There are OTHER entries in addition to the suspicious one → Edit the file to remove only the bad line

Because the other entries may be legitimate, you need to remove only the suspicious line and leave everything else in place.

B1. Open the crontab editor.
Type the following and press Return:

crontab -e

This opens your crontab in a text editor called vim inside Terminal. The screen will change to show your scheduled tasks as lines of text.

Important: Vim has two modes — a *navigation mode* and a *typing mode*. When you first open it, you are in navigation mode. Follow the steps below carefully and do not start typing until instructed.

B2. Find the suspicious line.
Use the arrow keys to move the cursor to the line containing the suspicious entry — the one with `40B02B38` or `1340F28F` in it.

B3. Delete the entire line.
With the cursor anywhere on that line, type:

dd

Press `d` twice quickly, without pressing Return. The entire line will disappear.

B4. Verify the line is gone.
Scroll through the remaining lines and confirm the suspicious entry is no longer present. All other entries should still be there.

B5. Save and exit.
Type the following exactly and press Return:

:wq

The colon (`:`) switches to command mode, `w` saves the file, and `q` quits. You will return to the normal Terminal prompt.

If you make a mistake and want to exit without saving, type `:q!` and press Return to discard your changes, then start from B1 again.

B6. Confirm the edit.
Type the following and press Return:

crontab -l

The suspicious line should no longer appear, and your other entries should still be present.

Step 4 — Remove the Malicious File

The cron job was pointing to a file hidden in your Library folder. You should delete that file as well.

1. In Terminal, type the following and press Return:

rm -rf ~/Library/Application\ Support/40B02B38-9EA8-422A-8896-C8070BCD2E6B

This removes the entire folder containing the malicious executable.

2. Confirm it is gone by typing:

ls ~/Library/Application\ Support/ | grep 40B02B38

If nothing is returned, the folder has been successfully deleted.

If you run into trouble at any step, stop and contact your IT support team before proceeding.