mixbuilder application and safari extension???

I was working on my computer when all of a sudden a window opens indicating something was installed and I was to click ok. However, the cursor was locked up and I had to shut down my computer. There was also something about a Safari extension called MixBuilder. When I restarted the computer, I found an extension in Safari and an application installed called MixBuilder. I deleted both. Has anyone else run into this?

MacBook Pro 15", macOS 10.14

Posted on Apr 23, 2019 2:45 PM

Top-ranking reply

elHw

Level 1

10 points

Posted on Apr 27, 2019 7:16 PM

I too experienced the same download, cursor freeze up, need to restart my computer, Safari launching with my normal extensions missing/deactivated. I immediately looked into Safari prefs, found my extensions deactivated and the mixbuilder extension activated. As this was not what I had in mind, I unchecked mixbuilder and rechecked my usual extensions. Once that was done I wanted to see if my extensions functioned as usual, signed into the main application for the first extension, and was asked to change my password. I checked that I was in the appropriate application and not some fabricated look alike. Once secure that that was my site, I changed the password. I then went to apple.support, in search for chat help on my Safar problemi. The chat helper invited me to download a malware app. and run it. (This was a free trial). I did as asked, and within 5 minutes or so, had the culprit mixbuilder with addition 6 or 7 items quarantined, with option to see what they were, and then to delete. They are no longer residing on my computer, and I am again a happy camper. Thank you APPLE-CHAT Support.

A strange coincidence in my application folder is another app called "ExpertFirstExtension.app" which has the very same icon as mixbuilder. I have not yet ruled out whether these two are related in some fashion. They are similar in their limit of Internet information.

The malware app I was invited to try is called "Malwarebytes.app". It instantly found mixbuilder, and additional items, but did not call into quarantine or question "ExpertFirstExtension". If anyone knows what "ExpertFirstExtension" is or does, please leave a note.

View in context

Similar questions

33 replies

swstl

Level 1

4 points

Apr 24, 2019 9:01 PM in response to sarahfromranchos

FYI: I opened and email Subject title (Domain Service) Final notice. I opened the email, and then the cursor froze up etc. Here is the header of email:

Return-Path: <****>

Delivered-To: ****

From info@nckiwebdesign.gdn Wed Apr 24 15:46:19 2019

Return-Path: <****>

Delivered-To: ****

Received: (qmail 25490 invoked by uid 89); 24 Apr 2019 15:46:19 -0000

Received: by simscan 1.2.0 ppid: 25466, pid: 25472, t: 1.2462s

scanners: attach: 1.2.0 clamav: 0.96.5/m: spam: 3.1.4

X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on

qsmtp001.serverphase.com

X-Spam-Level:

X-Spam-Status: No, score=-4.6 required=10.0 tests=DATE_IN_PAST_24_48,

HTML_MESSAGE,HTML_TAG_EXIST_TBODY,MIME_HTML_ONLY,UNPARSEABLE_RELAY,

USER_IN_WHITELIST_TO autolearn=disabled version=3.1.4

Received: from unknown (HELO mail.bbsar.org) (42.231.163.42)

by qsmtp001.serverphase.com with SMTP; 24 Apr 2019 15:46:18 -0000

Received-SPF: pass (qsmtp001.serverphase.com: SPF record at nckiwebdesign.gdn designates 42.231.163.42 as permitted sender)

dkim-signature:v=1; c=relaxed/relaxed; h=to:subject:message-id:date:from:reply-to:mime-version:list-unsubscribe:content-type:content-transfer-encoding;

d=nckiwebdesign.gdn; s=default; a=rsa-sha256;

bh=Byi8ptHQuJHoBg1F1BJPgQYTO8fRaPbsJxRP7chCW18=;

b=E2XXtj5+kjoZ0oFPvjyJF3AQ2deuwERKAMtSdS/3gMl5Gm0YiUlRELTFlyxJNtySe

18W7CepIN7lu6hkG64WHLNtCoweCK94/n+evjpHGhsA206ScFeBZVNGDPR/T8ZVYtDM

CmVZCS9t0gaEVC1OCQq//uzbnKfNBzNldu+xuM8=;

Received: from ([127.0.0.1]) with MailEnable ESMTP; Wed, 24 Apr 2019 08:46:07 -0700

To: ****

Subject: malletshop.com Final Notice

Message-ID: <cbde887c4543a41bd9ef9f33f86632ea@px021.nckiwebdesign.gdn>

Return-Path: ****

Date: Tue, 23 Apr 2019 05:42:43 -0400

From: "Domain Service" ****

Reply-To: ****

MIME-Version: 1.0

X-Mailer-LID: 35

List-Unsubscribe: <http://px021.nckiwebdesign.gdn/em/unsubscribe.php?M=1048030&C=4f700bc45ebcb1cc139e0c3550bb2f54&L=35&N=29>

X-Mailer-RecptId: 1048030

X-Mailer-SID: 29

X-Mailer-Sent-By: 1

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit

X-ME-Bayesian: 0.000000

[Emails Edited by Moderator]

Apr 30, 2019 6:20 AM in response to MadMacs0

How can you tell where it came from by looking at browser history? What do you look for?

I should mention that since I removed the application (moved to trash) and the extension (clicked uninstall in Safari preferences/extensions), I have had no further occurrences. (I also removed the 2 pieces of adware identified by EtreCheck.)

Further edit: I just looked at my history. Just in time because I have my settings to clear after 1 week and therefore had no history beyond the day mix builder manifested. That day there were no strange websites, only legitimate ones (such as the website of one of our utilities).

elHw

Level 1

10 points

May 13, 2019 6:41 AM in response to elHw

Does anyone have "ExpertFirstExtension.app" on their computer, know what it is, why it is...any info at all???

I found no further reference or extension of "mixbuilder" on my computer after using Malwarebytes.app. HOWEVER...

I continue to question the presence of "ExpertFirstExtension.app" appearing in my app folder as of Jan 8th 2019. I did not download it, and am the only user on this computer.

This morning I checked my Safari extensions, and found an extension for "ExpertFirstExtension 1.0".

I don't know what it is, and am quite suspicious as it's icon is the same as "mixbuilder" and it is now starting to behave like mixbuilder, by adding the extension I did not approve.

I searched the internet for any info on this app, and found NOTHING AT ALL, which feeds my suspicious.

The only reason I have not deleted it is that I am not sure the app isn't an intended part of the Mojave OS system, or some important item.

I ran Malwarebytes.app. which reports NO problem.

Info on this possible intruder is appreciated.

Apr 24, 2019 8:45 AM in response to dominic23

Sarahfromranchos I have the same issue! Have you tried what Dominic 23 suggested and did it work?

dominic23

Level 10

84,018 points

Apr 25, 2019 3:29 AM in response to MadMacs0

If you could post step by step instructions for uploading the extension, it would be helpful.

Best.

Apr 25, 2019 6:38 AM in response to swstl

As far as I can remember, I opened no strange emails or visited any questionable websites at or near the time that this incident occurred.

Apr 29, 2019 6:00 PM in response to sarahfromranchos

I have a virus that keep popping up macOS.mix builder.1.r

Apr 24, 2019 10:29 AM in response to dominic23

2nd set of report