Self Installing Google Malware

Question

Level 1

12 points

Self Installing Google Malware

Good day! In the interest of the current 48 state anti-trust probe...

There is some kind of Google malware that installs and continuously re-installs itself onto my mac.

Just yesterday, I had to delete its folder and supporting folder at least 5 times. Malware Bytes and Sophos do not acknowledge, nor do they quarantine the folders, so I am not certain if it is malware, adware, or what. But I don't want it.

The browser that I use is Safari, I do not have Google Chrome installed on my mac, yet, somehow, I suspect through this Google Remote Config function, Google also installed 2 of its extensions onto my Safari browser a couple of days ago! I caught it after a day or so and I deleted the 2 extensions' folders, but I am still having to clean these self-installing Google Remote Config folders several times a day.

Can someone give me some advice on what this folder is, and how to block it from reinstalling itself?

I have also considered that this may be a hacker installing/reinstalling this folder as well - as i have experienced major privacy issues with Google platforms in the past. Thus the reason that I do not use Google platforms or products.

Any feedback? Thanks so much

MacBook Pro 13", macOS 10.14

Posted on May 19, 2020 10:29 AM

Reply

Answer 1

vintageNY Author

Level 1

12 points

May 20, 2020 7:04 AM in response to vintageNY

How interesting...

Could this SIGKILL command have been executed by a hacker? I wonder who could be this concerned with disabling my VPN daily? It's a good thing that I am duplicating all of my system logs when my computer is accessed via this Google remote hack.

Reply

Answer 2

vintageNY Author

Level 1

12 points

May 19, 2020 5:42 PM in response to vintageNY

Hello!

The Google Remote Configuration folder reinstalled itself at 8:34, and whoever is accessing my computer using this function immediately disabled my VPN. Here is the code that they used to disable my VPN software. Any thoughts?

:Jx86_64R)1:384383282656:ios:99888df9fbb08cb5990f85bcom.nordvpn.osxÄí60605000†®≤10.14.6»–ÿ‚

11E146-19E258Ë˙ôapple-platform/macos apple-sdk/19E258 fire-abt/3.2.0 fire-db/6.1.4 fire-iid/4.3.2 fire-install/1.1.1 fire-ios/6.6.5 fire-rc/4.4.8 swift/true xcode/11E146à†

Reply

Answer 3

vintageNY Author

Level 1

12 points

May 24, 2020 11:50 AM in response to vintageNY

Good day!!

So I am in touch with NordVPN's customer and technical service, and I have made them aware of my recurring issue with their software.

I have also found that there is a file that has been installed onto my computer that indicates that Google's Firebase app is interfacing with the NordVPN software. So I have deleted the NordVPN app and I do not plan to renew the subscription. I am now trying another VPN.

My concern is whether Google is getting away with this on the computer's of many user without their knowledge.

Again: I have no Google software on my mac, I do not use Google as a search engine. Unwanted, I am considering this re-installing Google interface that attaches itself to functioning software to be malware.