Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Two-Word Magnifying Glass Malware

On March 4, 2019, user UpinthClouds reported in the discussion '"general net search" app ????' that they accidentally downloaded a malware app named 'general net search', using a 'green magnifying glass icon'. He noted that it repeatedly popped up when using another app.

LeeFox1 had a near-identical problem, reported on October 1, 2019, in the discussion 'Safari Virus with MacbookPro'. Going into more extensive details, LeeFox1 overviews how they have encountered multiple suspicious problems over that week. They say that each time, they '[got] a pop-up saying that Apple wants to make changes and requests [their] password'. They clicked cancel twice. They state that Safari launches along with a mysterious app - with the same icon - and an installation pop-up appears, with the only option being 'OK'. Instead of clicking it, they restarted their computer as their cursor was not functioning and then force-quitted Safari and the app, which variously was named 'ProductEvent.app' and 'ProcessSave.app'. They deleted it but it kept occurring. They believe that it is the same problem UpinthClouds is experiencing.

I may have unknowingly downloaded the software. I live in Indonesia. What I call the 'attacks' (they are too periodic and yet a few minutes early or late to be purely automatic) happen almost daily, around evening, WIB, though a few times they have happened in the morning too. With me, the attacks are more discreet - there is no password-asking, but the Safari extensions window is opened along with the main window. Then Safari is somehow opened again, as a separate app. I see that same cursed icon in the extension list. I click uninstall, and seeing that it is part of an app, click the 'View in Finder' button. I see an application with the icon, the only thing in a folder of the same name. I always delete it fully, but rearguard reopenings occur for a minute or so until they fully stop.

The first time I was hit, it was dubbed 'OptimalSync', and it has always changed its name to a similar name like...dammit, I can't remember any other ones, but it always has three or more syllables in the first word and two or less in the second. It's always vaguely tech-sounding. One of the second words was 'Fraction'.

I did some Finder sleuthing after today's attacks and found four group folders in a directory buried somewhere in the depths of my main disk. Like all the other ones, they were zero-bytes, but the names all included words that had once been names of the magnifying-glass malware. I deleted them instantly, and I think it may have helped. But like always, I expect that it'll reinstall on its own.

Here is a self-made approximation of the icon:

Is anyone else experiencing this? Is this remotely initiated by a human? And is there a free, permanent solution?

MacBook Air 13″, macOS 10.15

Posted on Aug 23, 2020 4:34 AM

Reply
Question marked as Best reply

Posted on Aug 23, 2020 5:29 AM

You installed Adware by trying to install some other software you got from an unsafe source.

Try EtreCheck to remove the Adware.

https://www.etrecheck.com/

If it can’t remove it, then try MalwareBytes Anti-Malware for Mac.

https://www.malwarebytes.com/mac/


Only download software directly from the developer’s website or the App Store. Any other source will likely be bundled with Adware.

Similar questions

1 reply
Question marked as Best reply

Aug 23, 2020 5:29 AM in response to yeeeeetatos

You installed Adware by trying to install some other software you got from an unsafe source.

Try EtreCheck to remove the Adware.

https://www.etrecheck.com/

If it can’t remove it, then try MalwareBytes Anti-Malware for Mac.

https://www.malwarebytes.com/mac/


Only download software directly from the developer’s website or the App Store. Any other source will likely be bundled with Adware.

Two-Word Magnifying Glass Malware

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.