Is there something wrong with my mini?

Question

Is there something wrong with my mini?

I noticed a couple of problems on my mac, and I think I got infected by malware. On my Keychain, I also saw that there are name's I'm not familiar with like Engram, AutoUnlock, Health, Manatee, Home, LimitedPeersAllowed, octagon-com.apple.security.keychain, SOSDataSource-ak.

I first noticed this when I checked my mail and found that I sent a malicious email to test@gmail.com:

And then my activity monitor started showing unusual processes - I always check the activity monitor because I understand that I only have 8GB Ram:

Then the other day, com.apple.preferences.network.remoteservices quit unexpectedly:

One keychain name that stuck to me was com.apple.account.iTunesStore.rpassword and I couldn't find anything about it on google and duckduckgo

And while I was checking the devices connected to my applied earlier, cdpd crashed.

I ran etrecheck earlier to check what's wrong but some of these don't make sense to me so I don't think theres something wrong with this. I just want my peace of mind back.

Etrecheck report

Mac mini, macOS 10.15

Posted on Oct 5, 2020 10:11 AM

Reply

Answer 1

BDAqua

Level 10

250,253 points

Oct 6, 2020 6:48 AM in response to strongarmstudio

See if you have unknown Profiles.

To remove a configuration profile in macOS:

From the Apple menu, select System Preferences....
From the View menu in System Preferences, select Profiles.Note:
Profiles won't be visible until you have at least one profile installed.
Select the profile you want to remove, and then press the - (minus) button. Click Remove to remove the profile.

Uninstall CleanMyMac per their directions , then run etrecheck again to see what chaff it left...

On CMM…

https://discussions.apple.com/thread/251370955?answerId=252661013022#252661013022

https://discussions.apple.com/thread/251442443?answerId=252814053022#252814053022

https://discussions.apple.com/thread/251464557?answerId=252841819022#252841819022

Reply

Answer 2

Oct 8, 2020 5:29 AM in response to BDAqua

Yeah no traces anymore of CMM & macpaw. I did a follow up on etrecheck after following what you've suggested.

I also ran Disk Utility in Mac Recovery and Encrypted the Firmware. But I downloaded VirusTotal to scan all my PDF's in case some malware was able to sneak in. And I blocked all incoming connections in Security & Privacy -> Firewall tab - is that ok?

The weird keychain stuff are now gone. But there are still some items on the keychain that I'm not familiar with like the unknown that's from LaunchServices device identifier base secret

Next, what's the best way to remove a kext? I have to uninstall Telestream since I won't be using Screenflow for a while.

Lastly, I need help in configuring a profile. I couldn't create one so I can't see if there's a profile on the System Preferences -> Profiles. Could you link me to a guide?

I feel bad for myself for paying for a premium plan of CMM.

Reply