Possible Malware?

The other day I heard laughter and a voice speaking, saying “This b**** is so f-ed” on my Mac (no clear source). I later noticed a failed log-in attempt to my email from a different ip address.

I worry I might have some malware or a RAT on my mac.


Looking at my launchagents they all say to have been modified on the same day and time. Is that normal?

Are any of these plists a cause for concern?



Additionally, processes like Windowserver are using a lot of memory and cpu in my activity monitor - if I look under otheruserprocesses not my processes.

Prevously processes like MDNSresponder and kernel task, as well as remotemanagementmd were also quite active under all processes. But I’ve currently disconnected the mac from the internet.

There is also a process under cpu called appleh13camerad which I don’t recognize.

MacBook Air 13″, macOS 13.3

Posted on Apr 16, 2023 2:52 AM

Reply

Similar questions

10 replies

Apr 16, 2023 5:25 AM in response to nickkick99

Windowserver always uses a lot of memory as compared to other Apple processes. You can run the free app Malwarebytes to check and remove any possible malware. You can also run the free app Etrecheck that will provide more info on any processes that are running and possible locations. You can post the report here for analysis. It will not show any pers. info.

Apr 16, 2023 10:45 AM in response to nickkick99

All of the agents you list are in the System folder. No one but Apple can touch anything in this read only section of the drive. So, not only were they installed by Apple to begin with, it's impossible for any third party app to alter them.


Per tbirdvet's post, also run EtreCheck and post the results here. All personal info is automatically redacted from the output.


https://etrecheck.com/en/index.html

Apr 16, 2023 1:28 PM in response to nickkick99

A lot of folks don't like to hear this when your fellow users here say it, but the Norton garbage on your Mac is not helping you one bit. It's only succeeding in bogging down your system doing nothing useful.


The main point here is there are no Mac viruses. None. Nada. Zip. Such self-replicating malware can't function on a Unix based OS. The permissions underlying macOS prevents such software from doing whatever it wants without asking.


That doesn't mean there's no Mac malware. But what there is are all Trojans. This is any type of malware you must be tricked into installing. It can't get on your Mac by itself. AV software like Norton (or any of them) can't help you since they can't know what it is you're installing or launching until after the fact. And even then, they rarely tell the user they've just installed malware.


All AV software is truly useless. MalwareBytes is the only similar title experienced Mac users here will suggest. It's main function is to try and find, then remove adware or malware you've already installed. Not attempt to prevent it.


Where did the audio come from? Good question. I can't even find a reference to it with a Google search. But Norton clearly didn't do anything about it.


What is does sound like is someone knows enough about your email account that they tried to guess your password to access it. Still doesn't explain the audio, though.

Apr 16, 2023 1:51 PM in response to nickkick99

Very much agree with Both previous contributors


Just to add a point of reference


Any of the below should be removed as per Developers Instructions 


Third Party Security Software  by any name of Brand


This will included Norton Antivirus 


Read some of the posting and arrive at your own conclusions.


As for Malware, if installed on this machine.


It would only effect the User Account on which it was installed and not Other Part of the Operating System


Additionally, in macOS 11 Big Sur, macOS 12 Monterey and macOS 13 Ventura. 


The Operating System resides in a Sealed and Read Only Volume that can not be opened by the User nor by Third Party Applications.


The only Entity that can open and modify or alter this Volume is Apple.


That would occur when a update or UpGrade is performed.


The Only thing this Antivirus software is protecting is the Bank Account of the Developers and for zero return to the User aside from the problems this software creates.


AntiVirus Developers purposefully Market their product to create a “ Fear Factor “. In so doing, creating a False Need for their Product.


The The Built in Security  is all that is required to protect the computer.

Apr 16, 2023 1:42 PM in response to Kurt Lang

Thank you for taking the time! I’ve heard a lot of criticism for Norton on Mac, and I’ll admit the main reason I have it is to scan rather than to block.

Is it reasonable to think that since MalwareBytes didn’t find anything - short scan though it was - there’s no really strong reason to wipe the computer? Because I had been considering it, but since I (stupidly) haven’t backed up my files I’ve been hesitant to do it unless I had more proof there was something wrong.

Really, the voice was very strange but in a sense it was such a one-off I think I might just be paranoid here.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Possible Malware?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.