Seeking help: Malware bugs ‘fseventsd’ & Root Files

Hi all. First time poster so please be gentle ….. Firstly I’ll start by saying my knowledge with computing and path files and strings etc is very basic. Hence this post.

The last few weeks have seen my humble vintage MacOS Ventura compromised remotely and my identity and 900 other files taken. Since then it’s been a computing and technology nightmare after what I suspect to be Root File Malware inserted in the Mac. After spending a lot of time, cash and effort trying to fortify our systems the Malware still seems to respawn and comeback meaner and angrier. For example today it was reconfiguring and disabling Xprotect and crippling numerous other functions and apps. Further examples are changing settings and notifications in Antivirus apps and others, changing permissions, disabling functionality and crippling performance. I’m also suspect of keylogging but have not much of an idea how to prove it. I’m at my wits end, seeking some assistance with how to eradicate the bugs. Attacked a snippet of the activity centre from today, have numerous other logs with bug names like ‘nsurlsessiond’, ‘warmd, ‘libthaitokeniser’ and ‘well played’ which all end up back in dylib after getting 700 odd samples. I assume these samples go out the backdoor somehow adter recently discovering the lsof command.

I’m truly lost as to how restore some normality in my vintage Mac, seeking help. Thanks so much for your time.

iMac 21.5″ 4K

Posted on Jan 1, 2025 3:52 AM

Reply
Question marked as Top-ranking reply

Posted on Jan 1, 2025 7:22 AM

User wrote " Antivirus apps and others "


Not popular for some


Part 1 of 2


Once this types of softwares are installed and embedded into the computer 


Start Over from Scratch 


Heavy Handed - Yes ?


You can spend hours or days hunting down all the bits and pieces of this software and never really get it all off the computer


Effective in removing the AV Software - Yes 


For Apple Silicon computer >> Use Disk Utility to erase a Mac with Apple silicon.


For Apple Intel computers >>   Use Disk Utility to erase an Intel-based Mac followed by How to reinstall macOS


Always make a Time Machine Backup  before  proceeding 


If going this route - I suggest Not using Startup Assist to migrate everything back.


This will probably Re-Introduce ( Antivirus apps and others ) back into the Operating System 


Part 2 of 2


Windows-like viruses that self-replicate and affect macOS don’t exist because of the underlying UNIX Foundation and permission limitations.


The macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications. Full Stop.


Mac app security enhancements are sufficient to protect computers from malware.



Adware and malware can affect computers and are often downloaded from “shady” websites or developers who inject them into downloads.


Source: User Tip from @Kurt Lang


What is malware? - Apple Community


Similar questions

4 replies
Question marked as Top-ranking reply

Jan 1, 2025 7:22 AM in response to DaJod25

User wrote " Antivirus apps and others "


Not popular for some


Part 1 of 2


Once this types of softwares are installed and embedded into the computer 


Start Over from Scratch 


Heavy Handed - Yes ?


You can spend hours or days hunting down all the bits and pieces of this software and never really get it all off the computer


Effective in removing the AV Software - Yes 


For Apple Silicon computer >> Use Disk Utility to erase a Mac with Apple silicon.


For Apple Intel computers >>   Use Disk Utility to erase an Intel-based Mac followed by How to reinstall macOS


Always make a Time Machine Backup  before  proceeding 


If going this route - I suggest Not using Startup Assist to migrate everything back.


This will probably Re-Introduce ( Antivirus apps and others ) back into the Operating System 


Part 2 of 2


Windows-like viruses that self-replicate and affect macOS don’t exist because of the underlying UNIX Foundation and permission limitations.


The macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications. Full Stop.


Mac app security enhancements are sufficient to protect computers from malware.



Adware and malware can affect computers and are often downloaded from “shady” websites or developers who inject them into downloads.


Source: User Tip from @Kurt Lang


What is malware? - Apple Community


Jan 1, 2025 2:34 PM in response to DaJod25

Factory Resetting the Mac is the way to go. Do not use any AntiVirus as they are worthless and the only thing you will see are false positives.


Nothing in the log files show anything nefarious. Everything you see there is normal and the keywords you are concerned about are seen on all devices and part of the OS. Frankly, you will not find anything useful in the log files. Anything logged there is done by the engineer of the process and they have coded it to print that exact message. In no way is a nefarious process going to logging exactly what they are doing.


You will find much more scary words in the log files that are also perfectly normal and only lead people down a rabbit hole they can never find an exit for. Some of the other phrases you can expect to see are "Roots Installed", "Pegasus", "Remote Access", "Crypto", and "Stingray" to name a few. They do have a meaning to the Engineer that logged the message, but nothing you may think it is. The most famous log message where users felt like they were hacked said "Goodnight, Gracie". The Engineer was making a humorous reference to a George Burns movie in the log and users were convinced when they saw it that someone named Gracie had hacked their computer.


The only purpose for the log files are to send to Apple Engineers if they request them after opening a Support Ticket. They use specialized decoders to make some sort of sense out of them.

Jan 1, 2025 7:19 AM in response to DaJod25

At least as far as I can tell, there is nothing in your screenshots to suggest any form of malware.


When you are looking at logs and samples such as those you are posting, you are bound to find many many many things that you and I don't understand.


Rather than trying to make sense of these logs, perhaps you can tell us why you thing you have been hacked. While not an impossibility that macs be hacked, in most cases we see here, it turns out to be the user's fear of being hacked.


This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Seeking help: Malware bugs ‘fseventsd’ & Root Files

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.