MacBook Pro Hacked from bootcamp windows

Hello All,


I was on windows and downloading & installing 7zip.


After installing I feel something wrong happen some strange popus some strange behaviour in browser. browser was closed and default serch engine was closed.


It seams that I downloaded some enfected app I was even not able to trace what url I download as I was not careful before.


After I leave windwos and back to Mountain Lion. I noticed that Launcher took more then usual time.


And when I open my chrom browser it's default search engine was changed to Conduit Search "http://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&Sea rchSource=58&CUI=&UM=2&UP=SP6C3AE6B3-DF32-4307-9FB5-8FA6CD32EDF8&q=%s"


Same as windows.


Also some other search engine added in list like

"http://mixidj.delta-search.com/?q=%s&babsrc=SP_ss&mntrId=04A05C5948CD65F0&affID= 123187&tsp=5023"

"http://search.qvo6.com/web/?utm_source=b&utm_medium=oneinstaller&utm_campaign=eX Q&utm_content=ds&from=oneinstaller&uid=HitachiXHTS727575A9E364_J3790084G673EGG67 3EGX&ts=1380682230&type=default&q=%s"


So it looks my macbook is hacked. But not sure on which level. Is my keystroke is also being traped ?


What action should I take next ?


Should I reinstall all OS ?


& What is safe way to avoid this situation in future ?



Thanks & Regards


Piyush Verma

MacBook Pro, OS X Mountain Lion (10.8.5)

Posted on Oct 1, 2013 8:45 PM

Reply
6 replies

Oct 1, 2013 9:01 PM in response to piyushverma

You could try using something like Sophos to run a virus scan on your mac.

There are similar virus checking apps for Windows.

I suppose if I were really concerned about it I would just erase everything and reinstall OSX.

Personally I can't stand Windows and I wouldn't have it on my computer.

But: if you want to have Windows on your machine, the first thing I would install on it is a Windows antivirus program. And then I'd install Sophos on my mac. And I would also install LIttle Snitch on my mac to prevent any spyware from phoning home.

Oct 1, 2013 11:10 PM in response to piyushverma

You installed the Conduit spyware. To remove it, back up all data, then follow these instructions.


If the instructions don't work, proceed as follows.



Triple-click the line below on this page to select it:


~/Library/Application Support/Conduit


Copy the selected text to the Clipboard (command-C). From the Finder menu bar, select


Go â–č Go to Folder



Paste into the box that opens (command-V), then press return. A Finder window should open with a folder named "Conduit" selected. If it does, delete the selected item.


Repeat with this line:

/Applications/Toolbars

Now you're deleting a folder named "Toolbars". You may be prompted for your login password. Next, copy this line:

/Library



Select Go to Folder
 again and paste. Don't delete the Library folder. Delete only the following items inside it, if they exist.



  • Application Support/Conduit
  • InputManagers/CTLoader
  • LaunchAgents/com.conduit.loader.agent.plist
  • ScriptingAdditions/ct_scripting.osax
Close the Finder windows you opened. Log out and log back in.

I've seen a report that Conduit may be bundled with a scam "utility" called "MacKeeper." If you installed MacKeeper, you should remove it according to the developer's instructions. It's worthless and causes many problems reported on this site.

Oct 2, 2013 12:13 AM in response to Linc Davis

Hi Linc Davis,


Thanks for very detailed explanation.


Unfortunetly Conduit is not found in suggested path.


I feel it's installed more complicated way from windows. Might be some how mac partetion and mounted and file system updated.


This is really worst thing about unix system. it's totaly unsecuired if booted from other source.


I think se a while if not strange activity then continue to use it else reinstall all.


Besides would it be possibel to trace if some app watching key event or not ?


Regards


Piyush Verma

Oct 2, 2013 12:19 AM in response to arthur

Hi Arthur,


Thanks for reply.


You could try using something like Sophos to run a virus scan on your mac.

>> I really don't like anti virus that is one of the reason to use Unix based OS. Besides I can find Sophos inside appstore will that be reliable ?


There are similar virus checking apps for Windows.

>> Window I just use for testing so I can reinstall it.


I suppose if I were really concerned about it I would just erase everything and reinstall OSX.

>> ya that would be last option. as that is not a easy thing.


Personally I can't stand Windows and I wouldn't have it on my computer.

>> I also. But unfortunately customer us windows and as developer I need to test some app on windows.


But: if you want to have Windows on your machine, the first thing I would install on it is a Windows antivirus program. And then I'd install Sophos on my mac. And I would also install LIttle Snitch on my mac to prevent any spyware from phoning home.

>> Again I avoid strange app. but anti virus really slow down windows which already very slow and make impossible to work 🙂 . I check for Little Snitch which looks protecting aginst internet. and in case of windows it's totally different is not so ?


Regards


Piyush Verma

Oct 2, 2013 3:52 AM in response to piyushverma

It definitely sounds like you have installed some kind of adware, as Linc points out. This has nothing to do with anything you did in Windows, and is not due to actual malware. (Adware does not generally qualify as malware, unless it uses deceptive techniques to get itself installed.) Forget about Windows for the moment.


If I'm understanding you correctly, you're seeing your search engine change, cycling through all these different engines. Is that accurate? Is this happening only in Chrome, or in all your browsers? In Chrome, select Preferences from the Chrome menu and then click the Extensions link in the page that loads. What Chrome extensions do you have installed?


Adware is becoming an increasingly large problem for Mac users, often disguising itself as something else or being packaged in the installers for other apps. Downloading software from sites like Download.com or Softonic is a good way to get an installer that has been tampered with, against the wishes of the developer of the software in question. Never download from such sites. Crappy apps also have been known to do this, as a way of bolstering poor sales with additional ad revenue. Any installer that offers to install a browser toolbar or the like should be avoided... cancel installation and delete it.


I hadn't yet heard of Conduit, but looks like it could join the ranks of software like ChatZum and Genieo.


Also, one final comment: note that using a Unix-based OS does not guarantee you to be safe from malware. Although you are not currently infected with true malware, there is Mac malware out there, so you need to be aware of that. See my Mac Malware Guide.

Oct 2, 2013 7:52 AM in response to piyushverma

Please read this whole message before doing anything.

I've tested these instructions only with the Safari web browser. If you use another browser, they may not work as described.

This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software — potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions — they’re easy to carry out and won’t change anything on your Mac.


These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.


Below are instructions to enter some UNIX shell commands. The commands are harmless, but they must be entered exactly as given in order to work. If you have doubts about the safety of the procedure suggested here, search this site for other discussions in which it’s been followed without any report of ill effects.


Some of the commands will line-wrap or scroll in your browser, but each one is really just a single line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then copy it. The headings “Step 1” and so on are not part of the commands.


Note: If you have more than one user account, Step 2 must be taken as an administrator. Ordinarily that would be the user created automatically when you booted the system for the first time. The other steps should be taken as the user who has the problem, if different. Most personal Macs have only one user, and in that case this paragraph doesn’t apply.


Launch the Terminal application in any of the following ways:


☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)


☞ In the Finder, select Go â–č Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.


☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.


When you launch Terminal, a text window will open with a line already in it, ending either in a dollar sign (“$”) or a percent sign (“%”). If you get the percent sign, enter “sh” and press return. You should then get a new line ending in a dollar sign.


Step 1


Triple-click anywhere in the line of text below on this page to select it:

kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}' | open -ef

Copy the selected text to the Clipboard by pressing the key combination command-C. Then click anywhere in the Terminal window and paste (command-V). A TextEdit window will open with the output of the command. If the command produced no output, the window will be empty. Post the contents of the TextEdit window (not the Terminal window), if any — the text, please, not a screenshot. You can then close the TextEdit window. The title of the window doesn't matter, and you don't need to post that. No typing is involved in this step.

Step 2


Repeat with this line:

{ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|cups|isc|ntp|postf|x)/{print $3}'; echo; sudo defaults read com.apple.loginwindow LoginHook; echo; sudo crontab -l; } 2> /dev/null | open -ef

This time you'll be prompted for your login password, which you do have to type. Nothing will be displayed when you type it. Type it carefully and then press return. You may get a one-time warning to be careful. Heed that warning, but don't post it. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.


Note: If you don’t have a login password, you’ll need to set one before taking this step. If that’s not possible, skip to the next step.


Step 3

{ launchctl list | sed 1d | awk '!/0x|com\.apple|org\.(x|openbsd)/{print $3}'; echo; crontab -l 2> /dev/null; } | open -ef

Step 4

ls -A /e*/{cr,la,mach}* {,/}Lib*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/**,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts .la* 2> /dev/null | open -ef

Important: If you formerly synchronized with a MobileMe account, your me.com email address may appear in the output of the above command. If so, anonymize it before posting.


Step 5

osascript -e 'tell application "System Events" to get name of login items' | open -ef

Remember, steps 1-5 are all copy-and-paste — no typing, except your password. Also remember to post the output.


You can then quit Terminal.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

MacBook Pro Hacked from bootcamp windows

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.