Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

duffy1987 Author

Level 1

0 points

MacBook Pro has been hacked. What next?

Hi there,

I am very supsicious my MacBook Pro has been hacked. What next?

Symptoms (in chronological order, all within a two-hour period):

1. Would not enter sleep mode upon commanded (screen went black, then came back on just as quickly).

2. Then discovered that the letter 'p' did not work on my keyboard. The only way top enter this letter in text was by COMMAND + COPY and then pasting it.

3. Once I did this, the letter 'p' would appear any time I typed the letter 'o'. It is now doing it with other letters, too. In real time, it looks sompething likpe this.

4. Decided to restart. Upon doing so, my saved password changed on the screen right before my very eyes (it is saved on the startup page). I could not backspace, or use COMMAND + X to delete. Finally got a blank field (don't remember how), and (stupidly?) entered my usual password.

5. Once back in, the same problems continued (or got worse).

6. I then shut down the machine. Same issues upon restart.

Actions:

1. Ran avast scan. No infections found.

2. Downloaded ClamXav. As cautioned, I performed a full backup before running a scan. When I connected my external hard drive, it too behaved in an odd way, but I finally managed a full backup.

3. Then ran ClamXav scan. No infections found.

Questions:

1. Given that I have taken what I think are the appropriate steps, what now? The password change that I did not initiate concerns me most, but why my keyboard is acting so strangely remains very puzzling.

Any and all help is greatly appreciated.

Thank you.

MacBook Pro, OS X Mavericks (10.9.2)

Posted on May 3, 2014 12:38 PM

Best reply

dominic23

Level 10

83,916 points

Posted on May 3, 2014 12:54 PM

Infected?

http://www.thesafemac.com/mmg-infected/

http://www.thesafemac.com/mmg/

View in context

58 replies

MadMacs0

Level 5

5,221 points

May 3, 2014 7:54 PM in response to duffy1987

duffy1987 wrote:

6. the login 'welcome' is odd, especially since insofar as i have no idea why it would be significant. can you elaborate about why it might raise an eyebrow? my best guess is that it may be from one of two (entirely legitimate) sites i access for work, but i truly have no idea.

Open System Preferences->Users & Groups->Login Items tab for your username.

What does it say next to "Welcome" in the "Kind" column (normally will be "Application")?

Hover your cursor over "Welcome" and a yellow "tool-tip" will show you the path to where that file is located.

deferring to your expertise, am i wisest to conclude that this is a keyboard/hardware problem?

It's been a number of years since I've had a working laptop, but that would certainly be my conclusion.

Your installation disk set should have included one which contains the Apple Hardware Test. See Using Apple Hardware Test. I doubt that it can adequately test your keyboard and even everything else passes, it's not positive proof that there isn't a hardware issue, but it could give you a clue.

Did you purchase AppleCare? The Apple Genius Bar or an authorized Apple repair facility will have better testing software and even if your warrantee has expired will probably be willing to do a diagnostic test and give you an idea what the cost to repair will be.

MadMacs0

Level 5

5,221 points

May 3, 2014 8:07 PM in response to duffy1987

duffy1987 wrote:

i'd be happy to follow your guidance re. com.tectona.driver.PL2303, but i don't know what it is or know any reason why one might use it.

Hence my question before if you recognized everything reported by EtreCheck.

All I can tell you is what I read at the link I gave you which seems to say it's for one of these USB to Serial/UART and Parallel/Printer interface bridge solutions from Prolific.

The other extensions I didn't recognize were:

com.aliph.driver.jstub (1.1.2) possibly associated with JAMBOX by Jawbone?
com.smarttech.iokit.SMARTBoard (10) which seems to be an interactive flat panel from SMART.

Linc Davis

Level 10

209,547 points

May 3, 2014 9:48 PM in response to duffy1987

Decided to restart. Upon doing so, my saved password changed on the screen right before my very eyes (it is saved on the startup page).

What saved password? Are you talking about logging in to your account, or logging in to a website, or something else altogether? A login password is not saved anywhere unless you use automatic login, and then you wouldn't get the login screen at all.

duffy1987 Author

Level 1

0 points

May 4, 2014 8:33 AM in response to MadMacs0

Open System Preferences->Users & Groups->Login Items tab for your username.

What does it say next to "Welcome" in the "Kind" column (normally will be "Application")?

Hover your cursor over "Welcome" and a yellow "tool-tip" will show you the path to where that file is located.

well, that is indeed odd. following instructions above, it reveals 'Welcome' but 'Unknown' in the 'Kind' column. next to that is a yellow warning triangle with the exclamation mark. i have not a clue what this is, or how it got there. moreover, i'm not sure what to do with it now that it's been discovered. the only thing i can think of is that it might be related to my external drive that i connected two days ago to perform a full backpup.

All I can tell you is what I read at the link I gave you which seems to say it's for one of these USB to Serial/UART and Parallel/Printer interface bridge solutions from Prolific.

i've checked the link, but have never been to the Prolific site before. if 'Welcome' appears, it is not something i've knowingly done (and i'm usually quite careful about these sorts of things).

The other extensions I didn't recognize were:

com.aliph.driver.jstub (1.1.2) possibly associated with JAMBOX by Jawbone?

com.smarttech.iokit.SMARTBoard (10) which seems to be an interactive flat panel from SMART.

these are okay. i recognise them, and you are correct: SMARTBoard 10 software and Jambox. these were installed by me and both are used regularly.

i did not purchase AppleCare (of course not -- just my luck!), but it sounds like i'm going to have to set up an appointment at my local Apple store. thanks once again.

duffy1987 Author

Level 1

0 points

May 4, 2014 9:00 AM in response to Linc Davis

What saved password? Are you talking about logging in to your account, or logging in to a website, or something else altogether? A login password is not saved anywhere unless you use automatic login, and then you wouldn't get the login screen at all.

all apologies, and thanks for pointing this out.

in my haste i was typing about one thing whilst thinking about 14 others. i was indeed talking about logging into my account, and no, the password isn't saved. nor do i use automatic login.

to clarify, upon restart or powering on, i'm referring to the login page that appears after the familiar Apple startup chime. the field is normally blank. however, since these problems began, the field is already populated with a password before i am able to type a single letter. at least i am now able to delete this and to enter my usual password.

this was the issue that concerned me most, and i'm still left with two questions: is the field being automatically completed because of a keyboard/hardware malfunction, or is it something more malicious (and, as yet, undefined)?

thank you for your help.

Linc Davis

Level 10

209,547 points

May 4, 2014 10:25 AM in response to duffy1987

Please read this whole message before doing anything.

This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem. You must hold down the shift key twice: once when you turn on the computer, and again when you log in.

Note: If FileVault is enabled, or if a firmware password is set, or if the startup volume is a Fusion Drive or a software RAID, you can’t do this. Ask for further instructions.

Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

Test while in safe mode. Same problem?

After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

duffy1987 Author

Level 1

0 points

May 4, 2014 10:53 AM in response to Linc Davis

i followed your instructions to the letter, and am presently in safe mode. now, i'm stuck!

Note: If FileVault is enabled, or if a firmware password is set, or if the startup volume is a Fusion Drive or a software RAID, you can’t do this. Ask for further instructions.

problem 1: i don't know whether FileVault is enabled, or how to check if it is.

Test while in safe mode. Same problem?

problem 2: i'm not sure what you mean by 'test while in safe mode'. please advise (and sorry again for my dimwittedness).

Linc Davis

Level 10

209,547 points

May 4, 2014 11:02 AM in response to duffy1987

1. If you're in safe mode, FileVault is not enabled.

2. The main question is whether you got the pre-populated password field in the login screen, but also test for the other issues you mentioned in your first post.

duffy1987 Author

Level 1

0 points

May 4, 2014 11:36 AM in response to Linc Davis

i see.

yes, the field still populates itself in safe mode. on occasion, upon restart, the MBP yields a 'woodpecker' sound -- as if letters are still being 'typed in' beyond the character limit. as for the keyboard issue:

as youp can tellp from thips sentence, the issue with the letter 'p' is stipll relpipcatipng itself.

MadMacs0

Level 5

5,221 points

May 4, 2014 11:57 AM in response to duffy1987

duffy1987 wrote:

...following instructions above, it reveals 'Welcome' but 'Unknown' in the 'Kind' column. next to that is a yellow warning triangle with the exclamation mark.

That just means it can't find whatever 'Welcome' was, so you can remove it by highlighting it and clicking the minus "-" key at the bottom. Whatever it was must have been removed at some point.

We can discuss what to do with "com.tectona.driver.PL2303" after you've worked the Password issue with Linc. Since it doesn't load it shouldn't be part of any current issue you are having.

Linc Davis

Level 10

209,547 points

May 4, 2014 12:56 PM in response to duffy1987

Did you disconnect all USB devices? If so, please test with a different keyboard. You should always have a spare on hand.

duffy1987 Author

Level 1

0 points

May 4, 2014 1:45 PM in response to MadMacs0

thank you. i've deleted 'Welcome'.

duffy1987 Author

Level 1

0 points

May 4, 2014 1:54 PM in response to Linc Davis

the only USB device connected is that for my wireless mouse. when i disconnect it and just use the track pad, i still have the same issue with the keyboard.

unfortunately, this is a house full of laptops, iPhones and iPads, so i don't have an extra keyboard lying around. (can't believe i never thought of something so simple!) i will test first thing tomorrow with an external keyboard when at work, and will post whatever i find.

thanks again for taking out a good chunk of your day to help.

duffy1987 Author

Level 1

0 points

May 4, 2014 6:38 PM in response to Linc Davis

... an update on symptoms, for what they're worth:

the sleep disorder issue has returned this evening. commanded to sleep, the screen goes black -- only to turn back on again (on its own, that is) about two minutes later. when it first happened yesterday, the screen would go black for less than a second before 'waking up'.
occasionally, when i attempt to use a pulldown menu (e.g. apple symbol > restart, or firefox > quit), i am unable to 'lock in' on my target. against my will, the blue bar turns to another command in the same dropdown menu, or scrolls all of them quickly -- up and down, down and up. this is new.
desktop icons (but not dock icons) now 'blink' at 1 minute intervals, as if the screen were 'resetting' itself. this is also new.

until i can access an external keyboard in the morning, in the interim, i've taken Apple's instructions on software troubleshooting and disc utility HD checks, and report no problems at all.

MadMacs0

Level 5

5,221 points

May 4, 2014 7:55 PM in response to duffy1987

duffy1987 wrote:

the sleep disorder issue has returned this evening. commanded to sleep, the screen goes black -- only to turn back on again (on its own, that is) about two minutes later. when it first happened yesterday, the screen would go black for less than a second before 'waking up'.

I think I mentioned Avast! issues before. Here's a link to mostly 2013 MBP owners reporting similar problems that went away once Avast! was completely uninstalled IAW the developer instructions. https://discussions.apple.com/thread/5520135.

MacBook Pro has been hacked. What next?