Serious Mac Virus?

Hi. Right now my Mac is all messed up. For the past 2 weeks my Magic Trackpad has been acting crazy, and so I thought maybe it was a problem with the Trackpad or Bluetooth. I was doing stuff to try to fix it but it all failed so I assumed that it was a hardware issue. I went and got a cheap mouse at Walmart for the time being and now I'm finding that the new mouse is doing the same thing. I've done everything I can think of. I reset the PRAM, the SMC and etc. But the thing is, it also does stuff with my keyboard. In fact, as I'm trying to type this out it keeps backspacing and the mouse even comes and tries to delete it all (I think the hacker or virus maker or something is getting upset LOL), or move my letters around and all sorts of stuff. It's a major ******* and I've already done multiple antivirus scans. Another reason I think it is hacked is because around the same time it started, my dad was telling me about how he got all kinds of spam emails from me, which I didn't send. Is there any way to fix this without wiping my computer and reinstalling?

OS X Mountain Lion (10.8.2)

Posted on Jul 24, 2014 8:55 PM

Reply
20 replies

Jul 24, 2014 11:31 PM in response to diablo9333

There are several possible causes for this issue. Please take each of the following steps that you haven't already tried until it's resolved. Some may not apply in your case.

1. Follow the instructions in this support article, and also this one, if applicable. A damaged or defective AC adapter could be the cause, even if it's the right kind.

2. Press down all four corners of the trackpad at once and release. If there's any effect, it's likely to be temporary, and in that case the unit must be serviced or replaced.

3. Open the Bluetooth preference pane in System Preferences and delete all pointing devices other than the trackpad, if applicable. Disconnect any USB pointing devices. By a "pointing device," I mean a peripheral that moves the cursor, such as a trackpad, mouse, trackball, or graphics tablet. A plain keyboard is not a pointing device.

4. Start up in safe mode and test, preferably without launching any third-party applications. If you don't have the problem in safe mode, but it comes back when you restart as usual, stop here and post your results. Do the same if you can't start in safe mode. If there was no difference in safe mode, go on to the next step.

5. Reset the System Management Controller.

6. If you're using a Bluetooth trackpad or mouse, investigate potential sources of interference, including USB 3 devices.

7. A swollen battery in a portable computer can impinge on the trackpad from below and cause erratic behavior. If you have trouble clicking the trackpad, this is likely the reason. The battery must be replaced without delay.

8. There's a report that a (possibly defective) Thunderbolt Ethernet adapter can cause the built-in trackpad of a MacBook to behave erratically. If you're using such an adapter, disconnect it and test.

9. There's also a report of erratic cursor movements caused by an external display that was connected but not turned on.

10. If none of the above applies, or if you have another reason to think that your computer is being remotely controlled, remove it from the network by turning off Wi-Fi (or your Wi-Fi access point), disconnecting from a Bluetooth network link, and unplugging the Ethernet cable or USB modem, whichever is applicable. If the cursor movements stop at once, you should suspect an intrusion.

11. Make a "Genius" appointment at an Apple Store to have the machine and/or external trackpad tested.

Jul 25, 2014 8:26 PM in response to diablo9333

1. It is an iMac. What year/model is it?

2. Is your Keyboard USB or BT? Is it an Apple or a different brand?

3. You may want to keep track of how the Magic Mouse behaves. Please look in Console logs for Bluetooth messages.

4. USB messages will also help.

5. You may to take screen shot of the USB and BT from System Information for future reference. BT can be prone to RF interference - Wi-Fi and Bluetooth: Potential sources of wireless interference

6. For the 8pm mystery, it can be either machine initiated or network initiated activity. If you can use Wireshark at around 750pm, and another one at say 805 pm, connections can be analyzed. Terminal netstat -an | grep ESTABLISHED can also show you if anything new is started. If you can write a simple loop script which executes this command at a periodic interval, it can show you connections and how they vary over time.

7. Do you have any NAS devices which may have been configured for backups of devices connected to the network?

8. If you have the ability to install another OS, say Ubuntu or Windows, does the same behavior repeat across multiple OSes? A linux derivative may be better. Virtualization engines will muddy the water further, so a single OS-at-a-time can be used to narrow down issues.

9. I would try and start a 'full' AHT and let it run overnight, if necessary. Such tests are usually run with minimal peripherals being connected, so mouse/keyboard should be the minimum.

10. Do you have another Mac which can be paired with the same peripherals to further narrow down the focus of the diagnostics?

Jul 25, 2014 4:05 PM in response to Loner T

Okay so I decided that it needed to be a software issue maybe from a virus like I mentioned and now it is REALLY serious. I backed up my computer (certain files anyways) and went into Disk Utility to reformat the drive. I decided that I wanted to do a secure erase, so I chose the second option (I wanted to do the last one but it said it would take like 8 hours so I cancelled it). I waited and waited and waited because it said it was going to take a long time. So, I had no problem with that. I just waited. I kept checking back and everything was fine and then it said "1 minute remaining" and so I was happy that it was working and then suddenly I got an error. I tried to reformat it again except with the fast option and I got another error. Now when I go to Disk Utility, there isn't even a partition there. It just says "Internal Drive" and when I look at what is available it says just a little over 100 kilobytes. Somehow it seems as if it is bricked. Right now I'm using the "get help online" option which is how I'm doing this. But I don't know how this happened. Realistically, I could say that it is a hardware issue (I was having a problem with something else a few weeks ago and actually I think you responded to that Linc) but I'm not sure. I mean the entire computer must be messed up if that's the case. Anything you can suggest before I take it in?

Jul 25, 2014 4:47 PM in response to Linc Davis

Sorry about that. Firstly, I have been backing it up all day and formatting and I never saw yours until now (too late obviously). However, none of those would have been applicable really. Like I said, it was also a wired mouse that was doing the exact same thing. Might I add, it didn't happen all the time and in fact, it usually happened at around 8:00PM. So it was almost like it was planned. Unless the computer had a random failure of hardware (which is entirely possible), I don't see it being anything hardware related because I have had the same setup for a good year and a half now with no issues. Like I said in the original post, I already tried resetting the SMC (multiple times too).


Just to provide some extra information, last night I did the hardware test that was suggested by Loner T and the result that I got was that the hardware was entirely fine. Maybe I would have gotten a different result under the extended testing but I didn't feel a need to do the extended testing because of time (it would have taken a long time because of my system specs). I could always do the extended testing now though. Anyways, it seemed to me that it was a hardware issue and likely a virus or a hacker. In fact, just after I posted the original post, I was doing some browsing and when I left the mouse alone, it was in the middle of the screen. Then what happened was I saw the mouse go to the bottom of the screen and then go to the left, but it was done in such a fashion that it looked like someone was seeing what I had on my computer. Anyways, I was pretty convinced it was software related and so I went nuclear and tried to reformat. I've reformatted before so I knew what I was doing but this time it didn't work and this happened instead. I have one more idea though. I have an old Macbook that I can use and so I'm going to install OS X on a partition on my external hard drive and I'll see if I can do anything with the Disk Utility on that (particularly cloning the drive). Plus, I can always use the external hard drive as a start up disk and then maybe figure something out with that. It might seem a little stupid but right now the computer is bricked so it's all I have before making an appointment and taking it in to get fixed.

Jul 25, 2014 5:22 PM in response to Linc Davis

Sorry, I didn't mean it like that. I just meant that I did some of that already and that the other half wouldn't be the best way to find out in my opinion. For example, my wired mouse was a third party mouse so it didn't respond to the stuff within System Preferences. I actually had to find a third party solution just to adjust the settings properly. Safe mode has never properly worked for me. That is, I could use it but if I open Safari a bunch of weird stuff happens and so it makes it hard to use for a long period of time to find out different things. It's an iMac so the battery thing wouldn't work and I don't see it being the cord because I have used it since I got the computer with no problems. I didn't use any Ethernet Adapters (and actually used Wifi) and don't use an external display. Anyways I thank you for your help in this and also want to apologize if I seemed rude. I'm just really stressed out by all of this. It would be nice if things just worked, you know? My iMac used to "just work".

Jul 25, 2014 5:37 PM in response to diablo9333

ABout the 8PM - are you connected to the internet at that time?


If not, how long has it been on?


I did have a owned by work IBM Think Pad do berserker things (it was three or four years old at the time) where I became very adept at pulling it out of the docking port to get it off the network, and pulling the battery for quick shutdown before more stuff happened. It happened because it was in active use all day and few hours at home - so it was just wear and tear on the parts.

Jul 25, 2014 6:21 PM in response to Barney-15E

I think you have the wrong idea. Firstly, I was asking if there was a way to get rid of the problem BEFORE reinstalling. The problem is, the fellow yesterday seemed to suggest that I couldn't and so after some thought I decided to reinstall the OS. I didn't read Linc Davis' post until it was too late. What I'm saying is, I couldn't have done what he suggested anyways because my computer was already bricked from the reformatting process. If I was able to (which I would have done all of them without question), I already did reset the SMC multiple times and did some of the other things he wrote so I would only have to do about a quarter of what he suggested (because some of it is hardware related, there would have been nothing I could do to really test for that other than the diagnostics tool that Loner T brought up). I'm assuming your comment is a more sarcastic one because you think I'm being arrogant or something but that is far from the case (although I could have worded my comment a little better). The reality is, by the time I came on here to read the second suggestion, it was too late and another problem arose, which is mainly why I responded by saying it wasn't applicable.

Jul 25, 2014 6:25 PM in response to notcloudy

I'm always connected to the internet. I appreciate your response that maybe it was a hardware issue however my wired mouse also did the same thing, so it seems very unlikely. I think it was a virus (a serious one) or a hacker. I'm going to be reinstalling the OS in just a second (I'm using Safari on the recovery partition right now) and hopefully afterwards it will be fixed. I already see a few other problems being fixed after Disk Utility repaired the hard drive.

Jul 25, 2014 6:29 PM in response to diablo9333

Did you ever run AHT and/or Apple Diagnostics? All your issues seem to stem from HID (mouse, keyboard) which ends being either BT or USB.


You can connect the KB/Mouse to another computer (not the iMac) and figure out if it is HID related.


If it is not HID, then the other end is either BT, or USB.


You could have scheduled tasks that come on at 8pm, perhaps due to an application which has been asked to connect at that time.


Being stressed out is not going to help you (and others) solve your issue. You need to look at this from a 'logical' progression and find issues by process of elimination.

Jul 25, 2014 7:08 PM in response to Loner T

Yes I did and it said "no troubles". And wow..after all of this trouble I still have the issue. I will say this though, as much of a pain as it was, I think it was needed. I had too much garbage on my computer. Anyways, I have found my old Magic Mouse and so I'll try using that for a while and see what happens.


As for the 8:00PM thing, I find it starts then and keeps going for a while (sometimes hours). Since it is happening with a newly installed OS X, I doubt it is a scheduled task. Any other ideas? Should I do the extended hardware check (I just did the regular last night)?

Jul 26, 2014 6:16 AM in response to diablo9333

As others have reported a problem that looked like a hacker coming in through their wireless network and manipulating their screen - if you a wireless network change the passwords on it to secure passwords - if you left the default they will just come back in and do the same thing.


Ultimate security on the internet - and your Mac - when you are not using it shut it down - it is hard to hack into a system that is off and the spike stick is shut off.

Jul 26, 2014 9:43 AM in response to Loner T

It's a maxed out 21.5-inch, Late 2012 iMac. The keyboard I have is USB and of course the Magic Trackpad I have is Bluetooth as well as the Magic Mouse. I've never even heard of Wireshark so I probably have never used it. No NAS devices. And yes I have an older Macbook as mentioned.


I really don't know how to describe this so I'm just gonna kinda say it. After using my Magic Mouse it seems to be clear that the problem is with the Trackpad, since with the Magic Mouse it is fine. It still doesn't describe how the issue happened with the cheap mouse I got (it is a crappy mouse but still...). Maybe I actually did have a hacker but broke the Trackpad during the process of trying to fix this thing (entirely possible even though it seems unlikely). But it seems to be fine now so I'm not going to immediately assume the worst of everything. I think the AHT is a good idea.

Jul 26, 2014 10:11 AM in response to diablo9333

diablo9333 wrote:


I've never even heard of Wireshark so I probably have never used it.


You don't need to use Wireshark or netstat. Those are tools that are only useful in the hands of an expert. Someone who isn't a networking expert would only be confused by them, assuming they could even run them in the first place.


After using my Magic Mouse it seems to be clear that the problem is with the Trackpad, since with the Magic Mouse it is fine. It still doesn't describe how the issue happened with the cheap mouse I got


If there's a problem with the built-in trackpad, it doesn't matter what external mouse or trackpad you use... the screwed-up input from the internal trackpad is still present, and will still cause the same problems.


Since you have an older MacBook, a strong possibility is the swollen battery that was mentioned in one of the points in Linc's post. Not all older batteries swell when they start to die, but if they do swell, they usually cause problems with the trackpad, which sits right above the battery and has pressure put on it if the battery swells.


I would strongly suggest that you take this machine in to get checked out by Apple. If the battery is swelling, you want to get that taken care of before the pressure breaks something or the battery ruptures and spills its innards all over the insides of your MacBook.

Jul 26, 2014 10:59 AM in response to thomas_r.

The problem is related to an iMac. The question related to a second Mac was to allow the OP to test the peripherals on a second Mac to isolate peripheral issues. It can also be used to do some Target Disk Mode analysis, if necessary.


Wireshark and netstat can always be learnt. 😉


PS: Ah I see the OP responded as well. Apologies, Thomas on a double post.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Serious Mac Virus?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.