Have I Been Hacked?

Question

Level 1

0 points

Have I Been Hacked?

Macbook Air OS Yosemite 10.10.3 256 GB-downloaded some movies from iCloud on June 1 and almost ran out of free space. Afterwards Keychain said I needed to log in from another device and I then lost all of my passwords. Keychain Library was corrupted and had to restore. Now all of my autofill data has been wiped out. I had a virus previously that installed a new search engine I could never get to go away, seems to be gone after recent updates though. I have had some phishing attempts come through my phone lately. Have I had a hack? Can I restore autofill?

MacBook Air, OS X Yosemite (10.10.3)

Posted on Jun 2, 2015 10:37 PM

Reply

Answer 1

dominic23

Level 10

83,904 points

Jun 3, 2015 5:10 AM in response to jb7538

Can you run EtreCheck and post the report here please?

EtreCheck: https://discussions.apple.com/docs/DOC-6173

Reply

Answer 2

Linc Davis

Level 10

209,547 points

Jun 3, 2015 6:51 AM in response to jb7538

First and most important, what backups do you have? If the answer is "none," do nothing else until you have backed up.

Reply

Answer 3

jb7538 Author

Level 1

0 points

Jun 3, 2015 9:51 PM in response to dominic23

Problem description:

Downloaded movies from iCloud and almost ran out of free space. Afterwards I lost all of my keychain passwords and keys and I found a corrupt folder in the Keychain library. I removed the corrupted folder and did a reboot. Keychain replaced the folder but no data was restored. I found some old backups of my keychain but nothing that I needed. I ended up resetting keychain and starting anew. I then lost all of my autofill data including my credit card information (probably dumb to use this feature I know) and I couldn’t figure out how to retrieve it. Now my email repeatedly asks me to log in even though I have enabled all of my accounts. I received a phishing text message while working on my keychain repair. Also, I had adware at one point that went away, came back and is gone again I think. This afternoon my iPhone began to have problems with the display and touch screen and I had to reboot. Now it wants me to log in to iCloud at random times. Also, my iPad battery died and it won’t charge. The charge screen shows it is connected but flashes periodically and does not charge. I do not know if these are all connected. My main problem is the lost information on my macbook air (10.10.3) and a concern that I may have a virus.

EtreCheck version: 2.2 (132)

Report generated 6/4/15, 12:47 AM

Download EtreCheck from http://etresoft.com/etrecheck

Click the [Click for support] links for help with non-Apple products.

Click the [Click for details] links for more information about that line.

Click the [Click to remove] links for help removing adware.

Hardware Information: ℹ️

MacBook Air (13-inch, Mid 2013) (Verified)

MacBook Air - model: MacBookAir6,2

1 1.3 GHz Intel Core i5 CPU: 2-core

4 GB RAM Not upgradeable

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 115 - SN = D8634340UD9F90JAR

Video Information: ℹ️

Intel HD Graphics 5000

Color LCD 1440 x 900

System Software: ℹ️

OS X 10.10.3 (14D136) - Time since boot: 4:54:27

Disk Information: ℹ️

APPLE SSD SD0256F disk0 : (251 GB)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / [Startup]: 249.77 GB (8.13 GB free) (Low!)

Core Storage: disk0s2 250.14 GB Online

USB Information: ℹ️

Apple Internal Memory Card Reader

Apple Inc. iPod

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Thunderbolt Information: ℹ️

Apple Inc. thunderbolt_bus

Gatekeeper: ℹ️

Mac App Store and identified developers

Adware: ℹ️

Genieo, InstallMacAdware! [Click to remove]

More adware filesAdware! [Click to remove]

Kernel Extensions: ℹ️

/Library/Extensions

[not loaded] com.mice.driver.Wireless360Controller (1.0.0d14 - SDK 10.9) [Click for support]

[not loaded] com.mice.driver.WirelessGamingReceiver (1.0.0d14 - SDK 10.9) [Click for support]

[loaded] com.symantec.nfm.kext (6.2.1f85 - SDK 10.9) [Click for support]

/System/Library/Extensions

[not loaded] com.mice.driver.Xbox360Controller (1.0.0d14 - SDK 10.9) [Click for support]

[loaded] com.symantec.internetSecurity.kext (6.2f85 - SDK 10.8) [Click for support]

[loaded] com.symantec.ips.kext (6.2f85 - SDK 10.8) [Click for support]

Launch Agents: ℹ️

[loaded] com.symantec.errorreporter-periodicagent.NFM.plist [Click for support]

[running] com.symantec.uiagent.application.NFM.plist [Click for support]

Launch Daemons: ℹ️

[loaded] com.adobe.fpsaud.plist [Click for support]

[running] com.mice.360Daemon.plist [Click for support]

[not loaded] com.symantec.deepsight-extractor.NFM.plist [Click for support]

[loaded] com.symantec.errorreporter-periodic.NFM.plist [Click for support]

[failed] com.symantec.liveupdate.daemon.NFM.plist [Click for support]

[running] com.symantec.sharedsettings.NFM.plist [Click for support]

[running] com.symantec.symdaemon.NFM.plist [Click for support]

[failed] com.symantec.SymLUHelper.NFM.plist [Click for support]

[loaded] com.symantec.UninstallerToolHelper.plist [Click for support]

User Launch Agents: ℹ️

[failed] com.genieo.completer.download.plist Adware! [Click to remove]

[loaded] com.genieo.completer.ltvbit.plist Adware! [Click to remove]

[loaded] com.genieo.completer.update.plist Adware! [Click to remove]

User Login Items: ℹ️

iTunesHelper Application (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Wormhole Application (/Users/[redacted]/Library/Wormhole/Wormhole.app)

TuneupMyMac UNKNOWN (missing value)

Dropbox Application (/Applications/Dropbox.app)

Internet Plug-ins: ℹ️

FlashPlayer-10.6: Version: 17.0.0.188 - SDK 10.6 [Click for support]

QuickTime Plugin: Version: 7.7.3

Flash Player: Version: 17.0.0.188 - SDK 10.6 [Click for support]

Default Browser: Version: 600 - SDK 10.10

Unity Web Player: Version: UnityPlayer version 4.3.5f1 - SDK 10.6 [Click for support]

NortonInternetSecurityBF: Version: 6.2 - SDK 10.9 [Click for support]

JavaAppletPlugin: Version: 15.0.0 - SDK 10.10 Check version

Safari Extensions: ℹ️

Evernote Web Clipper

Norton Security

Omnibar Adware! [Click to remove]

3rd Party Preference Panes: ℹ️

Flash Player [Click for support]

XBox 360 Controllers [Click for support]

Time Machine: ℹ️

Time Machine not configured!

Top Processes by CPU: ℹ️

4% WindowServer

3% fontd

3% SymDaemon

1% taskgated

0% mds

Top Processes by Memory: ℹ️

490 MB kernel_task

315 MB SymDaemon

287 MB com.apple.WebKit.WebContent(3)

147 MB com.apple.MediaLibraryService

123 MB Safari

Virtual Memory Information: ℹ️

150 MB Free RAM

3.85 GB Used RAM

1 MB Swap Used

Diagnostics Information: ℹ️

Jun 3, 2015, 07:52:57 PM Self test - passed

Jun 3, 2015, 07:30:03 PM /Library/Logs/DiagnosticReports/SymDaemon_2015-06-03-193003_[redacted].cpu_reso urce.diag [Click for details]

Jun 2, 2015, 10:03:50 PM /Users/[redacted]/Library/Logs/DiagnosticReports/accountsd_2015-06-02-220350_[r edacted].crash

Jun 2, 2015, 09:09:46 AM /Library/Logs/DiagnosticReports/SymDaemon_2015-06-02-090946_[redacted].cpu_reso urce.diag [Click for details]

Jun 2, 2015, 06:58:25 AM /Library/Logs/DiagnosticReports/???_2015-06-02-065825_[redacted].cpu_resource.d iag [Click for details]

Jun 2, 2015, 06:05:13 AM /Users/[redacted]/Library/Logs/DiagnosticReports/bird_2015-06-02-060513_[redact ed].crash

Jun 2, 2015, 06:05:10 AM /Users/[redacted]/Library/Logs/DiagnosticReports/bird_2015-06-02-060510_[redact ed].crash

Jun 2, 2015, 06:04:57 AM /Users/[redacted]/Library/Logs/DiagnosticReports/cloudd_2015-06-02-060457_[reda cted].crash

Jun 2, 2015, 06:04:56 AM /Users/[redacted]/Library/Logs/DiagnosticReports/cloudd_2015-06-02-060456_[reda cted].crash

Jun 2, 2015, 02:43:17 AM /Library/Logs/DiagnosticReports/mdworker_2015-06-02-024317_[redacted].crash

Reply

Answer 4

jb7538 Author

Level 1

0 points

Jun 3, 2015 9:52 PM in response to jb7538

Wow thanks for this! I see my adware problem still exists....what else does this tell me?

Reply

Answer 5

Jun 3, 2015 9:59 PM in response to jb7538

jb7538 wrote:

I had a virus previously that installed a new search engine I could never get to go away, seems to be gone after recent updates though.

1) It's not a virus. From the symptoms you describe, it's adware. Based on the EtreCheck report you posted, it's still on your computer (Genieo and Omnibar adware). It is possible, though I can't say for certain, that it is responsible for your AutoFill problem as well. You should remove it, and while you're at it, remove the worthless Symantec "Norton" product. Anti-virus is useless at protecting you from adware (or even general malware for that matter), and Norton for Mac in particular has a poor reputation.

2) Download and run a scan with AdwareMedic: http://adwaremedic.com/index.php.

The best way to remove adware is often the subject of heated debates on these forums. If you feel comfortable running a program, prefer a quicker solution, and don’t want to risk incompletely or incorrectly removing the adware manually, then you should run AdwareMedic as I suggested. If you would rather remove the adware manually because you don’t want to run any programs to solve the problem, then follow Apple’s instructions at https://support.apple.com/en-us/HT203987. Note that this document does not cover all types of adware. If those instructions do not solve the problem, see http://thesafemac.com/arg (from the same author as AdwareMedic).

You will probably hear others’ opinions about whether you should run a program or remove the adware manually. AdwareMedic gets my vote, but don’t let that, or anyone else’s opinions sway you one way or the other.

Reply