Unusual and random automatic downloads

Question

Level 1

8 points

Unusual and random automatic downloads

Greetings.

My computer just recently started downloading strange (to me) files with .pdf-(number).html. I cant open them either. Clicking on one takes me to my default browser and it shows up as a jumble of letters, numbers and other symbols. At first I thought there was a pattern to the onset of downloads, seemed to happen every time I would wake computer up. I know now that's nit true because I see that some of the files are downloaded while I'm asleep in the wee hours of the morning or while I'm away.

What's causing this? Is it some type of virus or hacking activity?

Thank you for your help.

PS -Apologies if this doesn't end up in the correct forum, first time poster.

Posted on Jul 18, 2018 7:47 AM

Reply

Answer 1

Best reply

macjack

Level 10

111,168 points

Jul 18, 2018 3:51 PM in response to 1bradapple

Do not open any of the files. As long as you do not install anything they can't do any harm.

I'd suggest you download and run Malwarebytes. Malwarebytes was developed by one of our own colleagues here in ASC and is about the most proven anti-malware software for Mac.

Reply

Answer 2

Eric Root

Level 10

684,069 points

Jul 23, 2018 9:59 AM in response to 1bradapple

If the above doesn't work, try running this program in your normal user account, then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown. You can run the report for free at least once, but if you run it several times, at some point it will ask you to pay a license fee.

Etrecheck – System Information

Reply

Answer 3

1bradapple Author

Level 1

8 points

Jul 18, 2018 3:51 PM in response to macjack

Thanks, just scanned -found, remediated and quarantined 21 threats. Coincidently, there were 21 downloads of the mystery files. Any idea what the files are? Guess it doesn't really matter as long as they're not a threat.

Reply

Answer 4

1bradapple Author

Level 1

8 points

Jul 18, 2018 3:56 PM in response to Eric Root

Alright -just downloaded and ran the program. Guess I didn't follow directions exactly as I didn't click 'share report' because I thought I needed to do it manually in order to copy and paste here.. Pasted below. See anything I need to be concerned with? This type of stuff is way over my head -graphic artist and Mac user since 1998 but definitely limited in the tech skills dept. Thanks!

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-07-18 15:06:15

Download EtreCheck from https://etrecheck.com

Runtime: 9:18

Performance: Below Average

Problem: Other problem

Description:

unknown files being downloaded automatically

Major Issues:

Anything that appears on this list needs immediate attention.

Time Machine backup out-of-date - The last Time Machine backup is over 10 days old.

More than one antivirus app - This machine has multiple antivirus apps installed.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Heavy RAM usage - This machine is using a large amount of RAM.

Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage.

Clean up - There are orphan files that could be removed.

Unsigned files - There are unsigned software file installed. They appear to be legitimate but should be reviewed.

Low performance - EtreCheck report took over 5 minutes to run. This is unusual.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Abnormal shutdown - Your machine shut down abnormally.

Hardware Information:

Mac mini (Late 2012)

Mac mini Model: Macmini6,2

1 2.3 GHz Intel Core i7 (i7-3615QM) CPU: 4-core

16 GB RAM - At maximum

BANK 0/DIMM0 - 8 GB DDR3 1600 ok

BANK 1/DIMM0 - 8 GB DDR3 1600 ok

Video Information:

Intel HD Graphics 4000 - VRAM: 1536 MB

Thunderbolt Display 2560 x 1440

Drives:

disk0 - APPLE HDD HTS541010A9E662 1.00 TB (Mechanical)

Internal SATA 3 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 - Macintosh HD (Journaled HFS+) 999.35 GB

disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB

disk1 - Disk Image 24 MB (Disk Image)

External Disk Image

disk1s1 [Partition Map] 32 KB

disk1s2 - Flash Player (HFS+) 24 MB

disk2 - Disk Image 24 MB (Disk Image)

External Disk Image

disk2s1 [Partition Map] 32 KB

disk2s2 - Flash Player (HFS+) 24 MB

Mounted Volumes:

disk0s2 - Macintosh HD 999.35 GB (676.57 GB free)

Journaled HFS+

Mount point: /

Network:

Interface en1: Wi-Fi

802.11 a/b/g/n

One IPv4 address

3 IPv6 addresses

Interface Bluetooth-Modem: Bluetooth DUN

Interface en0: Ethernet

Interface en3: Display Ethernet

Interface fw0: FireWire

Interface fw1: Display FireWire

Interface en4: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 44.52 GB available

System Software:

macOS Sierra 10.12.5 (16F73)

Time since boot: About 37 days

System Load: 1.78 (1 min ago) 1.47 (5 min ago) 1.30 (15 min ago)

Security:

System	Status
Gatekeeper	Mac App Store and identified developers
System Integrity Protection	Enabled

Unsigned Files:

Launchd: ~/Library/LaunchAgents/com.iLike.Agent.plist

Executable: ~/Library/Application Support/iLike/Agent/iLikeAgent.app/Contents/MacOS/iLikeAgent