Help!!! Malware with rdp found

Hi there,

I have strong suspicions that there is currently malware on my laptop with rdp setup, keyboard logger (passwords emailed) and camera access.

Did a few searches and ran the following etrecheck Checks. Removed a few suspicious things already and this is the second report here.

also would be keen to know how to check for active Remote Desktop rdp connections or what processes in activity monitor to look for with keyboard loggers (i suspect there isn’t a generic program?)

I dont have an active virus program (downloaded Bitdefender but install was doing funny things)

Can someone Help?

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-07-28 15:26:13

Download EtreCheck from https://etrecheck.com

Runtime: 2:45

Performance: Excellent

Problem: Other problem

Description:

suspect malware

Major Issues:

Anything that appears on this list needs immediate attention.

Time Machine backup out-of-date - The last Time Machine backup is over 10 days old.

Battery failure - Your battery is reporting that it needs to be serviced.

Old operating system - Old operating system versions no longer receive security updates.

More than one antivirus app - This machine has multiple antivirus apps installed.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Low disk space - This machine is running low on free hard drive space.

Clean up - There are orphan files that could be removed.

Unsigned files - There are unsigned software file installed. They appear to be legitimate but should be reviewed.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

MacBook Pro (Retina, 15-inch, Early 2013)

MacBook Pro Model: MacBookPro10,1

1 2.7 GHz Intel Core i7 (i7-3740QM) CPU: 4-core

16 GB RAM - Not upgradeable

BANK 0/DIMM0 - 8 GB DDR3 1600 ok

BANK 1/DIMM0 - 8 GB DDR3 1600 ok

Battery: Health = Service Battery - Cycle count = 476

Video Information:

Intel HD Graphics 4000 - VRAM: 1024 MB

NVIDIA GeForce GT 650M - VRAM: 1024 MB

Color LCD 2880 x 1800

Drives:

disk0 - APPLE SSD SD512E 500.28 GB (Solid State - TRIM: Yes)

Internal SATA 6 Gigabit Serial ATA

disk0s1 - EFI [EFI] 210 MB

disk0s2 - Macintosh HD [Core Storage Container] 499.42 GB

disk1 - Macintosh HD (Journaled HFS+) 499.05 GB

disk0s3 - Recovery HD [Recovery] 650 MB

Mounted Volumes:

disk1 - Macintosh HD 499.05 GB (15.80 GB free)

Journaled HFS+

Mount point: /

Network:

Interface Bluetooth-Modem: Bluetooth DUN

Interface en3: Thunderbolt Ethernet 2

Interface fw0: Thunderbolt FireWire

Interface en0: Wi-Fi

802.11 a/b/g/n

Interface en5: iPhone

Interface bridge0: Thunderbolt Bridge

Interface en4: Bluetooth PAN

System Software:

OS X Yosemite 10.10.5 (14F2511)

Time since boot: Less than an hour

System Load: 1.71 (1 min ago) 2.04 (5 min ago) 1.49 (15 min ago)

Security:

Unsigned Files:

Launchd: ~/Library/LaunchAgents/com.logos.LogosIndexer.plist

Executable: /Applications/Logos.app/Contents/MacOS/LogosIndexer.app/Contents/MacOS/LogosInd exer

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.adobe.SwitchBoard.plist

Executable: /Library/Application Support/Adobe/SwitchBoard/SwitchBoard.app/Contents/MacOS/launch.switchboard

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.divx.dms.agent.plist

Executable: /Library/Application Support/DivX/DivXMediaServer.app/Contents/MacOS/DivXMediaServer

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.amazon.sendtokindle.launcher.plist

Executable: /usr/bin/stkLaunchAgent.sh

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.skype.skype.shareagent.plist

Executable: /Applications/Skype.app/Contents/Library/LaunchServices/com.skype.skype.shareag ent.bundle/Contents/MacOS/com.skype.skype.shareagent

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.adobe.fpsaud.plist

Executable: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

26 32-bit apps

Kernel Extensions:

/Library/Application Support/HASP/kexts

[Not Loaded] aksfridge.kext (1.0.13274)

/Library/Extensions

[Loaded] SelfProtect.kext (Bitdefender SRL, 1.2.11 - SDK 10.9)

[Loaded] ufsd_NTFS.kext (Paragon Software GmbH, 14.2.288 - SDK 10.5)

/System/Library/Extensions

[Not Loaded] basICColorDISCUS.kext (1.0.0 - SDK 10.4)

[Not Loaded] Seagate Storage Driver.kext (5.2.6 (26**3) - SDK 10.4)

[Not Loaded] Wacom Tablet.kext (Wacom Tablet 6.3.6-3 - SDK 10.8)

/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns

[Not Loaded] SeagateLeafPowSecDriver_10_4.kext (5.2.6 (26**3) - SDK 10.4)

[Not Loaded] SeagateLeafPowSecDriver_10_5.kext (5.2.6 (26**3) - SDK 10.5)

[Not Loaded] SeagateDriveIcons.kext (5.2.6 (26**3) - SDK 10.4)

System Launch Agents:

System Launch Daemons:

Launch Agents:

Launch Daemons:

User Launch Agents:

User Login Items:

Dropbox Application (Dropbox, Inc. - installed 2018-07-14)

(/Applications/Dropbox.app)

StartUpHelper SMLoginItem (Spotify - installed 2018-07-27)

(/Applications/Spotify.app/Contents/Library/LoginItems/StartUpHelper.app)

LoginHelper SMLoginItem (Mac App Store - installed 2018-07-08)

(/Applications/Memory Clean 2.app/Contents/Library/LoginItems/LoginHelper.app)

Internet Plug-ins:

o1dbrowserplugin: (installed 2016-03-14)

WacomNetscape: (installed 2013-06-07)

OVSHelper: (installed 2016-03-17)

Default Browser: (installed 2016-12-03)

AdobeExManDetect: (installed 2013-05-15)

Flip4Mac WMV Plugin: (installed 2013-05-15)

WacomTabletPlugin: (installed 2013-06-07)

AdobeAAMDetect: (installed 2013-12-05)

AdobePDFViewerNPAPI: (installed 2018-02-24)

DivX Web Player: (installed 2016-03-10)

FlashPlayer-10.6: (installed 2016-04-24)

QuickTime Plugin: (installed 2017-10-26)

Flash Player: (installed 2016-04-24)

googletalkbrowserplugin: (installed 2015-12-12)

Silverlight: (installed 2017-06-11)

AdobePDFViewer: (installed 2018-02-24)

JavaAppletPlugin: (installed 2018-02-13)

User Internet Plug-ins:

ZoomUsPlugIn: (installed 2017-09-15)

Safari Extensions:

3rd Party Preference Panes:

Flash Player (installed 2016-04-16)

Flip4Mac WMV (installed 2013-03-30)

Java (installed 2018-01-13)

Paragon NTFS for Mac® (installed 2017-04-20)

Perian (installed 2011-07-24)

Time Machine:

Skip System Files: No

Mobile backups: Yes

Auto backup: Yes

Volumes being backed up:

Macintosh HD: Disk size: 499.05 GB - Disk used: 483.24 GB

Destinations:

S*********B [Local] (Last used)

Total size: 4.00 TB

Total number of backups: 45

Oldest backup: 2014-09-17 18:09:42

Last backup: 2018-04-28 01:19:35

W****B [Local]

Total size: 3.00 TB

Total number of backups: 13

Oldest backup: 2016-03-20 02:58:07

Last backup: 2017-10-26 11:23:08

Top Processes by CPU:

Top Processes by Memory:

Top Processes by Energy Use:

Virtual Memory Information:

Software Installs (past 30 days):

Clean up:

/Library/LaunchDaemons/yEHCjlVXmd8d.plist

/Library/Application Support/SendSpace/XMUP3ohglvj/SendSpace

Executable not found

/Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist

/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud

Executable not found

/Library/LaunchDaemons/com.xrite.device.xrdd.plist

/Library/Application Support/X-Rite/Frameworks/XRiteDevice.framework/Versions/B/Resources/xrdd

Executable not found

Diagnostics Information (past 7 days):

2018-07-28 15:16:56 Dock.app CPU (2 times)

/System/Library/CoreServices/Dock.app

2018-07-27 15:43:53 Audacity.app CPU (3 times)

/Applications/Audacity.app

End of report