Redirect Virus on MacBook Air

Question

Level 1

8 points

Redirect Virus on MacBook Air

Hello,

I play an online game, hosted by a UK-based website. I have been using this site for almost ten years, no problem, but it is located at an unsecured site (i.e. http rather than https). When I tried to go to the link today, unfortunately, my computer redirected me to a website called chillcardiac[dot]com, which then started downloading files without permission. This was happening in a Chrome browser, so I switched to Safari; it happened there as well. The friend with whom I was playing, however, is not having a problem on her computer. I also contacted the administrator of the website, and he sent me the Norton virus scan, showing that it is clean on his end.

After doing a bit of research, I am guessing that my Mac might have something called a "redirect virus," but I have no idea how to remove it. I downloaded and ran Malwarebytes, but its report says that my computer is clean. I also deleted the files that were downloaded from the website and emptied the trash. Does anyone have any other thoughts on what to try next?

Thanks in advance for any insights.

Julia

MacBook Air, iOS 10.1.1

Posted on Sep 6, 2018 12:15 PM

Reply

Answer 1

Tesserax

Level 10

157,692 points

Sep 6, 2018 2:55 PM in response to juliairwin

Ok, just wanted to bring this to your attention as a possible culprit.

The next step I would suggest it to run an EtreCheck report and post it here so we can try to assist you further.

(Note: The EtreCheck report does NOT contain any personal information.)

You can download EtreCheck fromhere.
Start EtreCheck from a normal user account. Optionally, you can run it from a user account with Administrator privileges.
Select a problem from the drop-down menu to enable the "Start EtreCheck" button. Optionally, you can add comments on what issues your Mac is experiencing, especially to aide others with similar Mac issues.
Click on Start EtreCheck
Allow the program to run to completion.
When done, select Report from the left-side window to display it.
Select the "Share Report" icon.
Select Copy Report
Paste the report to your reply post.

Ref: Using EtreCheck - ASC (etresoft)

Reply

Answer 2

Tesserax

Level 10

157,692 points

Sep 6, 2018 5:37 PM in response to juliairwin

Ok a few things stand out and here are a few suggestions for you to consider:

Remove Avast anti-virus. Mac do not get viruses. They may be "infected" by adware or malware, but so far, no viruses. Most AV apps cause more problems than they resolve, especially those that run in the background.
Keep Malwarebytes, but don't let it run in the background. Use it periodically when you suspect adware infections.
Remove MacKeeper. It's been reported here as a potential type of malware and numerous users post here to ask how to remove it.
IDrive seems to be problematic. I suggest that if you really don't need it, to remove it.
Carefully review all of your Internet plug-ins. Remove any you don't really use.
Clear the Google Chrome caches. Also review any Chrome plug-ins or extensions. Again, if you really don't use them, remove them.
Finally, your MBA is a bit short on RAM ... and available drive space. Both are symptomatic with the limited available to begin with this notebook line. This wouldn't help with the "virus" issue, but could help boost overall performance.

Reply

Answer 3

Kappy

Level 10

361,995 points

Sep 6, 2018 1:13 PM in response to juliairwin

Fixes for Adware and Pop-ups

Reply

Answer 4

Tesserax

Level 10

157,692 points

Sep 6, 2018 2:02 PM in response to juliairwin

It may also be possible that your Mac's Hosts file has been compromised and needs to restored.

Reply

Answer 5

juliairwin Author

Level 1

8 points

Sep 6, 2018 3:13 PM in response to Tesserax

Terrific! Tesserax, thank you so much for your help. Here is the EtreCheck report. Thank you in advance for further thoughts you may have!!

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-09-06 18:08:19

Download EtreCheck from https://etrecheck.com

Runtime: 4:35

Performance: Good

Problem: Other problem

Description:

I play an online game, hosted by a UK-based website. I have been using this site for almost ten years, with no problem, but it is located at an unsecured site (i.e. http rather than https).

When I tried to go to the link today, unfortunately, my computer redirected me to a website called chillcardiac[dot]com, which then started downloading files without permission. This was happening in a Chrome browser, so I switched to Safari; it happened there as well. The friend with whom I was playing, however, is not having a problem on her computer. I also contacted the administrator of the website, and he sent me the Norton virus scan, showing that it is clean on his end.

I have run both Malwarebytes and Avast Security and that has not helped. I also tried to restore the host file. And finally, I tried to set parental controls to block the offending website. None of this has worked, unfortunately. I suspect (having done some research) that I have a redirect virus, but I do not know how to remove it from my computer.

Thank you for your help!

Major Issues:

Anything that appears on this list needs immediate attention.

No Time Machine backup - Time Machine backup not found.

More than one antivirus app - This machine has multiple antivirus apps installed.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Clean up - There are orphan files that could be removed.

Unsigned files - There are unsigned software file installed. They appear to be legitimate but should be reviewed.

Insufficient permissions - EtreCheck running under a standard user. Diagnostic information may not be available.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

MacBook Air (11-inch, Early 2015)

MacBook Air Model: MacBookAir7,1

1 1.6 GHz Intel Core i5 (i5-5250U) CPU: 2-core

4 GB RAM - Not upgradeable

BANK 0/DIMM0 - 2 GB DDR3 1600 ok

BANK 1/DIMM0 - 2 GB DDR3 1600 ok

Battery: Health = Normal - Cycle count = 130

Video Information:

Intel HD Graphics 6000 - VRAM: 1536 MB

Color LCD 1366 x 768

Drives:

disk0 - APPLE SSD AP0256H 251.00 GB (Solid State - TRIM: Yes)

Internal PCI-Express 5.0 GT/s x4 NVM Express

disk0s1 - EFI [EFI] 315 MB

disk0s2 250.69 GB

disk1s1 - Macintosh HD (APFS) 250.69 GB (181.16 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] 250.69 GB (22 MB used)

disk1s3 - Recovery (APFS) [Recovery] 250.69 GB (519 MB used)

disk1s4 - VM (APFS) [APFS VM] 250.69 GB (2.15 GB used)

Mounted Volumes:

disk1s1 - Macintosh HD 250.69 GB (66.70 GB free)

APFS

Mount point: /

Encrypted

disk1s4 - VM [APFS VM] 250.69 GB (66.70 GB free)

APFS

Mount point: /private/var/vm

Network:

Interface en2: Thunderbolt Ethernet

Interface en4: iPhone

Interface en0: Wi-Fi

802.11 a/b/g/n/ac

One IPv4 address

Interface en3: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: Less than an hour

System Load: 1.89 (1 min ago) 1.56 (5 min ago) 2.23 (15 min ago)

Security:

System	Status
Gatekeeper	Mac App Store and identified developers
System Integrity Protection	Enabled

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.avast.init.plist

Executable: /Library/Application Support/Avast/hub/init.sh