Have I got some malware when my Mac screen shows lines from Unix script on login, instead of going to the password dialogue box?

Question

Level 1

4 points

Have I got some malware when my Mac screen shows lines from Unix script on login, instead of going to the password dialogue box?

Is it normal that my Mac (Mini, running High Sierra) would spontaneously run Unix script on a login if there had been a crash a few hours before this on login happened? Or should I consider that this spontaneous running of the UNIX script is an indication of the presence of malware? Here are the details.

There was a spontaneous system crash at midnight (I was asleep -- more details from the crash log are below). When I started to use the machine (it had spontaneously restarted after the crash) after 6 AM, some Finder windows began to close spontaneously and some applications began to start spontaneously. So I quickly did a normal shutdown.

On doing a login about 10 minutes later, instead of bringing up the normal startup screen this weird UNIX script began to run, which it did for more than 30 seconds, and I saw lines saying that XX (can't remember what now) was "changed"; and this, I suppose, referred to changes done by the script! (My heart started to flutter -- there is a big bunch of business stuff on this machine.) Soon the usual dialogue box for me to enter my password appeared.

So, that is how I got to the questions asked at the outset of this message. Basically, do I now have some new malware on board?

Semi-finally. In the past two days I installed new programs, one of which required my use of Terminal (craftcms, which executes PHP code). Also, I installed MAMP and MAMP_Pro (two different programs), which also harness PHP-executing server software (Apache).

However, note that McAffee's True Key seems to have triggered the crash at midnight. I mention these PHP-executing programs to say that they and I have been 'messing around' below the MacOS level of code.

I will appreciate all comments/advice as to whether I should act as if something bad has happened (in terms of malware arrival) and I need to start 'rescuing important stuff' ASAP.

Thanks in advance.

Finally, here are a few lines from the crash log in the Diagnostics folder:

____

Process: nativeproxy [38165]

Path: /Applications/True Key.app/Contents/Frameworks/nativeproxy

Identifier: nativeproxy

Version: 0

Code Type: X86-64 (Native)

Parent Process: Google Chrome [38146]

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

...

Exception Type: EXC_BAD_ACCESS (SIGSEGV)

Exception Codes: EXC_I386_GPFLT

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread

0 nativeproxy 0x0000000108b46833 ELF::ELFRegistrar::logLine(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, ELF::ELFLevel) + 179

1 nativeproxy 0x0000000108b2a580 ZmqClient::StopConnect() + 1152

2 nativeproxy 0x0000000108b11f5b NativeProxy::RunLoop() + 363

3 nativeproxy 0x0000000108b028b0 main_common(std::__1::basic_string<wchar_t, std::__1::char_traits<wchar_t>, std::__1::allocator<wchar_t> > const&, std::__1::basic_string<wchar_t, std::__1::char_traits<wchar_t>, std::__1::allocator<wchar_t> > const&, std::__1::basic_string<wchar_t, std::__1::char_traits<wchar_t>, std::__1::allocator<wchar_t> > const&) + 2272

4 nativeproxy 0x0000000108b05793 main + 883

5 libdyld.dylib 0x00007fff63771015 start + 1

____

Posted on Nov 16, 2018 8:34 AM

Reply

Answer 1

Nov 19, 2018 4:36 AM in response to Theordore

Please post the Etrecheck report.

A per usual, have complete and current backups.

That’s some ordinary boot-time chatter and usually only visible with verbose mode boot, a user lacking a .profile file is commonplace, and all this would usually be hidden from view absent Command-V.

Reset the SMC and NVRAM.

If there’s any anti-virus or any anti-malware or optimizers or cleaners or protectors or network-logging and connection-sniffing packages added on, please remove all of that per vendors’ instructions, reboot, and test again.

This might head toward a recovery-mode boot and reinstall but we’re not there yet. The SMC and NVRAM, and the removal of some add-on packages may well clear this. It’s also remotely possible there’s a hardware problem here such as a failing disk, but thatks very far from a certainty. But have current backups before you proceed.

https://support.apple.com/en-us/HT201295

https://support.apple.com/en-us/HT204063

Reply

Answer 2

Nov 16, 2018 12:24 PM in response to Theordore

I've had a few problems with add-on packages stepping on login scripts and related Unix-level configuration files, and it's also common for updates and other activities to run overnight when the macOS feature Power Nap feature has been enabled.

Remove the anti-virus, anti-malware and whatnot, and try again.

Anti-malware is a common source of instabilities and corruptions, and more than a few security packages have themselves introduced security vulnerabilities that did not previously exist. More than a little of the security software around is often ineptly secured.

This particular stuff is intercepting network connections, by all appearances.

Once that's done, post the diagnostic output report—copy the report to the clipboard, and paste it here—from Etrecheck, and we'll have a look at the configuration. From that, we can have a look at what's been installed, and whether there are any obvious issues with the hardware or software.

https://www.etrecheck.com/

Backups and off-site backups are a key part of your overall system security, too. Make sure that's all running and current, and that you have a schedule for rotating some of your backups minimally disconnected and preferably stored remotely.

Reply

Answer 3

Theordore Author

Level 1

4 points

Nov 16, 2018 3:01 PM in response to MrHoffman

Very helpful note from, MrHoffman! I plan to follow the procedure you outlined, over the next few days, and come back with a copy of the diagnostic report if it seems to have additional pointers you can use. Thanks again.

Reply

Answer 4

Theordore Author

Level 1

4 points

Nov 18, 2018 7:24 PM in response to MrHoffman

Thanks MrHoffman. I've spent much of the past two days securing my business files, and associated software properly (including cold-storage stuff that will allow me to get back to work after a major attack); as well as keeping really sensitive business stuff off my internal drive.

Here is a follow-up report.

I am beginning the process of trying to track down which of the three programs installed last week has caused the sudden spontaneous (uninvited) appearance (on Thursday last) of what seems like Unix script on my screen during startup of Mac OS High Sierra (and Mojave also, I have just discovered following installing it in a separate partition, and migrating all software to run under it). In the mean time, I share with you some snippets of information connected with this odd development.

The opening lines of the visible login script are:

"waiting for DSMOS

Darwin/BSD (localhost) (console) login: SDXC

108211 controller: data ... "

The script suddenly appears on the screen after the progress bar of the Mac OS startup process has gone about 60% of the way to its end.

On opening the Terminal window I see that processing of Unix code began at the moment of login and there is this odd line: " -bash: /Users/lestone2/.profile: No such file or directory".

So I am asking myself, what is this file X that is missing, whose code caused the file to be sought, and how did we get that code (the search for missing file X) to execute automatically on login?

In the log (in Library) there is an "ims.log", and a folder named "CoreTelephonyTraceScratch". Inside this folder are two more "ims...log" files, and a "CSI.scratch" folder containing a file named "..x000...csi.txt". Lines in these files suggest to me (a dummy at this stuff, of course) that some kind of tracking is being set up (is someone setting up migrating info. from my computer over to their's, since the word "tracking" is used at least twice on one of these files), and one line includes explicit naming of my iCloud account email address.

I suppose this is all legitimate stuff linked to my free access to this wonderful OS built by Apple staff and supporting developers; but can you tell me very briefly what this is meant to achieve?

Thanks in advance.

PS. If you want to know which program is causing the uninvited piece of "verbose login script" to pop up on my screen let me know. I'll slowly figure out which one is the culprit over the coming days, as I pursue this search as a low-priority project, via OS installations in special test partitions (volumes on external drives).

Reply

Answer 5

Theordore Author

Level 1

4 points

Nov 19, 2018 6:36 AM in response to MrHoffman

Sorry I missed your question about "Etrecheck report", which is new to me. I just did a search to learn about it, and it seems I have to download some 3rd party software. I will do all of this over the next few hours and report again. Cheers!

Reply

Answer 6

Theordore Author

Level 1

4 points

Nov 19, 2018 9:23 AM in response to MrHoffman

A *big* thanks, MrHofman, for teaching me about EtreCheck, whose report I just scanned fairly carefully. Yes, indeed, the Intego Virus Barrier was recently updated, and am also targeting Teamviewer, Flash Player, the Paragon software, the MySQL app installed here, as well as MAMP Pro, all of which have been changed or installed in the last 10 days and do low-level operations.

I forgot to tell you that in my weekend tests, I did a clean install of High Sierra to a wiped partition and no migration of stuff from my old setup before shutting down and starting again. There was no appearance of the problem I have reported when I did the start-up. That result left me confident that I could take my time and find the bad-behaving code and then decide what to do once I found it; since I am fully protected against a major crash, and no testing is done with my main work system other than the use of the motherboard while a test i underway. (All loaded software and data for the tests are coming from external drives.)

Reply

Answer 7

Nov 19, 2018 9:46 AM in response to Theordore

When things go weird, I’d usually remove the anti-malware and anti-virus, as various

of those products have had a history of causing problems and instabilities, and not necessarily providing benefits, and run some tests. The way that a legimate anti-malware tool hooks into a system is often indistinguishable from how malware hooks in.

Unless there’s a specific requirement for the Adobe Flash player (and that can’t also be addressed by HTML5 and a browser), I’d remove that.

Reply

Answer 8

Theordore Author

Level 1

4 points

Nov 19, 2018 6:16 AM in response to MrHoffman

Your note is very helpful, MrHoffman. I will follow the procedures you describe.

Reply

Answer 9

Nov 19, 2018 7:10 AM in response to Theordore

If you should need it, the Etrecheck link was previously posted in this thread.

Reply

Answer 10

Theordore Author

Level 1

4 points

Nov 19, 2018 7:47 AM in response to MrHoffman

Hello again MrHoffman! I have just sent two email messages to "discussions ...", and one has the EtreCheck report. Thanks in advance for your attention.

Reply

Answer 11

Theordore Author

Level 1

4 points

Nov 19, 2018 11:21 AM in response to MrHoffman

Thanks MrHoffman. These are my two top priorities for removal in the next few hours.

Reply

Have I got some malware when my Mac screen shows lines from Unix script on login, instead of going to the password dialogue box?

Similar questions