1

All of a sudden my mac has started prompting me to enter my password with the dialog: "Network Configuration needs to update DHCP setting. Type your password to allow this."

enter image description here

I've just recently installed MakeMKV on my laptop... could my Mac have caught something nasty?

As a side note: Is there a way I can find out which process is creating the pop-up window?

|improve this question
  • If I click cancel, the window just re-appears immediately... – Ben Schwabe May 5 '17 at 3:05
4

You've got a trojan! Look at the Directory ~/Library/VideoFrameworks The Trojan collected your keychain and browser-data there.

The program itself resides in ~/Library/RenderFiles

You can stop it with launchctl stop fr.handbrake.activity_agent

Did you install handbrake as well or just makemkv?

I would recommend to make a clean install of osx or install your time-machine backup from before the installation of the program.

Update: I cannot comment here, so I try to edit my answer with additional information:

The trojan collects at least the following data:

  • Keychain files (saved passwords in OSX)
  • Personal data from every browser on your system including saved passwords
  • Screenshots

So you really should check which passwords you saved in the keychain and the browser and change them immediately on another computer. You can find the data that it collected in the directory described above in several zip-files.

Do you remember where you downloaded handbrake? Did you use the update function?

|improve this answer
  • Bugger! Yeah I did install Handbrake too.... :( Thanks Dave, ugh, I was hoping to be able to avoid a re-install... – Ben Schwabe May 6 '17 at 1:28
  • Same, just got Handbrake and it asked for my password to install extra codecs, now the DHCP setting box won't go away. Nuts. – Craig May 6 '17 at 4:39
  • I have neither of the files you/directories you listed. How did you know those were the ones, I might use the same method to find the ones being used on my system – Craig May 6 '17 at 9:12
  • you can execute "launchctl list" to see a list of services. The service that shows the dialog about needing to update the dhcp settings is called fr.handbrake.activity_agent. And have a look at ~/Library/LaunchAgents. "launchctl list fr.handbrake.activity_agent" gives information about the service. – Dave May 6 '17 at 9:20
  • 1
    I cannot tell how it behaves on other systems, but chances are that it deleted the files after it was successful. You might check if you have the following files in the /tmp directory: au, au.pub, public.pem. But the directory gets cleared after a reboot. You could also look after traces of "activity_agent" in the system-log (start console-app). For example under "User Diagnostic reports". I found a crash-log there. – Dave May 6 '17 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .