2

My roommate brought me her iMac this afternoon because it's been behaving very badly since she upgraded to High Sierra. It turns out that her boyfriend has gotten a lot of malware onto it, and I'm having real problems getting rid of it.

The biggest culprit is a set of browser hijackers (they may all be related, or they may be separate malware, I'm not sure), including well-known ones like G-Search.Pro, and others (feedvertizus, beleelashopper, etc).

I cannot figure out where these things have stuck themselves to get rid of them. So far, I have:

  • Deleted any installed applications I didn't recognize.
  • Installed and run MalwareBytes, which claims I have no malware.
  • Installed and run AVG Anti-Virus, which claims I'm clean.
  • Completely deleted Chrome and Firefox from the machine and reinstalled.
  • Checked the LaunchAgents folders in /Library, /System/Library, and /Users/user/Library for anything odd.
  • Checked the LaunchDemons folders in the same places.
  • Removed anything from Application Support folders that looked suspicious.

All to no avail. A clean, fresh install of Chrome immediately gets infected with G-Search.pro and these other things. I'm at my limit of OS X knowledge so I have no idea where else to look.

Where could these things be hiding, or where can I go (are there system logs, etc.?) to find out?

  • I’d check the Chrome and Firefox data folders. I don’t remember exactly where they are, and I’m AFK now (using my phone) but they’re somewhere in the above mentioned Library folders. – NoahL May 28 '18 at 4:56
  • I found and deleted those as well. Is there any kind of "global preferences" type folder where stuff might be registering itself? – Michael Edenfield May 28 '18 at 5:17
  • You mentioned having completely deleted and reinstalled Chrome and Firefox, but what about Safari? Obviously it's installed on the system, so I'd be checking that as well. Launch Safari, go to Safari > Preferences, select the Extensions tab and check for any signs of GSearchPro etc in there. – Monomeeth May 28 '18 at 8:42
  • 2
    Create a new account. If the problem goes away, it's not system wide. It's probably easier to just migrate data over than to go on a never-ending hunt for malware. – Allan May 28 '18 at 8:56
  • There are articles "how to get rid of g-search.pro", etc. (I realize that this was just one among many and I didn't address any others). From a security aspect, the question becomes "how can you know you found everything?" For this reason I tend to recommend you (a) backup all of your important data (documents, photos, etc.) and (b) do a complete wipe & re-install, then (c) restore just the data (do not 'restore' applications ... safer to re-download applications and install from known-good source.) – Tim Campbell Jun 9 at 22:03
2

In case anyone else gets infected by this, here's what I ultimately discovered:

The virus had installed a local web proxy, and a background service that was constantly monitoring the system's proxy settings and "restoring" them to point to itself. I discovered this when I noticed that Safari was throwing SSL warnings for everything, and that YouTube was returning empty responses and proxy errors trying to watch videos.

The proxy also appears to have been preventing Chrome's sync from working, and preventing me from activating several anti-virus programs that require online activation.

I was able to find it using lsof to see what was listening on the port that kept setting itself up as the local proxy. It had installed a mono application using the Titanium web proxy NuGet package, into /usr/local/srcsrv.

Once I killed that, the behavior of the web browser returned to normal except for the "New Tab" page in Google still pointing to G-Search.pro. I haven't yet tried to delete and reinstall Chrome a second time, but I did add several domains to /etc/hosts to prevent them from phoning home.

  • The above answer worked for me. I ended up deleting almost everything under /usr/local/srcsrv. I then restarted the computer and the network connection didn't work. I had to go to Network -> Advanced -> Proxies to deselect the HTTP and HTTPS proxies that the malware was using. After that the internet worked and the proxy services didn't restart themselves. – user1880798 Jun 9 at 20:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .