2

Running macOS 10.14.2. Safari 12.0.1.

Symptoms:

  • Safari redirects searches through proxy to bing
  • Chrome redirects searches through proxy to bing
  • In Privacy Settings, under Automation "Finder" with no icon has access to Safari
  • When removing it, a preferences pop up shows up.
  • Immediately after a memory warning shows up and cancel the preferences pop up.
  • "Finder" reappears under "Automation" with safari checked.
  • When quitting Safari, it launches alone. (Can't close safari)

Attempts: Used "tccutil reset AppleEvents", both pop ups appear once after execution. Used Avira anti-virus with quick scan it found and eliminated 1 virus, ran a full scan and it found and removed 4. Did not run it again.

No clue how to remove this without disabling SIP which is not something I necessarily want to do, nor would I know how to exactly find "Finder".

It also seems to be using some exploit to grant itself Automation privileges even after you uncheck them via some memory issue that triggers the memory warning.

How can malware like this be cleaned?

  • I would do a fresh install of the system just to see if that helps, but backup your personal files ... – Solar Mike Feb 1 at 5:39
  • Do you mean macOS 10.14.2? 10.4 is very, very old. – Wowfunhappy Feb 2 at 19:18
  • Anyone know what virus this is? – Wowfunhappy Feb 2 at 19:21
  • 1
    @Wowfunhappy Malwarebytes called it OSX Genieo. Also yes I meant 10.14. – Ge0rges Feb 2 at 19:34
2

I wouldn't disable SIP if you have active malware on your system. If you have another Mac you can use or borrow, I'd boot your Mac into Target Disk Mode, connect it to the other Mac with a Thunderbolt cable, and then run both Avira and Malwarebytes on it from the other Mac. This allows the antimalware software to ignore any SIP protection on the TDM'd Mac and perform a full clean.

If you can't use another Mac, then install a bootable copy of macOS onto an external drive, boot from that, and do the same.

If you can't do either, boot into Safe Mode, run Avira, and then if it finds something, let it clean it and then reboot again into Safe Mode. Now run Malwarebytes and do the same. Always reboot after a pass where it found something, because whatever it is that it found may be preventing you from finding anything further until you reboot with it gone.

  • After every pass Avira finds a different number of viruses. Never 0. – Ge0rges Feb 1 at 17:17
  • Are you attempting cleanup while booted from the infected filesystem, or using another option I mentioned earlier? – Craig Stodolenak Feb 1 at 17:27
  • 1
    Safe Mode option. However I ended up switching to malware bytes and it worked. – Ge0rges Feb 2 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .