1

since about a week there is a strange behaviour in my girlfriend's MacBook Air (Retina, 13-inch, 2018).

# uname -a
Darwin Air 18.2.0 Darwin Kernel Version 18.2.0: Thu Dec 20 20:46:53 PST 2018; root:xnu-4903.241.1~1/RELEASE_X86_64 x86_64

I have the supposition that this comes from me trying to get the Java Runtime Environment from this site: https://mac.filehorse.com/download-java-runtime/6018/

I want the JRE in order to run a .jar-file that allows me to control the mouse-pointer over WLAN. Which by the was I have not achieved yet...


The symptoms

Given that we mainly use this device to watch movies and series, this is also the only time when the weird crash happens. While streaming something (e.g. from Netflix) about one hour into the show - but always a different time - there is a crash. Safari closes and a strange software loads. It comes from "nowhere" and it has a different name every time. It has happened 3 or 4 times, once it was called "VirtualBasic", another time "GeneralLauncher", and another "DeluxeFocus". This "programs" appear as Safari extensions AND as Applications. I can't remove the extension without removing the software first. I am an iDevice-newbie so I have "deinstalled" the Applications by deleting it and emptying the Trash (is this the correct way to do it?). They appear in the Launchpad but they have no "x" to delete them.

The second time it happened I was very surprised, so I opened a terminal and ran # find / -name "*eneral*aunche*" and this is the output

/Library/Logs/DiagnosticReports/GeneralLaunch_2020-03-24-213804_USER-MacBook-Air.hang
/private/var/folders/4y/92hdyw2d0l3g6k9_7gg97gnc0000gn/T/com.q2wygenerallaunch
/private/var/folders/4y/92hdyw2d0l3g6k9_7gg97gnc0000gn/C/com.q2wygenerallaunch
/private/tmp/0B1ACE5D-1148-43D7-9D51-F71E51769C4D/CFFEEB77-DC26-4A97-89D3-61EAA536B8BC/GeneralLaunch.app
/private/tmp/0B1ACE5D-1148-43D7-9D51-F71E51769C4D/CFFEEB77-DC26-4A97-89D3-61EAA536B8BC/GeneralLaunch.app/Contents/MacOS/GeneralLaunch
/private/tmp/0B1ACE5D-1148-43D7-9D51-F71E51769C4D/CFFEEB77-DC26-4A97-89D3-61EAA536B8BC/GeneralLaunch.app/Contents/PlugIns/GeneralLaunch-extension.appex
/private/tmp/0B1ACE5D-1148-43D7-9D51-F71E51769C4D/CFFEEB77-DC26-4A97-89D3-61EAA536B8BC/GeneralLaunch.app/Contents/PlugIns/GeneralLaunch-extension.appex/Contents/MacOS/GeneralLaunch-extension
/Users/USER/Library/Application Support/CrashReporter/GeneralLaunch_F3FDB7C8-2CFF-5D8E-9247-9E40FBFE719C.plist
/Users/USER/Library/Application Scripts/com.q2wygenerallaunch
/Users/USER/Library/Logs/DiagnosticReports/GeneralLaunch_2020-03-24-213852_Emmas-MacBook-Air.crash
/Users/USER/Library/Group Containers/group.com.q2wygenerallaunch
/Users/USER/Library/Containers/com.q2wygenerallaunch
/Users/USER/Library/Containers/com.q2wygenerallaunch/Data/Library/Application Support/CrashReporter/GeneralLaunch_F3FDB7C8-2CFF-5D8E-9247-9E40FBFE719C.plist
/Users/USER/Library/Containers/com.q2wygenerallaunch/Data/Library/Preferences/shared.com.q2wygenerallaunch.plist
/Users/USER/Library/Containers/com.q2wygenerallaunch/Data/Library/Application Scripts/com.q2wygenerallaunch
/Users/USER/Applications/GeneralLaunch

The sneaky software seems to be everywhere! I deleted all those files, hoping for the best, but the crash happened again! Now with the other name. So, I did the same to track it down a bit:

# find / -name "*elux*ocu*"   
/private/var/folders/4y/92hdyw2d0l3g6k9_7gg97gnc0000gn/T/com.3xit0deluxefocus
/private/var/folders/4y/92hdyw2d0l3g6k9_7gg97gnc0000gn/C/com.3xit0deluxefocus
/private/tmp/EE53DC69-E4CD-41C3-B924-6F250F2819F9/2E683D7E-EB38-49AF-8463-0A16DD58FF5D/DeluxeFocus.app
/private/tmp/EE53DC69-E4CD-41C3-B924-6F250F2819F9/2E683D7E-EB38-49AF-8463-0A16DD58FF5D/DeluxeFocus.app/Contents/MacOS/DeluxeFocus
/private/tmp/EE53DC69-E4CD-41C3-B924-6F250F2819F9/2E683D7E-EB38-49AF-8463-0A16DD58FF5D/DeluxeFocus.app/Contents/PlugIns/DeluxeFocus-extension.appex
/private/tmp/EE53DC69-E4CD-41C3-B924-6F250F2819F9/2E683D7E-EB38-49AF-8463-0A16DD58FF5D/DeluxeFocus.app/Contents/PlugIns/DeluxeFocus-extension.appex/Contents/MacOS/DeluxeFocus-extension
/Users/USER/Library/Application Scripts/com.3xit0deluxefocus
/Users/USER/Library/Group Containers/group.com.3xit0deluxefocus
/Users/USER/Library/Containers/com.3xit0deluxefocus
/Users/USER/Library/Containers/com.3xit0deluxefocus/Data/Library/Preferences/shared.com.3xit0deluxefocus.plist
/Users/USER/Library/Containers/com.3xit0deluxefocus/Data/Library/Application Scripts/com.3xit0deluxefocus
/Users/USER/Library/Containers/com.3xit0deluxefocus/Data/Library/Caches/com.3xit0deluxefocus
/Users/USER/Applications/DeluxeFocus
/Users/USER/Applications/DeluxeFocus/DeluxeFocus.app
/Users/USER/Applications/DeluxeFocus/DeluxeFocus.app/Contents/MacOS/DeluxeFocus
/Users/USER/Applications/DeluxeFocus/DeluxeFocus.app/Contents/PlugIns/DeluxeFocus-extension.appex
/Users/USER/Applications/DeluxeFocus/DeluxeFocus.app/Contents/PlugIns/DeluxeFocus-extension.appex/Contents/MacOS/DeluxeFocus-extension

but I don't know what to do next...


what should I do? is the system infected with something? can it be removed? should I reinstall Safari? can I track this software down and deactivate it from running again?

Thanks


Updates based on comments
From the comment by Tetsujin I decided to try the freeware Malwarebytes and it did find 4 threats on the first scan:

SearchSkilledData

I have quarentined those threats. Let's see how things develop.
Based on that I decided to also run the following on terminal as an extended preventive measurement:

# find / -name "*earch*killed*"
/Library/Application Support/com.SearchSkilledDataDaemon
/Library/Application Support/com.SearchSkilledDataDaemon/SearchSkilledData
/Library/LaunchDaemons/com.SearchSkilledDataDaemon.plist
/Users/USER/Library/Application Support/com.SearchSkilledData
/Users/USER/Library/Application Support/com.SearchSkilledData/SearchSkilledData
/Users/USER/Library/LaunchAgents/com.SearchSkilledData.plist
8
  • 1
    Start with Malwarebytes – Tetsujin Mar 31 '20 at 6:40
  • You might want to get rid of /Users/USER/Applications/GeneralLaunch and Users/USER/Applications/DeluxeFocus if these are applications you don't remember installing yourself, and also remove Library/LaunchDaemons/com.SearchSkilledDataDaemon.plistand /Users/USER/Library/LaunchAgents/com.SearchSkilledData.plist, followed by a reboot. – nohillside Mar 31 '20 at 8:05
  • 1
    Given that it’s mainly to watch Netflix, why not just wipe the drive and reinstall the OS? – Allan Mar 31 '20 at 8:09
  • And then download Java directly from java.com/en/download/mac_download.jsp – nohillside Mar 31 '20 at 8:51
  • @Allan hehe thaksn, but no... – scjorge Mar 31 '20 at 9:20

You must log in to answer this question.

Browse other questions tagged .