Is this a Mac Malware

Question

Today I was downloading some apps for an old windows PC I own using my MacBook Pro which has High Sierra. I downloaded Internet Explorer app from a googled source that I knew wasn't secure. And then via USB I installed it in my Windows PC, which didn't had a browser.

After a few minutes my mac started to write only in uppercase and I noticed so I launched the keyboard watch app, and it had both shift keys continuously pressed. I decided to restart. But then when I entered the password it didn't work, I checked a few times and nothing.

There was this note on screen that said I could reset password pressing power until it powers off and then powering on again so I took that path and reset the password this time to just numbers to escape the uppercase. But it didn't work, and even thou I reset my Mac's password it still has the old password hint.

Suddenly the screen showed me as follows: If your password is correct but don't let you enter your account, maybe it is not compatible with file vault. Here it started getting suspicious. But I deactivated File vault using my password and the thing is that in this interface, and in the interface of changing passwords the old password worked! Then I really thought I was being victim of fishing.

Here is the thing, there's this malware extracting info by taking screenshots and saving keyboard pulsations, so maybe I am infected

I could be infected

I don't know what to do. I disconnected from wifi but I need to know if I can solve it, if this is a keyboard issue or if it is a malware. Note: The screens of the interfaces when I was asked to input my passwords looked strange to me. I saw this message too. Input your password to unlock your HDD and the password worked even when I was to supposed to got that changed 5 minutes earlier.

Answer 1

MalwareBytes free can help you, scanning your Mac : https://www.malwarebytes.com/mac

MalwareBytes in free version can be updated and the only restriction is that scans of your Mac are triggered manually. The benefit of a tool is you don’t need to learn a lot about how processes start or stop or pick apart the most common unwanted software and malware.

Answer 2

I think your best chance to tackle this, or rule out it's malware would be to create a rescue disk to boot from and then scan your hard drive. I suggest downloading one from a different computer altogether and then boot into it. Unfortunately it seems there is no anti-virus/anti-malware on a bootable CD/USB drive as such, but you can create a bootable macOS on a USB drive or external hard drive.

Make sure you create one from a separate (ie. not your maybe infected) Mac:

• Format your drive using Disk Utility, download the latest macOS 10.13 High Sierra installer from the App Store and install it to the external drive.
• Install one of those free virus scanners for Mac, e.g. from Bitdefender or Malwarebytes
• Plug the drive into your switched off potentially infected Mac
• Start it up holding ⌥ at startup to select the newly attached drive.
• Once you booted from it, you can scan your disk.

Since your issue was related to characters typed in, you might also want to try a separate keyboard first to rule out (or confirm) the keyboard as the culprit.

Personally, I've invested in a subscription of Bitdefender, Little Snitch as well as offline and online backups. While I have never had a malware infection that I'm aware of, I'm not taking my chances. Little Snitch is good for detecting which app wants to phone home. Both run quite unobtrusively in the background. Bitdefender downloads its regular updates and lets me know about them, but that's all. It's a little price for the hassle and the pain of data loss.

Good luck!