42
votes
What is this unknown executable on my boot volume? Is it Malicious?
This is SilverInstaller, adware to download more adware and ‘potentially unwanted programs’. This was likely distributed through fake Flash popups, which someone on the system clicked on, downloaded, ...
grg♦
- 206k
32
votes
I think I downloaded spyware! I used a curl command in terminal given by a fake support user to download a .sh file
There's no need to post the script; I downloaded it. It's a highly obfuscated shell script that seems, most importantly, to do the following.
First, it installs an extension (presumably malicious) in ...
- 3,015
28
votes
Mac terminal found open with “man James” text. Have I been hacked?
Maybe you've been hacked, maybe you haven't. But the fact that you got a "man James" window open is a poor indicator of a hack, and it's far more likely that you accidentally triggered the ...
- 1,023
20
votes
Mac terminal found open with “man James” text. Have I been hacked?
I doubt man James was run directly, i.e. by someone typing that in Terminal. The window in your screenshot shows the default theme for man page output.
There is a default text service provided by ...
grg♦
- 206k
14
votes
I think I downloaded spyware! I used a curl command in terminal given by a fake support user to download a .sh file
Based on analysis by Linc D., but I don't see it doing much changes to the system itself.
Instead, the primary impact is this:
Treat all passwords you have stored in any web browser, all browser ...
- 291
13
votes
Accepted
What is the Unknown (0) process with 232 threads on my iPhone?
pid 0 is always kernel_task in xnu. Further corroborated by being owned by root and having a lot of threads. It’s a synthetic process structure that represents the kernel. It isn’t malware.
- 4,964
12
votes
HP Easy Scan - "HP Scanner 3" will damage your computer
This message happens when the certificate used to sign software gets revoked. The OS does check for revocations online so yes it blocks apps even if you don’t update the apps or the OS.
For HP ...
- 241k
12
votes
Unexplained and persistent "OS X 10.13 is not supported" dialog
The problem is with the docker application.
- 131
11
votes
How can I understand an alert of "cpverify" will damage your computer?
What is this?
This is utility associated with CryptoPro app (digital signature app, accepted by Russian government and tax office) which was normally located in /opt/cprocsp.
Apple rejected their dev ...
- 211
9
votes
Accepted
Stopping false positive malware warnings in Catalina?
Unfortunately, this appears to be an issue with HP printer drivers and/or Catalina 10.15.7 - I'm one of many people with the same issue. Lots of us are reporting the same symptoms on the HP Support ...
- 394
9
votes
Unexplained and persistent "OS X 10.13 is not supported" dialog
This comes from Docker. Click the docker icon in the bar and choose Preferences. Go to the Software Updates section and uncheck Automatically check for updates. Click Apply & Restart. It ...
- 191
8
votes
Accepted
Does macOS need antivirus protection?
Most, but not all, Mac virus protection is there to stop Windows viruses being spread further.
That doesn't mean Macs are immune - there are viruses/trojans/malware targeted specifically at Mac users....
- 118k
8
votes
Accepted
HP Easy Scan - "HP Scanner 3" will damage your computer
Edit: While the app now launches, it still won't let me scan. Found this https://forums.macrumors.com/threads/hp-driver-framework-broken-in-catalina-10-15-7.2262865/post-29100622 saying that the ...
- 106
8
votes
What is the process EscrowSecurityAlert in Activity Monitor?
Yes, it's part of macOS & has been since perhaps Mavericks.
Wikipedia lists it in List of macOS components but provides no description -
The iPhone Wiki gives a brief description
This application ...
- 118k
8
votes
What is AirPlayXPCHelper?
No, you aren't. AirPlayXPCHelper is a process of Airplay, a built-in feature of macOS.
- 281
7
votes
Is DetectX itself malware?
I'm the developer of DetectX.
A few facts about my app pertinent to your question:
i. DetectX does not ask for admin rights either to install or run.
ii. DetectX does not install any 'helper' apps ...
- 331
7
votes
flashplayer.dmg is in use and can't empty Trash
open Terminal.app
type rm .Trash/flash_player.dmg and press Enter. This removes the file.
reboot
check whether the file is gone from the Trashcan
It might be helpful to run a malware cleaner ...
- 104k
7
votes
Mac terminal found open with “man James” text. Have I been hacked?
All we can say is that something or someone on your Mac used Terminal to run man James.
running bash -x afterwards doesn‘t help, you may want to look at the bash history though
The Terminal output in ...
- 104k
6
votes
Is it possible or likely for malware or a virus to be transferred by plugging a USB hard drive into my Mac?
Possible: Yes.
Everything is possible. You may have an infection as yet undiscovered which can make the leap, or one buried in some seemingly innocuous file you're about to copy over.
Likely: No.
...
- 118k
6
votes
Are auto-downloaded malicious .dmg app files a security risk if they are never opened?
If I download a malicious .dmg file, but don't click on it to install it, am I safe?
You are safe. The .dmg (disk image) file is not the actual installer. The .dmg must be double-clicked to install ...
- 1,333
6
votes
How can I alert Apple about spyware targetting Apple users?
For what it's worth you can reach Apple's legal department through the contact form on https://www.apple.com/legal/contact/. Picking "Phishing and Spam" from the drop-down leads you to https://support....
- 104k
6
votes
Stopping false positive malware warnings in Catalina?
Download new driver from hp support website can solve this problem.
eg: https://support.hp.com/cn-zh/drivers/selfservice/closure/hp-laserjet-pro-p1106-p1108-printer-series/5099191?ssfFlag=true&sku=...
- 61
6
votes
Accepted
Recommended malware/virus scanner for mac?
I would recommend MalwareBytes. However, macOS already includes XProtect, which is a regularly updated blacklist of malware. On top of that, there are lots of built-in security features that make it ...
- 38k
6
votes
Mac terminal found open with “man James” text. Have I been hacked?
You were not hacked.
Somehow a keyboard shortcut was accidentally triggered.
This is mentioned in 200_success’s answer, but I am posting my own answer to add more specific details and references.
...
- 5,790
6
votes
Accepted
Is there a valid reason why Canon's webcam plugin asks to scan my external drives?
Did I install a malware?
No. While I can’t speak to the quality of the software produced (I use Nikon and find their software mediocre at best) it’s not malware that will harm your computer.
Is ...
- 104k
5
votes
Eliminate com.adobe.ARMDC.Communicator.plist malware
These are probably real Adobe files, but I'm deleting them because I didn't authorize their installation and they're useless daemons running at launch. The "ARM" ones are apparently for alerting you ...
- 182
5
votes
Accepted
How to detect if OS and Machine fingerprint has been corrupted by malware?
The linked document specifies a data exchange format based on XML. It describes how to package all data (including the fingerprint.codex.xml) in 3. (U) Directory Structure.
The whole CODEX data ...
- 67k
5
votes
Is my mac being hacked by a user called Guatoan? And how can I remove this user?
It’s not clear what user ID you are running - so to rule that out - what does this command show?
id
Next, you’ll want to inventory your backups to know if you can erase everything and or need to ...
- 220
5
votes
Accepted
Prevent Spam Downloads on Safari
Wouldn't this be a good case for a Safari content blocker / javascript blocker that's selective?
Ghostery might be a good place to start on the Mac to see if you can use pre-built rules to quash ...
- 241k
5
votes
Prevent Spam Downloads on Safari
While there many capable ad blockers for Safari, there are far fewer choices for wider-spectrum, extension-based content-blockers. Of those, only two stand out: Ghostery and uBlockOrigin [information ...
- 2,533
Only top scored, non community-wiki answers of a minimum length are eligible