Malware sul mio mac

[nene]

Buona sera, mi dicono che probabilmente ho qualche malware sul mio iMac e non so come fare una pulizia nel caso ci fosse qualche elemento sospetto, non ho antivirus anche se mi consigliano di prendere uno, per favore un aiuto su come fare?, tutto è partito perché il mio provider mi ha bloccato temporaneamente internet per un presunto malware nel mio sistema, poi ho chiamato per farlo sbloccare ma risulta che nel mio sistema operativo qualche malware ci sia .... ho un iMac 24 inca,M1 2021, chip Apple m1, ventura 13.1, grazie mille

[spegahsheen]

Come prima cosa farei una scansione con DetectX Swift. Poi aspetterei ulteriori suggerimenti da altri utenti del forum più esperti di me

[mauripucci]

... ho un iMac 24 inca,M1 2021, chip Apple m1, ventura 13.1

Ventura 13.1 ovvero una versione del dicembre 2022, oggi siamo alla 13.6.4.
Oltre a far girare -come già suggerito- DetectX Swift.app, provato ad aggiornare?

[Alberto.G]

..., per favore un aiuto su come fare?, ...

Il primo aiuto che ti possiamo dare (siamo tutti d’accordo su questo) è NON installare nessun antivirus… nulla!

Poi come ti ha suggerito spegahsheen esegui la scansione con DetectX, un programma che è gratis ed è utile in questi casi.

Per postare correttamente il report che viene prodotto, ti consiglio di leggere il Tutorial che ho preparato, vedi link
viewtopic.php?f=33&t=52394

E' facile.

[nene]

rieccomi spero di aver fatto tutto giusto come chiesto, e vi ringrazio per l'aiuto, nel frattempo ho aggiornato il mac a Sonoma 14.3.1 (23D60)

Codice: Seleziona tutto

Timestamp (6): Mon Feb 12 21:51:58 2024
DetectX Swift v1.0983

macOS: Version 14.3.1 (Build 23D60)
File System: apfs
Temp: The thermal state is within normal limits.

Boot time: Mon Feb 12 21:34:02 2024
Uptime: 18 mins, 1 user

Spotlight status for /:
	Indexing enabled. 
System Integrity Protection status: enabled.
Gatekeeper status: enabled for App Store and identified developers.
FileVault is On.

Internet:	Reachable


    Hardware Overview:

      Model Name: iMac
      Model Identifier: iMac21,1
      Model Number: Z12W001DYSM/A
      Chip: Apple M1
      Total Number of Cores: 8 (4 performance and 4 efficiency)
      Memory: 16 GB
      System Firmware Version: 10151.81.1
      OS Loader Version: 10151.81.1
      Provisioning UDID: 00008103-001448561ED0C01E
      Activation Lock Status: Enabled



  Sharing Preferences:

	File Sharing:  On
	Screen Sharing:  On
	Remote Management:  Off
	Back To My Mac:  Off
	Remote Login:  Off
	Remote Apple Events:  Off


3rd Party Kexts (loaded):



 $PATH:

PATH=/usr/bin:/bin:/usr/sbin:/sbin


/etc/paths:
	/usr/local/bin
	/System/Cryptexes/App/usr/bin
	/usr/bin
	/bin
	/usr/sbin
	/sbin

/etc/paths.d/:
	/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin
	/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin
	/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin

~/.bash_profile:
	
~/.bashrc:

~/.bash_login:

~/.profile:

~/.bash_logout:


PID	Status	Label
-	0	com.bittorrent.uTorrent
-	0	com.openssh.ssh-agent
-	0	com.microsoft.update.agent
-	78	com.teamviewer.desktop
-	0	com.oracle.java.Java-Updater
2198	0	application.com.sqwarq.DetectX-Swift.19855813.19855825
-	0	com.microsoft.OneDriveStandaloneUpdater
-	78	com.teamviewer.teamviewer
-	0	com.dropbox.DropboxMacUpdate.agent


 System Launchd processes:

0      - 	com.purevpn.macapp.HelperTool
0      - 	com.vix.cron
0     78 	com.teamviewer.service
0      - 	com.google.GoogleUpdater.wake.system
0      - 	com.teamviewer.Helper
0      - 	com.microsoft.office.licensingV2.helper
0      0 	com.microsoft.autoupdate.helper
0      0 	org.cups.cupsd
886      - 	com.microsoft.OneDriveStandaloneUpdaterDaemon
0      - 	com.microsoft.OneDriveUpdaterDaemon
0      - 	com.oracle.java.Helper-Tool



 User Login Items:
 
	/Applications/Surfshark.app
	/Applications/Surfshark.app/Contents/Library/LoginItems/LaunchAgent.app
	/Applications/uTorrent Web.app
	/Applications/Dropbox.app



 /Library/LaunchDaemons:

	com.microsoft.OneDriveStandaloneUpdaterDaemon.plist
		-> Program: /Applications/OneDrive.app/Contents/StandaloneUpdaterDaemon.xpc/Contents/MacOS/StandaloneUpdaterDaemon
	
	com.microsoft.OneDriveUpdaterDaemon.plist
		-> Program: /Applications/OneDrive.app/Contents/OneDriveUpdaterDaemon.xpc/Contents/MacOS/OneDriveUpdaterDaemon
	
	com.google.GoogleUpdater.wake.system.plist
		--> Program Arguments: /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
		--> Program Arguments: --wake-all
		--> Program Arguments: --enable-logging
		--> Program Arguments: --vmodule=*/components/update_client/*=2,*/chrome/updater/*=2
		--> Program Arguments: --system
	
	com.purevpn.macapp.HelperTool.plist
		-> Program: /Library/PrivilegedHelperTools/com.purevpn.macapp.HelperTool
		--> Program Arguments: /Library/PrivilegedHelperTools/com.purevpn.macapp.HelperTool
	
	com.google.keystone.daemon.plist
	
	com.apple.installer.osmessagetracing.plist
		--> Program Arguments: /System/Library/PrivateFrameworks/OSInstaller.framework/Resources/OSMessageTracer
	
	com.teamviewer.Helper.plist
		-> Program: /Library/PrivilegedHelperTools/com.teamviewer.Helper
		--> Program Arguments: /Library/PrivilegedHelperTools/com.teamviewer.Helper
	
	com.teamviewer.teamviewer_service.plist
		--> Program Arguments: /Applications/TeamViewer.app/Contents/MacOS/TeamViewer_Service
		--> Program Arguments: -Module
		--> Program Arguments: Full
	
	com.microsoft.office.licensingV2.helper.plist
		-> Program: /Library/PrivilegedHelperTools/com.microsoft.office.licensingV2.helper
		--> Program Arguments: /Library/PrivilegedHelperTools/com.microsoft.office.licensingV2.helper
	
	com.oracle.java.Helper-Tool.plist
		--> Program Arguments: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool
	
	com.microsoft.autoupdate.helper.plist
		-> Program: /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper
	



 /Library/LaunchAgents:

	com.google.keystone.xpcservice.plist
	
	com.teamviewer.teamviewer_desktop.plist
		--> Program Arguments: /Applications/TeamViewer.app/Contents/Helpers/TeamViewer_Desktop
		--> Program Arguments: -RunAsAgent
		--> Program Arguments: YES
		--> Program Arguments: -Module
		--> Program Arguments: Full
	
	com.google.keystone.agent.plist
	
	com.teamviewer.teamviewer.plist
		--> Program Arguments: /Applications/TeamViewer.app/Contents/MacOS/TeamViewer
		--> Program Arguments: -RunAsAgent
		--> Program Arguments: YES
	
	com.oracle.java.Java-Updater.plist
		--> Program Arguments: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/JavaUpdater.app/Contents/MacOS/JavaUpdater
		--> Program Arguments: -bgcheck
	
	com.microsoft.OneDriveStandaloneUpdater.plist
		-> Program: /Applications/OneDrive.app/Contents/StandaloneUpdater.app/Contents/MacOS/OneDriveStandaloneUpdater
	
	com.microsoft.update.agent.plist
		--> Program Arguments: /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
		--> Program Arguments: --launchByAgent
	



 ~/Library/LaunchAgents:

	com.dropbox.DropboxMacUpdate.agent.plist
		--> Program Arguments: /Users/[U502]/Library/Dropbox/DropboxMacUpdate.app/Contents/MacOS/DropboxMacUpdate
		--> Program Arguments: -check
		--> Program Arguments: periodic
	
	com.bittorrent.uTorrent.plist
		--> Program Arguments: /usr/bin/open
		--> Program Arguments: -n
		--> Program Arguments: /Applications/uTorrent.app
	

 User Crontab:

	No cron jobs



 /etc:

	kcpassword
	rc.common
	bashrc_Apple_Terminal
	zshrc_Apple_Terminal
	bashrc
	krb5.keytab~orig
	zshrc
	rc.netboot
	localtime~orig
	efax.rc~previous
	ntp.conf~orig
	php.ini.default-previous~orig
	php.ini.default-5.2-previous
	aliases
	uucp / .. children: 3
	zprofile

 / $Root:

	.file
	.VolumeIcon.icns
	opt / .. children: 0

 ~/ $Home:

	eTax_ticino2017-macos.dmg
	.config / .. children: 3
	Music / .. children: 24
	eTax_ticino2022-macos.dmg
	.install4j
	iCloud Drive (Archivio) - 1 / .. children: 8
	.CFUserTextEncoding
	eTax_ticino2016-macos.dmg
	iCloud Drive (Archivio) / .. children: 2
	.icesoft / .. children: 1
	Pictures / .. children: 23
	Desktop / .. children: 44
	Library / .. children: 115
	Cereto P. Sara_Massagno.tipf2020-new.pdf
	.oracle_jre_usage / .. children: 25
	.android / .. children: 3
	eTax_ticino2020-macos.dmg
	.cups / .. children: 1
	Sites / .. children: 1
	.bash_sessions / .. children: 4
	.DDPreview / .. children: 1
	Public / .. children: 4
	.dropbox / .. children: 12
	eTax_ticino2018-macos.dmg
	iCloud Drive (Archivio) - 2 / .. children: 6
	Movies / .. children: 10
	Applications / .. children: 1
	Dropbox / .. children: 14
	.Trash / .. children: 1
	Documents / .. children: 77
	.mcf / .. children: 2
	eTax_ticino2019-macos.dmg
	.dvdcss / .. children: 3
	Downloads / .. children: 65
	.cache / .. children: 2
	.bash_history



 ~/Library:

	Daemon Containers / .. children: 5
	com.apple.appleaccountd / .. children: 3
	Filters / .. children: 0
	CloudStorage / .. children: 0
	Address Book Plug-Ins / .. children: 4
	studentd / .. children: 3
	PDF Services / .. children: 0
	Staging / .. children: 0
	HomeKit / .. children: 32
	DES / .. children: 3
	com.apple.WatchListKit / .. children: 2
	com.apple.aiml.instrumentation / .. children: 3
	Translation / .. children: 2
	Trial / .. children: 4
	UIKitSystem / .. children: 1
	Google / .. children: 1
	Contacts / .. children: 1
	Family / .. children: 1
	ResponseKit / .. children: 10
	AppleMediaServices / .. children: 3
	com.apple.icloud.searchpartyd / .. children: 11
	DataAccess / .. children: 1
	SafariSandboxBroker / .. children: 0
	Personas / .. children: 3
	DuetExpertCenter / .. children: 9
	HTTPStorages / .. children: 42
	DataDeliveryServices / .. children: 1
	FrontBoard / .. children: 3
	News / .. children: 1
	Biome / .. children: 5
	EQATEC Analytics / .. children: 3
	IntelligencePlatform / .. children: 28
	Shortcuts / .. children: 4
	UnifiedAssetFramework / .. children: 5
	Dropbox / .. children: 1
	Finance / .. children: 9
	Weather / .. children: 15
	com.apple.bluetoothuser / .. children: 1
	ContainerManager / .. children: 5
	Intents / .. children: 1
	Fonts Disabled / .. children: 0
	PersonalizationPortrait / .. children: 7
	Photos / .. children: 1
	Accessibility / .. children: 4
	userData / .. children: 4
	Reminders / .. children: 1
	com.apple.bluetooth.services.cloud / .. children: 3
	com.apple.iTunesCloud / .. children: 3
	StatusKit / .. children: 1
	DoNotDisturb / .. children: 1
	LockdownMode / .. children: 0



 ~/Library/Application Support:

	com.apple.sbd / .. children: 1
	com.apple.replayd / .. children: 0
	DrFoneApps / .. children: 3
	DropboxElectron / .. children: 7
	SyncServices / .. children: 1
	com.apple.kvs / .. children: 1
	Mozilla / .. children: 1
	networkserviceproxy / .. children: 3
	com.apple.transparencyd / .. children: 5
	com.apple.touristd / .. children: 25
	Hewlett-Packard / .. children: 0
	DiskImages / .. children: 1
	Microsoft AU Daemon / .. children: 2
	EasyFind / .. children: 0
	DiskDrill / .. children: 2
	CoreParsec / .. children: 0
	com.apple.ap.promotedcontentd / .. children: 4
	BenVista / .. children: 2
	Aiseesoft Studio / .. children: 1
	com.apple.exchangesync / .. children: 0
	OneDriveStandaloneUpdater / .. children: 1
	Animoji / .. children: 2
	2022-08-16-api.txt
	com.apple.akd / .. children: 2
	Skype Helper / .. children: 0
	2022-08-16-log.txt
	MobileSync / .. children: 1
	Smartflix / .. children: 4
	uTorrent / .. children: 372
	Google / .. children: 4
	Kaspersky Lab / .. children: 1
	Microsoft / .. children: 3
	com.apple.MediaPlayer / .. children: 1
	Oracle / .. children: 1
	dr.fone / .. children: 1
	dmd / .. children: 0
	homeenergyd / .. children: 1
	com.malwarebytes.mbam.frontend.application / .. children: 1
	Java / .. children: 8
	com.microsoft.OneDriveStandaloneUpdater / .. children: 1
	com.apple.NewDeviceOutreach / .. children: 1
	T / .. children: 1
	CEF / .. children: 1
	AKVIS / .. children: 1
	Visan / .. children: 2
	VLC / .. children: 1
	TrustedPeersHelper / .. children: 0
	com.crashlytics / .. children: 1
	EtreCheck / .. children: 1
	Adobe / .. children: 3
	MediaHuman / .. children: 1
	org.videolan.vlc / .. children: 1
	DesktopDPO-d00b9882479ed9b4899926f5c7e44f49 / .. children: 2
	Gtk2 / .. children: 3
	TeamViewer / .. children: 1
	HP Photo Creations / .. children: 1
	com.sqwarq.DetectX-Swift / .. children: 4
	Aperture / .. children: 0
	com.apple.ContextStoreAgent / .. children: 0
	com.surfshark.vpnclient.macos.direct / .. children: 1
	FileProvider / .. children: 12
	com.smartflix.Smartflix.ShipIt / .. children: 0
	FaceTime / .. children: 3
	Folx / .. children: 8
	WAF / .. children: 4
	Dropbox / .. children: 4
	com.apple.AMPLibraryAgent / .. children: 2
	Preview / .. children: 0
	com.apple.windowmanager / .. children: 1
	µTorrent / .. children: 1
	Information Factory / .. children: 95
	DVD Player / .. children: 1
	uTorrent Web / .. children: 6
	wondershare / .. children: 2
	com.apple.wallpaper / .. children: 1
	Skype / .. children: 11
	com.apple.siri.inference / .. children: 1
	Microsoft Update Assistant / .. children: 2
	com.apple.avfoundation / .. children: 1
	transparencyd / .. children: 0
	Helper / .. children: 1
	Microsoft AutoUpdate / .. children: 2
	DesktopDPO / .. children: 2
	com.malwarebytes.mbam.frontend.agent / .. children: 1
	TemWebRTCPlugin / .. children: 2
	Movavi Photo Editor 3 / .. children: 1
	syncdefaultsd / .. children: 0
	Google Earth / .. children: 3
	com.apple.RemoteManagementAgent / .. children: 3
	GIMP / .. children: 1
	Megadede / .. children: 11
	JREInstaller / .. children: 1
	com.apple.accounts.dom / .. children: 0
	Eltima Software / .. children: 0
	DesktopDPO-6bc83914cf7cb3dd8e394440f92a9b6d / .. children: 2



 ~/Library/Safari/Extensions:

	Pin It Button.safariextz
	Extensions.plist



 ~/Library/Internet Plug-Ins:

	Folx3Plugin.plugin



 /Users/Shared:

	Previously Relocated Items 8 / .. children: 3
	Previously Relocated Items 1 / .. children: 3
	Previously Relocated Items 6 / .. children: 3
	Previously Relocated Items 7 / .. children: 3
	SC Info / .. children: 0
	Previously Relocated Items 9 / .. children: 3
	Previously Relocated Items 15 / .. children: 3
	Previously Relocated Items 12 / .. children: 3
	Previously Relocated Items 24 / .. children: 3
	Previously Relocated Items 23 / .. children: 3
	Previously Relocated Items 22 / .. children: 3
	Previously Relocated Items 25 / .. children: 3
	.AKVIS.Sketch.conf
	Previously Relocated Items 13 / .. children: 3
	Previously Relocated Items 14 / .. children: 3
	Avery Products Corp.-DesignPrintIT-Design&Print.ini
	Library / .. children: 1
	AKVIS / .. children: 0
	Previously Relocated Items 5 / .. children: 3
	Previously Relocated Items 2 / .. children: 3
	Previously Relocated Items 3 / .. children: 3
	Previously Relocated Items 4 / .. children: 3
	Avery Products Corporation-DesignPrint-Design&Print.ini
	Previously Relocated Items 11 / .. children: 3
	Previously Relocated Items 16 / .. children: 3
	Previously Relocated Items 20 / .. children: 3
	Previously Relocated Items 18 / .. children: 3
	Previously Relocated Items 26 / .. children: 2
	Previously Relocated Items 19 / .. children: 3
	Previously Relocated Items 21 / .. children: 3
	Previously Relocated Items 17 / .. children: 3
	Previously Relocated Items 10 / .. children: 3
	Previously Relocated Items / .. children: 4
	.betamigrated



 /Applications:

	VLC.app
	Google Earth Pro.app
	Hewlett-Packard / .. children: 5
	Flash Player
	Pool.app
	Google Chrome.app
	CollageFactory Free.app
	Dropbox.app
	OnyX.app
	Disk Drill Media Recovery.app
	OneDrive.app
	DetectX Swift.app
	Microsoft Word.app
	eTax.ticino PF 2022 / .. children: 5
	PhotoZoom Pro 7.app
	dr.fone.app
	Microsoft Excel.app
	WhatsApp.app
	FileShredder.app
	The Unarchiver.app
	Microsoft OneNote.app
	Skype.app
	Burn ISO Pro.app
	Microsoft PowerPoint.app
	ifolor Designer.app
	App for Facebook.app
	Folx.app
	Mac FoneTrans
	PhotoScapeX.app
	YouTube to MP3.app
	Friendly Streaming.app



 /Library:

	Apple / .. children: 3
	DropboxHelperTools / .. children: 3
	OSAnalytics / .. children: 2
	StagedDriverExtensions / .. children: 0
	Catacomb / .. children: 1
	Trial / .. children: 3
	Google / .. children: 3
	InstallerSandboxes / .. children: 2
	KernelCollections / .. children: 1
	DriverExtensions / .. children: 0
	Automator / .. children: 94
	Bluetooth / .. children: 7
	User Template / .. children: 41
	Fonts Disabled / .. children: 16
	SystemExtensions / .. children: 2



 /Library/Application Support:

	com.apple.backgroundassets.user / .. children: 0
	Mozilla / .. children: 1
	com.apple.TVIdleScreen / .. children: 1
	.TDgdwjRgim
	Macromedia / .. children: 2
	Mica / .. children: 1
	Google / .. children: 4
	Microsoft / .. children: 2
	BTServer / .. children: 11
	Oracle / .. children: 1
	com.apple.idleassetsd / .. children: 5
	Visan / .. children: 1
	Adobe / .. children: 5
	TeamViewer / .. children: 1
	HP Photo Creations / .. children: 4
	livefsd / .. children: 0



 /Library/Extensions:

	AppleMobileDevice.kext
	hp_Inkjet1_io_enabler.kext



 /Library/Internet Plug-Ins:

	SharePointBrowserPlugin.plugin
	SharePointWebKitPlugin.webplugin
	JavaAppletPlugin.plugin



 /Library/Managed Preferences:

	*-- Folder doesn't exist or is inaccessible --*



 /Library/PrivilegedHelperTools:

	com.teamviewer.Helper
	com.purevpn.macapp.HelperTool
	com.microsoft.autoupdate.helper
	com.microsoft.office.licensingV2.helper



 /Library/ScriptingAdditions:

	



 /Library/StartupItems:

	



 /Library/Updates:

	ProductMetadata.plist



Top Processes: 

%CPU	PID	COMMAND	
9.2		378		WindowServer 
4.1		0		kernel_task 
1.7		2198		DetectX Swift 
0.7		371		bluetoothd 
0.5		790		UniversalControl 
0.4		364		PerfPowerService 
0.3		1523		com.apple.WebKit 
0.2		348		thermalmonitord 
0.1		423		mDNSResponder 
0.1		374		corebrightnessd 


«»EOF»«		

[macbio]

... ho un iMac 24 inca,M1 2021, chip Apple m1, ventura 13.1

Ventura 13.1 ovvero una versione del dicembre 2022, oggi siamo alla 13.6.4.
Oltre a far girare -come già suggerito- DetectX Swift.app, provato ad aggiornare?

ogii a dire il vero siamo a Sonoma 14.3

[nene]

aggiornato a Sonoma 14.3.1

[Alberto.G]

nene hai fatto tutto giusto, per cui complimenti!
Sei uno dei pochi che, al primo invio del report, ha postato tutto in modo corretto! Grazie.

Cosa però importante è sapere se la scansione che ha eseguito DetectX è terminata con un OK, che vuol dire che non ha trovato né adware né malware o altri potenziali pericoli.
Altrimenti produce una lista con gli elementi che ritiene possano essere un pericolo per il Mac in quanto portatori di adware e/o malware.
Quindi dacci conferma che tutto sia a posto con un bel OK, altrimenti ci invii la lista facendo uno screenshot e poi come Allegati.

Da un primo esame del report Profile inviato, non rilevo presenza di malware se non qualcosa che andrebbe eliminato per tutta sicurezza.
Questo vedremo poi.

[Hammarby]

Da quello che vedo io è pulito.

Ci sono applicazioni pesanti che sono installate e partono automaticamente ma niente che sembri pericoloso

[nene]

Grazie mille per il vostro aiuto, sinceramente non sono molto pratico e non so dove controllare se è tutto ok, nel profile o nelle History di Detectx?

[Alberto.G]

Ci basta questa immagine che è importante come prima diagnosi

Schermata 2024-02-13 alle 11.14.15.png (368.08 KiB) Visto 456 volte

[nene]

ho trovato questo nelle History:
[/img]

Screenshot 2024-02-13 alle 11.14.24.png (436.24 KiB) Visto 454 volte

[/img]

[Alberto.G]

Proprio quello che cercavamo!
Questa lista ti dice che hai 5 elementi potenzialmente pericolosi, secondo DetectX.
Sono da eliminare per sicurezza.
Già questa app ti permette laloro eliminazione.
Basta evidenziare ciascun elemento o file, mettere la spunta sul quadratino a sinistra, poi cliccare sul simbolo [ X ] nero, in alto a dx.
Fatto questo, riavvia il Mac e rilancia DetectX per verifica che tutti gli elementi siano stati cancellati.
Dacci notizia

[nene]

Grazie, grazie mille ..... pensavo fosse più complicato ma alla fine sono riuscito grazie a i vostri preziosi aiuti, ora è OK, non so se devo fare ancora qualcosa

[nene]

Una domanda, questa operazione con DetectX è consigliabile farla ogni certo periodo di tempo??....