Techsurvivors

Welcome to Techsurvivors => Tech => Topic started by: kimmer on October 10, 2016, 01:25:08 PM

Title: SOLVED! Do I have malware?
Post by: kimmer on October 10, 2016, 01:25:08 PM
Problem solved (Original problem is below). In case anyone else bumps into something similar, here is what solved my problem:

Here's a quick recap of what I've done:
In the long run, I believe that all of the problems were related to those Amazon apps.  dry.gif  Thanks for all the help!
=-=-=-=-=

Over the past 3 weeks I’ve had some odd little issues, and I’m stumped as to what is going on with my iMac. The concern over security has me considering erasing the HD and doing a fresh system install from Apple, and then bringing over my documents, pictures and such, and slowly reinstalling my apps. I’m leery of booting from my CCC backup in case I have malware or something.

I’m also going to research how to get in to the logs on my routers. Yes there are two and I don’t know how to go to just one - the apple airport; and yes I should know how to log into both the router and apple airport, but I don't. I had a reliable tech friend install the apple airport and he left the older router as well. It’s been a rough couple of years and I’m just really getting my feet on the ground with many things, so no lectures, please. If I can remove the older router, just tell me how and I'll work on this.

Two points worth noting:Here’s the 3 oddities:
  1. The first time I heard a loud beeping and walked around the house until I discovered my iMac was stuck trying to raise the volume level. I could see the “image” that represents the speaker and volume, but I couldn’t stop the attempt to increase. I tried hitting the volume button on my keyboard and there wasn’t a response. My mouse was also uncontrollable. I couldn’t shut down the iMac with the button on the back, so finally I simply pulled the plug from the outlet. I left the iMac unplugged overnight and then restarted the next morning. All seemed fine.
  2. The second time I walked into the computer room to plug in my iPad to recharge and discovered the iMac awake and a desktop file was highlighted and blinking. I was able to use the mouse and click on the finder desktop to stop the action. I launched console and saved the logs and shut the iMac down until morning.
  3. The last time was last night. I came in before bed and discovered an alert window open (see below). If you look, you’ll see a file is highlighted. When I clicked cancel on the alert, a second window popped up and said I couldn’t rename the file to “/.” Again, I used console to grab the logs and then shut the iMac down until this morning.
[attachment=3310:alert109.jpg]


In glancing at the system logs from the last two incidents, the one thing I notice in both of them is:

QUOTE
XPC connection was invalidated


Otherwise the whole mish-mash is meaningless to me. I can copy/paste the logs if anyone understands this and wants to look at either of them.

Any and all suggestions would be appreciated.
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 10, 2016, 02:17:31 PM
I'm betting you have a badly written app/extension/kext/etc. that you or some other app installed. Of course, you could be one of the first to experience a real OS X hack. My suspicions would be the WiFi connected TV. Who knows what it may have installed on your system? Possibly some 'deivers' and that's where the XPC comes in (see below).

QUOTE
I’m leery of booting from my CCC backup in case I have malware or something.
If you have malware, it is already installed and booting from CCC won't change that, assuming it backed up the malware. If it is not malware, which I seriously doubt, booting from CCC may improve things. Most likely, you'll simply take longer to boot into the OS from the backed up files and experience exactly the same symptoms. rolleyes.gif

As for Airport logs, you should see most of them in Console. "Diagnostic and Usage Messages" with "airport" typed into the 'search' box. I'm not sure the other router would write any messages with an easily identifiable label. They may just be limited to 'network' messages without any direct link to the router. Not sure any router saves error info in its own memory.

Here are a couple of links explaining what XPC is for, but I have never knowingly used it.
QUOTE
If I can remove the older router, just tell me how and I'll work on this.
Are these things connected in series, that is, is one connected to the cable(?) modem and the second one plugged into the first one?

I'd not suggest pasting any log files. They usually don't have much human readable info, anyway. Wait until we come up with some specific words that you can search for.

In the meantime, look for any apps you don't remember installing or plists that don't identify a known app or use. Also anything that has a label/title similar to the TV or the non-Apple router. Might be great to ask that 'tech friend' to remove the router. Thinking.gif BTW, what color is it? eek2.gif
Title: SOLVED! Do I have malware?
Post by: kimmer on October 10, 2016, 04:38:23 PM
QUOTE(Xairbusdriver @ Oct 10 2016, 12:17 PM) <{POST_SNAPBACK}>
As for Airport logs, you should see most of them in Console. "Diagnostic and Usage Messages" with "airport" typed into the 'search' box.

I just tried that and nothing showed up. What I did see were a lot of computer crashes associated with Amazon Music Helper.

QUOTE
Here are a couple of links explaining what XPC is for, but I have never knowingly used it.

Well, I know less now then before. wink.gif  Seriously, I have no clue what I just read.

QUOTE
QUOTE
If I can remove the older router, just tell me how and I'll work on this.
Are these things connected in series, that is, is one connected to the cable(?) modem and the second one plugged into the first one?

Yes, Apple Airport is plugged into the older router, and that's plugged into the Internet line. My routers are in the garage. I do know how to disconnect the older router from the household Internet, and I think I could then just plug that line directly into the Apple Airport. I could remove the panel cover and take pictures if need be.

QUOTE
In the meantime, look for any apps you don't remember installing or plists that don't identify a known app or use. Also anything that has a label/title similar to the TV or the non-Apple router. Might be great to ask that 'tech friend' to remove the router. Thinking.gif BTW, what color is it? eek2.gif

I know every app in my app folder, although I don't use them all. wink.gif  I'll start digging through the plists, and look for Samsung and router things. I've avoided asking the tech guy to come up here, but will if my back is pushed to the wall.

Router color? Old one is black, Apple Airport is white. Am I missing a joke here?
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 10, 2016, 05:07:05 PM
QUOTE
Amazon Music Helper
Well, there's one culprit! wink.gif

Here's another place to look in Console: Files->/var/Logs->com.apple.xpc.launchd If nothing there, you can probably rule out an XPC problem. OTOH, you did get at least one erer warning...

QUOTE
Apple Airport is plugged into the older router, and that's plugged into the Internet line.
Great! Is the "Black" 'router' actually the box from the cable or the telephone company? In other words, who provides your Internet connection?
Title: SOLVED! Do I have malware?
Post by: kimmer on October 10, 2016, 07:33:11 PM
QUOTE(Xairbusdriver @ Oct 10 2016, 03:07 PM) <{POST_SNAPBACK}>
QUOTE
Amazon Music Helper
Well, there's one culprit! wink.gif

Yup, and I searched for a bit and found out it's an issue with running in the background for PC's and Mac's. After reading 5 pages in the Amazon help forum, I found out how to disable having it run in the background. Hopefully that will help. I hate the Amazon Music app, but it is the only way to download music from them when you purchase MP3's.

QUOTE
Here's another place to look in Console: Files->/var/Logs->com.apple.xpc.launchd If nothing there, you can probably rule out an XPC problem. OTOH, you did get at least one erer warning...

Loads of stuff listed under Files->/var/Logs->com.apple.xpc.launchd/commerce dot log, and as far as I can tell it's all Apple related stuff.

QUOTE
QUOTE
Apple Airport is plugged into the older router, and that's plugged into the Internet line.
Great! Is the "Black" 'router' actually the box from the cable or the telephone company? In other words, who provides your Internet connection?


I'll explain about this when I get home later as I have a meeting to attend. I'll take pics to help explain.
Title: SOLVED! Do I have malware?
Post by: gunug on October 11, 2016, 08:03:06 AM
I'm using Malwarebytes on my Macbook Pro as an experiment; but the only thing it ever called Malware was something that I purposely installed and didn't seem to be doing anything.
I clean the thing up pretty frequently with Onyx and clean out Firefox browser with the "Reset Browser" website so I've cleaned out whatever is making it slow today.
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 11, 2016, 09:08:30 AM
I need to do some search on "MalwareBytes". I have serious concerns about a company that uses vast amounts of advertising. Words are so cheap these days (even if advertising isn't).
Title: SOLVED! Do I have malware?
Post by: gunug on October 11, 2016, 09:25:31 AM
Malwarebytes is my go to program on PC's at work; it finds a lot that our paid for Antivirus/Antimalware package doesn't find.  The only draw back is
that you have to install it and then uninstall it because we're not buying licensing for every computer in the schools.  The Mac version doesn't seem to be
looking for enough when it runs (less Mac Malware) but it does update almost every time I run it!
Title: SOLVED! Do I have malware?
Post by: kimmer on October 11, 2016, 04:40:15 PM
Okay, here's the current set up:
  1. The entire house was pre-wired for several things, one of which is Ethernet connections in every room (except bathrooms). wink.gif tongue.gif
  2. At the junction box I found the modem (supplied by my ISP which is peak.org). It's hard to see in the one photo, but there is a beige wire that was installed by Peak when house was built, and that runs to the modem.
  3. From the modem there was a line (Ethernet ?) running from the modem to the old router; then a connection from the old router to the Apple AirPort Extreme.
  4. I took a good long look at all the connections and determined that the old router wasn't necessary, so I removed it and then ran the line from the modem directly into the Apple AirPort Extreme.
  5. Even though I have wi-fi, I also ran the 2 Ethernet lines directly into the Apple AirPort Extreme so that 2 rooms have direct Ethernet connection if needed. (My old printer required it, and I've used it in the past for company). You can see these 3 connections in the second photo. The two upper lines (darker blue) are Ethernet lines and run to two rooms. The lower bright blue line is the one that runs from the modem to the Apple AirPort Extreme.
[attachment=3311:modem.jpg]
[attachment=3312:AirPort.jpg]


I don't remember why we needed this information, but here it is. laugh.gif I'm still seeing a lot of alerts in Console, but so far no more oddities so I'm wondering if all of those were from the Amazon Music Helper. This is what showed in console while I was typing this:

CODE
Tue, 10/11/16 2:28:54.618 PM garcon[8723]: Connecting to Dropbox on 'com.getdropbox.dropbox.garcon.cafe_502'
Tue, 10/11/16 2:28:54.620 PM garcon[8723]: Connected to Dropbox on 'com.getdropbox.dropbox.garcon.cafe_502'.
Tue, 10/11/16 2:28:54.620 PM garcon[8723]: Garcon is ready (1 alive).
Tue, 10/11/16 2:28:54.620 PM garcon[8723]: Invalidating watch set.
Tue, 10/11/16 2:28:54.628 PM garcon[8723]: Watch set is now: {(
    file:///Users/me/Dropbox/,
    file:///Users/me/Team%20Dropbox%20(new)
)}.
Tue, 10/11/16 2:28:54.793 PM pkd[390]: client 8734 plug-in com.getdropbox.dropbox.garcon election := 1
Tue, 10/11/16 2:28:58.116 PM garcon[8723]: Garcon destroyed (0 alive).
Tue, 10/11/16 2:28:58.127 PM garcon[8723]: host connection <NSXPCConnection: 0x7f8b61402160> connection from pid 3075 invalidated
Tue, 10/11/16 2:29:03.175 PM pkd[390]: client 8739 plug-in com.getdropbox.dropbox.garcon election := 1
Tue, 10/11/16 2:32:17.398 PM CalendarAgent[370]: [com.apple.calendar.store.log.caldav.coredav] [Refusing to parse response to PROPPATCH because of content-type: [text/html; charset=UTF-8].]
Tue, 10/11/16 2:32:17.444 PM CalendarAgent[370]: [com.apple.calendar.store.log.caldav.coredav] [Refusing to parse response to PROPPATCH because of content-type: [text/html; charset=UTF-8].]
Tue, 10/11/16 2:34:13.835 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.885 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.889 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.889 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.976 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:14.059 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:14.151 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.127 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.181 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.221 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.392 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.603 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:16.384 PM Console[8757]: Failed to connect (_consoleX) outlet from (NSApplication) to (ConsoleX): missing setter or instance variable


Except for Dropbox, this is all related to Apple software. I'm still stumped, and still concerned that I need to do a clean reinstall. I also need to research how to look at the logs for the Apple AirPort Extreme, and how to change the password if I want to do so—although that's a HUGE pain as everything has to be logged back in.  jawdrop.gif  Talk about wasting hours typing a few letters/symbols.

Anyhow, I'm still watching and if anyone has any ideas/suggestions/thinks I've solved this with the removal of the Amazon thing, let me know.
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 11, 2016, 07:21:50 PM
Congrats on removing the old router, that's one less thing to go rong and it might even have been slower than the Apple one (not that you would probably have seen it). The modem might not be as fast as either router cold handle, anyway.

Is "Peak" a telecom or just a cable company? (I'm too lazy to search for that. rolleyes.gif )

I have no idea what "garcon.cafe_502" is. The 502 could be the owner ID, I'm listed as "501" and "502" is basically my lowercase name and "imac". Most of "my" owner numbers are in the 500-510 range. dntknw.gif Wouldn't hurt to make sure you have the latest Dropbox software. Thinking.gif

I don't think you will ever get a log inside of the Apple router. It is basically a bunch of chips. When something in it fails, the OS just writes to one of the many log files.

I agree, however, that the XPC messages are from Apple. But I don't think they have anything to do with the router or even your network. From what I can understand, this is simply a method Apple provides for developers to access things in the OS or send messages to the OS that should then notify the user. In other wurdz, I still think you have an app (kernel, launch daemon or extension) that needs updating/replacing.
Title: SOLVED! Do I have malware?
Post by: tacit on October 11, 2016, 08:13:04 PM
QUOTE(kimmer @ Oct 10 2016, 07:25 PM) <{POST_SNAPBACK}>
Here’s the 3 oddities:
  1. The first time I heard a loud beeping and walked around the house until I discovered my iMac was stuck trying to raise the volume level. I could see the “image” that represents the speaker and volume, but I couldn’t stop the attempt to increase. I tried hitting the volume button on my keyboard and there wasn’t a response. My mouse was also uncontrollable. I couldn’t shut down the iMac with the button on the back, so finally I simply pulled the plug from the outlet. I left the iMac unplugged overnight and then restarted the next morning. All seemed fine.
  2. The second time I walked into the computer room to plug in my iPad to recharge and discovered the iMac awake and a desktop file was highlighted and blinking. I was able to use the mouse and click on the finder desktop to stop the action. I launched console and saved the logs and shut the iMac down until morning.
  3. The last time was last night. I came in before bed and discovered an alert window open (see below). If you look, you’ll see a file is highlighted. When I clicked cancel on the alert, a second window popped up and said I couldn’t rename the file to “/.” Again, I used console to grab the logs and then shut the iMac down until this morning.


I have seen all of those things happen with a dying battery in a cordless keyboard.

The beeping was because the iMac "saw" the Volume Up key being pressed. Both the other two things can happen if the iMac "sees" the Return key being pressed.
Title: SOLVED! Do I have malware?
Post by: kimmer on October 12, 2016, 12:19:45 PM
QUOTE(Xairbusdriver @ Oct 11 2016, 05:21 PM) <{POST_SNAPBACK}>
Is "Peak" a telecom or just a cable company? (I'm too lazy to search for that. rolleyes.gif )

Neither. It's simply a good old fashioned ISP.

QUOTE
PEAK Internet is a full-service Internet provider....
PEAK is a wholly owned subsidiary of three local utility cooperatives ... lists names of phone companies.

You must have a landline with one of the phone companies in order to use PEAK Internet. It's the only game in town unless I want to go with DirecTV (and then I'd have to switch to AT&T from Verizon). Remember, I live in a fairly rural area; still I have no complaints with this company, the speeds are decent and there's no caps.

There has to be a way to talk to the Apple AirPort Extreme as "the kid" did it when he set it up. I'm going to make an appt and talk with him to learn how to do this. I was trying to avoid that, for reasons I won't share, but it's the only way I'm going to solve the last of this – I think.

Title: SOLVED! Do I have malware?
Post by: kimmer on October 12, 2016, 12:28:43 PM
QUOTE(tacit @ Oct 11 2016, 06:13 PM) <{POST_SNAPBACK}>
I have seen all of those things happen with a dying battery in a cordless keyboard.

The beeping was because the iMac "saw" the Volume Up key being pressed. Both the other two things can happen if the iMac "sees" the Return key being pressed.


This is interesting. I use a wired keyboard with my iMac, but there is an Apple bluetooth keyboard that I use with my mini iPad (tried it with this iMac, but prefer my full keyboard that requires being USB connected). The bluetooth keyboard is in the other room, and I keep it off unless I'm using it. I also thought it was out of range, but perhaps not. I’ve now removed it from the bluetooth gadget listing for this iMac.

Now I’m also wondering if this could be related to my Apple magic mouse. It’s the original one and it does have odd issues (reported all over the web), although I’ve never seen any of these oddities associated with it. Still, it’s something to research. Since the mouse itself keeps falling apart (the back refuses to stay on any more), I’ve been considering a new one, so maybe it’s time to make that purchase.

Interesting points, tacit.
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 12, 2016, 12:33:16 PM
Have you tried tacit's KISS solution? wink.gif Even easier than switching cables! cheer.gif

OK, so Peak is an ISP, and, apparently, the telephone company is providing the connection. I assume that is DSL, which can be as fast as some cable providers (assuming you are close it the 'switch', that is, <1.8 miles).

Airport Utility seems to be the only way to 'talk' to the box. Version 5.6 no longer runs in 10.11, I guess I can delete it now. The "new and improved" version is next to useless, IMHO. You now make all the settings in the Network Pref Panel. You do have a 'shortcut' access to that via the Airport Utility; click on the Airport image and then the 'greyed-out-but-active' Edit button. rolleyes.gif
Title: SOLVED! Do I have malware?
Post by: kimmer on October 12, 2016, 02:37:01 PM
QUOTE(Xairbusdriver @ Oct 12 2016, 10:33 AM) <{POST_SNAPBACK}>
Have you tried tacit's KISS solution? wink.gif Even easier than switching cables! cheer.gif

I replied to him. smile.gif

QUOTE
OK, so Peak is an ISP, and, apparently, the telephone company is providing the connection. I assume that is DSL, which can be as fast as some cable providers (assuming you are close it the 'switch', that is, <1.8 miles).

Correct on all counts, and the "switch" is in the corner of my front yard. smile.gif

QUOTE
Airport Utility seems to be the only way to 'talk' to the box. Version 5.6 no longer runs in 10.11, I guess I can delete it now. The "new and improved" version is next to useless, IMHO. You now make all the settings in the Network Pref Panel. You do have a 'shortcut' access to that via the Airport Utility; click on the Airport image and then the 'greyed-out-but-active' Edit button. rolleyes.gif

I have version 6.36, and it's a waste of HD space. wink.gif  A fancy globe sits there and underneath it states "No configured AirPort base stations have been found" – but it promises to keep looking.  rolleyes.gif

I check my console logs daily and I’m not seeing anymore of the issues I originally saw. I've made several changes and if nothing odd happens again, I'll be happy. I won't know what exactly caused these oddities, but I'll still be happy.

Here's a quick recap of what I've done:
I'll keep watching and I'll update this thread in a few weeks if nothing else weird occurs. If something did happen, I'll holler asap. Thanks for all the help. I wouldn't have thought about checking some of these things on my own.
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 12, 2016, 04:07:46 PM
Setting it up may be as simple as unplugging the power supply cable, waiting a few minutes (giving the electrons time to "leave the building") and plugging it (the power cable) back in. That supposedly will automatically start up Airport Utility. rolleyes.gif Another easy 'solution'. (I'm assuming changing batteries, if any, didn't help. Might also try a different keyboard...)

As for directions, here are a couple of links that may help:That should cover it, especially if you get the Manual!
Title: SOLVED! Do I have malware?
Post by: kimmer on October 23, 2016, 04:26:32 PM
Problems solved. Refer to the beginning of the first post in this thread for all the information. Again, thanks for all the help.
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 23, 2016, 07:19:29 PM
QUOTE
Refer to the beginning of the first post in this thread for all the information.
Butt, but... Inquiring minds want to know how! If we have a similar problem, saying the magic words, "Problem solved" probably won't be enough for the rest of us! eek2.gif dntknw.gif nono.gif We need step by step text and a few graphics/schematics/drawings/images/diagrams/video/etc. At least a phone number so we can call you at 6am Eastern time!!!! laughhard.gif
Title: SOLVED! Do I have malware?
Post by: kimmer on October 23, 2016, 11:02:01 PM
QUOTE(Xairbusdriver @ Oct 23 2016, 05:19 PM) <{POST_SNAPBACK}>
QUOTE
Refer to the beginning of the first post in this thread for all the information.
Butt, but... Inquiring minds want to know how! If we have a similar problem, saying the magic words, "Problem solved" probably won't be enough for the rest of us! eek2.gif dntknw.gif nono.gif


The very short answer is: don't install Amazon apps. Period. If you do purchase digital music from Amazon they will force you to install the Amazon Music App, and if you do that then don't allow the Amazon Music Helper to run in the background.

I may not have shared this before, so just in case ... It's not easy to find out how to turn off the Amazon Music Helper. In fact, for a long time they only allowed win users to do so, and there wasn't a fix for the Mac version of their software.  angry.gif There is now the ability to do so, and here are the steps to turn off the Amazon Music Helper. This info was buried in a thread at the Amazon forums and was posted by an Amazon forum moderator:

QUOTE
Hello everyone, thanks for your feedback about the Amazon Music Helper background process. In our most recent update (3.2.0.591.3.2.0-20140729 on Windows, 3.2.0.274.3.2.0-20140729 on Mac) we added an option to allow customers to disable the Amazon Music Helper background process when the PC/Mac app is not running.

To disable the background process when the PC/Mac app when the app is closed:
1.   Click the app menu icon in the upper left and choose Preferences
2.   Go to the Advanced tab
3.   Uncheck “Allow Amazon Music to launch from the web”
4.   Click disable on the dialog that appears
5.   Shut down the app

When disabled the Amazon Music Helper process will only appear when the PC/Mac app is open.


QUOTE
We need step by step text and a few graphics/schematics/drawings/images/diagrams/video/etc. At least a phone number so we can call you at 6am Eastern time!!!! laughhard.gif

Here's the deal: you send me your phone number that allows texting, and around midnight left coast time, I'll send you a text. It will have drawings and everything since we can now do that in texts. I'll keep sending this text until you reply. Then I'm ditching my phone and getting a new number. tease.gif
Title: SOLVED! Do I have malware?
Post by: Xairbusdriver on October 24, 2016, 12:26:56 PM
What is this "Amazon" thing, of which you speak?! dntknw.gif