Finder Logged Out, Reset Wallpaper, Chrome Launched, Mounted Flash Installer on its own?

[caoimhin]

I was in the middle of doing some housekeeping when Finder logged out on its own and prompted me to log in again. When I did, my wallpaper had been reset to the Sierra default. More curiously, three instances of the Flash installer package had been mounted to the desktop, and Chrome had launched (it is not my default browser).

Very odd. Any idea what may have happened? I was not connected to WiFi, and was cleaning up old archived iMessage conversations when it happened.

 

[caoimhin]

Bump. Anyone have any clue? Very hard to find any reliable information on Mac malware, although I've seen somewhat similar issues reported with Flash installers arbitrarily appearing. Still doesn't explain the Chrome or desktop reset issues.

 

[fisherking]

try http://www.adwaremedic.com/index.php

eject those installers; check your download folder for the .dmg files, and delete those. check in System Preferences>Users & Groups>Login Items, and delete anything that should not be there.

anyone else with ideas?....

 

[caoimhin]

Thanks fisherking. Good call on Login Items. Forgot about that. Nothing suspicious there though. Just Dropbox and iTunes Helper. Hmm.

 

[DeltaMac]

Did you run the Malwarebytes app, downloaded from the link in fisherking's post?

 

[fisherking]

& did you check the downloads folder, for flashplayer installer dmgs?

 

[Partron22]

I'd check that copy of Chrome carefully. Perhaps export bookmarks, delete the App and its prefs, and download a new copy from a known valid source.