How to safely transfer data from a previously infected mac to a new one?

[aeneasvb]

Hi,

I've had the bad experience of getting a virus or malware on my mac earlier this June. I was trying to install an app to transfer whatsapp message from android to iOS and suddenly bunch of pop-up messages opened/closed, and an extension was added to Safari. I believe it was the 'iWorm' (found the 'JavaW' file) so I proceeded to get rid of it and to be extra safe, did a clean install via the recovery mode and changed all my passwords. When re-installing, I updated to High Sierra (from Sierra), cleared caches on Chrome+Safari, re-downloaded items from dropbox + iCloud and transferred my other files from an old back-up, all along the way running several anti-virus scanners (thanks for the 30-days trial). I'm not an expert but looks like I did everything possible to get rid of any virus/malware.

Unfortunately, my mac started to slow down unexpectedly for a short a period, resulting in having to wait 1-2 min to use it again. This started happening only 1-2 months after the clean install so not sure if the issue comes from the infection, from my 12 chrome tabs or from the fact that I spilled orange juice 3 years ago on it. Also just now iTunes asked me to do a software update (not via the App store) when trying to update my iPhone SE to iOS 12 (but this looks legit from what I read online).

Anyhow, I'm getting a new mac 15inch in a few days (current mac's keyboard is dead due to OJ spill and repair is €1350+ since there's pulp on the logic board, etc.) and I'm wondering what can I do to transfer my data to my new mac and do all the possible to avoid transferring any possible virus/malware? I just screened my mac with avast free (it's clean) and planning to transfer my data using an external hard drive. Perhaps I'm being too cautious and there's no way that my mac could possibly still be infected?

Would be great to hear your feedback. First time I ever got infected. Thanks!

–––––––––––––––––––––––––
Current Mac: MacBook Pro (Retina, 13-inch, Early 2015), 2.9 GHz Intel Core i5, 16 GB 1867 MHz DDR3, macOS High Sierra (10.13.6)

 

[T'hain Esh Kelch]

It is very unlikely to be infected, so just do it the normal way.

And the iTunes software update is real.

 

[iRaynor SK]

Hello,

if you haven’t done yet, try Malwarebytes - offers 30 days free trial. Malwarebytes is also the only anti-virus I allow on my Mac.

Then try utilities from Objective-See (maybe you know Patrick Wardle) and let us know if something was found.

 

[Juicy Box]

What is the Mac you are having problems with? Does it have a HDD?

When re-installing, I updated to High Sierra (from Sierra)

Many people have reported that High Sierra does not run well on HDDs. I experienced this my self with a mid-2011 MBP 17" when upgrading from 10.11 to 10.13.

I am wondering if this might be the case for you.

 

[Fishrrman]

iRaynor wrote:
"if you haven’t done yet, try Malwarebytes - offers 30 days free trial. Malwarebytes is also the only anti-virus I allow on my Mac."

MalwareBytes can be used "in free mode" FOREVER.
You DO NOT have to pay the fee.

When you download it, it will ask you to "upgrade" to the paid version for a 30 day period.

If you choose not to, after 30 days it "converts itself" into a "forever free" version and keeps on going.

Just needed to clear that up.

 

[aeneasvb]

Hello,

if you haven’t done yet, try Malwarebytes - offers 30 days free trial. Malwarebytes is also the only anti-virus I allow on my Mac.

Then try utilities from Objective-See (maybe you know Patrick Wardle) and let us know if something was found.

Just ran Malwarebytes and it's all clean but wasn't able to find the utilities app from objective-see. Do you now if it's been replaced by another one? There's quite a lot on their website.

 

[iRaynor SK]

https://objective-see.com

Here are utilities like KnockKnock and LuLu, all free.

 

[aeneasvb]

What is the Mac you are having problems with? Does it have a HDD?

I'm running a MacBook Pro (Retina, 13-inch, Early 2015) with 2.9 GHz Intel Core i5, 16 GB 1867 MHz DDR3, macOS High Sierra (10.13.6). The slow issue only started to happen 1-2 months after the update so I doubt that it's due to my mac's hardware.

Plus it didn't get slower overall, only slows/freeze for a really short period and have to wait for it to pass. So like the mouse moves really slowly, Mission Control too, videos start playing bugging. For example, noticed that netflix on full screen lags a lot via Chrome and have to wait for that to pass. That's why I'm guessing it's either due to the OJ affecting the motherboard (I was shown photos with dried pulp on there) or a virus that's still hiding.

[doublepost=1537454961][/doublepost]

It is very unlikely to be infected, so just do it the normal way. And the iTunes software update is real.

Thanks for the input! That's what I'm guessing but is there a way to transfer my files more safely than with a hard drive just to be extra careful? One that doesn't involve using an old back up of course.

 

[Juicy Box]

The slow issue only started to happen 1-2 months after the update so I doubt that it's due to my mac's hardware.

Another thought related to the HDD, I had a bad HDD on my Late 2012 iMac with a 1TB Fusion Drive. It was still under a Apple Care warranty, but the Apple Store refused to replace the HDD due to it passing their hardware diagnostic tests.

They would wipe the drive completely and re-install the OS, I would use the migration assistant and copy my files over and the Mac would run great for a few months.

Then, I would have goofy stuff start happening such as slow downs, slow boot times, random lock ups, and app crashes.

I would take it back to the Apple Store, only to be turned down again when the drive passed their HW test. The would again, wipe the drive and the computer ran fine.

This went on for about a year, each time the issue would come back sooner and sooner.

Eventually, it totally failed, 12 days before the warranty ended, and Apple replaced the HDD of the Fusion Drive.

I think what was happening was there was bad sectors in the HDD, and the bad sectors were growing. Each time I started fresh, my data wouldn't touch the bad sectors, data eventually found its way there.

I am not saying this is your problem, I don't think the 2015 MBPs even had HDDs as an option, I guess it could be a similarly situation with an SSD, but don't rule out hardware issues. If you try software fixes, and the problem still comes back, maybe it could be hardware.

 

[aeneasvb]

https://objective-see.com

Here are utilities like KnockKnock and LuLu, all free.

Top, thanks! Ran KnockKnock came back with the below flagged as red (1/60 virustotal) and some others with question marks from virustotal. I also ran DHS but only got some applications that are vulnerable but none hijacked. Should I be worried?

KnockKnock categories:
1->4 = Kernel Extensions
5->7 = Launch Items
8->10 = Lirbary Proxies

1) /System/Library/Extensions/AppleGraphicsPowerManagement.kext/Contents/MacOS/AppleGraphicsPowerManagement
2) /System/Library/Extensions/AMDLegacyFramebuffer.kext/Contents/MacOS/AMDLegacyFramebuffer
3) /System/Library/Extensions/udf.kext/Contents/MacOS/udf
4) /System/Library/Extensions/IOFireWireFamily.kext/Contents/MacOS/IOFireWireFamily
5) /System/Library/CoreServices/Installer Progress.app/Contents/MacOS/Installer Progress
/System/Library/LaunchDaemons/com.apple.InstallerProgress.plist
6) /Users/[myuser]/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent

Ones with a question mark:
7) /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd
/System/Library/LaunchDaemons/com.apple.usbmuxd.plist
8) /System/Library/StagedFrameworks/Safari/WebCore.framework/Versions/A/WebCore
9) /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/WebKit
10) /System/Library/StagedFrameworks/Safari/SafariShared.framework/Versions/A/SafariShared

 

[aeneasvb]

If you try software fixes, and the problem still comes back, maybe it could be hardware.

I did a clean install so it's either hardware or it's the virus/malware that is still lurking around somehow, even after doing clean scans with Malware, Bitdefender, F-secure, Avast, Sophos. No idea to know which one it is though, hence my question about safely transferring file to my new mac without infecting it..