Possible virus help

[tivoboy]

Is there a thread somewhere where one can get help with a possible virus issue? I have an issue where it appears my computer is taking screenshots.. As well, it seems to have disabled the volume (I would imagine so one doesn't HEAR the screenshot and only gets the brief flash of light as indicator) I can't seem to find any of the modern possibles, like Mokes or others. Have tried running AVAST and Sophos but they don't find anything.

thanks for any direction.

 

[Fishrrman]

tivo wrote:
"Is there a thread somewhere where one can get help with a possible virus issue?"

There are no "Mac viruses" in-the-wild.
Your problems are coming from somewhere else.

The VERY FIRST THING you should do is download and run MalwareBytes Anti-Malware for Mac (if you have not done so).

Do that, and get back to us with the results.

 

[tivoboy]

tivo wrote:
"Is there a thread somewhere where one can get help with a possible virus issue?"

There are no "Mac viruses" in-the-wild.
Your problems are coming from somewhere else.

The VERY FIRST THING you should do is download and run MalwareBytes Anti-Malware for Mac (if you have not done so).

Do that, and get back to us with the results.

Thank, normally have MWB installed and running. Checked it again, nothing shows up. Have tried some odd tests with AVAST and it showed some odd /.spotlight - v-100 as infections. TNJ. Nothing else shows anything.

Has anyone heard of a reason, malware or other where the screen will do the screen capture flash?

 

[organicCPU]

Is there a thread somewhere where one can get help with a possible virus issue?

Maybe you should create your own thread with a meaningful title so that others can find it.

I have an issue where it appears my computer is taking screenshots..

If MalwareBytes doesn't come up with an issue, you could try https://objective-see.com/products/oversight.html to see what app is activating your camera.

 

[tivoboy]

Maybe you should create your own thread with a meaningful title so that others can find it.

If MalwareBytes doesn't come up with an issue, you could try https://objective-see.com/products/oversight.html to see what app is activating your camera.

thanks, that objective SEE is nice, any way to know if it is safe?
My issues seems to have been the screenshots, not camera usage.

I cant find anything, MWB (updated to 3.xx) didn't find anything, AVAST found some things that I reported above and some eml/emxl emails which were mostly just advertising. Couple of old android installers that were suspect, but I can't imagine that could be launched.

I'm going to migrate to a legacy backup, and rebuild the system at this point but is there any way to actually SEE if the screenshots were occurring and being posted to local machine or remote? I can't see to find anything in Console and all logs around the times things occurred.

 

[BrianBaughn]

My Macs running El Capitan or Sierra do not exhibit a "brief flash of light as indicator" of any type of screenshot.

I'm thinking something else is going on.

 

[chown33]

Check:
System Preferences > Accessibility > Hearing > Audio > Flash screen when an alert occurs (checkbox)

The screen flash is an option for hearing impairment. It can be enabled with or without an audible alert indicator (i.e. you can have both).

There might also be another option under Accessibility. You'd have to search for it. I'm just guessing.

If that's not it, try a Safe Boot.
https://support.apple.com/en-us/ht201262

And/or run the program EtreCheck and post the output which lists the active extensions, agents, daemons, drivers, etc. You'd have to post the output here so others can see it, if you're unable to recognize something unusual. Fortunately, the output is anonymized, so you're not exposing anything private.

 

[organicCPU]

thanks, that objective SEE is nice, any way to know if it is safe?
My issues seems to have been the screenshots, not camera usage.

Sorry for missing the point of screenshots, I thought of camera usage indicator light. Oversight won't help you then. If you're still thinking that you do have a screen capturing app running that does remote uploads, maybe monitoring your network can give some answers. Although, I think that @chown33 offered a very likely explanation for the screen's flashing by the accessibility setting.

Like most other security related software, it could be that software from objective see is watching one aspect of security while unintentionally opening another security hole that didn't exist before. Personally, I'd consider apps from the developer as safe. Means, I don't think they're malware on their own. If they're always capable of what they claim is another question. If you don't need such an app, just don't use it.