Liebes Trojaner-Board Forum!

Erstmal: tolle Arbeit die ihr hier leistet, und vielen Dank für euer Engagement.

Ich bin allerdings auch mit einem Problem hier, da mein Mac derzeit merkwürdige Dinge macht: Er öffnet Fenster (letztens war mein Kontakte Fenster geöffnet, ohne dass ich am Mac gearbeitet habe). Jetzt würde ich gerne mal prüfen lassen, ob eh alles passt, oder vllt doch infiziert ist. Ich kenn mich leider nicht wirklich aus und wäre über eure Hilfe sehr dankbar! Unten hab ich ein Log-File mit EtreCheck erstellt, wäre super, jemand das prüfen könnte!

Vielen Dank im Voraus!

Luigi 10000

EtreCheck version: 5.2 (5029)
Report generated: 2019-05-18 13:06:18
Download EtreCheck from https://etrecheck.com
Runtime: 2:42
Performance: Excellent
Sandbox: Enabled
Full drive access: Disabled

Problem: Other problem
Description: 
Windows open without doing anything.

Major Issues: None

Minor Issues:
****These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. 

****High battery cycle count - Your battery may be losing capacity.
****Unsigned files - There are unsigned software files installed. They appear to be legitimate but should be reviewed.
****Limited drive access - More information may be available with Full Drive Access.

Hardware Information:
****MacBook Pro (13-inch, Mid 2012)
****MacBook Pro Model: MacBookPro9,2
****1 2,5*GHz Intel Core i5 (i5-3210M) CPU: 2-core
****8*GB RAM - At maximum
********BANK 0/DIMM0 - 4*GB DDR3 1600* ok
********BANK 1/DIMM0 - 4*GB DDR3 1600* ok
****Battery: Health = Replace Soon - Cycle count = 1223

Video Information:
****Intel HD Graphics 4000 - VRAM: 1536*MB
********Color LCD 1280 x 800

Drives:
****disk0 - Samsung SSD 850 EVO 500GB 500.11*GB (Solid State - TRIM: Yes)
****Internal SATA 6 Gigabit Serial ATA
********disk0s1 - EFI (MS-DOS FAT32) [EFI] 210*MB
********disk0s2 [APFS Container] 499.90*GB
************disk1 [APFS Virtual drive] 499.90*GB (Shared by 4 volumes)
****************disk1s1 - Macintosh HD (APFS) (Shared - 415.94*GB used)
****************disk1s2 - Preboot (APFS) [APFS Preboot] (Shared)
****************disk1s3 - Recovery (APFS) [Recovery] (Shared)
****************disk1s4 - VM (APFS) [APFS VM] (Shared - 6.44*GB used)

Mounted Volumes:
****disk1s1 - Macintosh HD 499.90*GB (76.80*GB free)
********APFS
********Mount point: /

****disk1s4 - VM [APFS VM] (Shared - 6.44*GB used)
********APFS
********Mount point: /private/var/vm

Network:
****Interface en0: Ethernet
****Interface fw0: FireWire
****Interface en1: Wi-Fi
********802.11 a/b/g/n
****Interface en3: Bluetooth PAN
****Interface bridge0: Thunderbolt Bridge

System Software:
****macOS Mojave 10.14.4 (18E226) 
****Time since boot: About 31 days

Configuration Files:
****File /etc/sysctl.conf exists but not expected
****/etc/hosts - Count: 6

Notifications:
****Notifications not available without Full Drive Access.

Security:
****Gatekeeper: Enabled
****System Integrity Protection: Enabled

****Antivirus apps: MalwareBytes

Unsigned Files:
****Launchd: ~/Library/LaunchAgents/com.valvesoftware.steamclean.plist
********Executable: ~/Library/Application Support/Steam/SteamApps/steamclean Public
********Details: Exact match found in the whitelist - probably OK

****Launchd: ~/Library/LaunchAgents/com.spotify.webhelper.plist
********Executable: ~/Library/Application Support/Spotify/SpotifyWebHelper
********Details: Exact match found in the whitelist - probably OK

Kernel Extensions:
****/Library/Extensions
********SteamInput.kext (Valve Corporation, 4345.50.02 - SDK 10.13)
********SteamInput-DS4v1.kext (Valve Corporation, 4345.50.02 - SDK 10.9)

Startup Items:
****TuxeraNTFSUnmountHelper Path: /Library/StartupItems/TuxeraNTFSUnmountHelper 

System Launch Agents:
****[Not Loaded] 17 Apple tasks
****[Loaded] 172 Apple tasks
****[Running] 112 Apple tasks

System Launch Daemons:
****[Not Loaded] 36 Apple tasks
****[Loaded] 180 Apple tasks
****[Running] 120 Apple tasks

Launch Agents:
****[Not Loaded] com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2019-04-17)
****[Other] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist (Adobe Systems, Inc. - installed 2018-02-14)
****[Not Loaded] com.adobe.AdobeCreativeCloud.plist (? faec172d - installed 2016-10-08)
****[Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2018-12-24)
****[Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-12-24)
****[Not Loaded] com.teamviewer.teamviewer.plist (? bb938493 - installed 2016-09-19)
****[Not Loaded] com.teamviewer.teamviewer_desktop.plist (? 5984e04 - installed 2016-09-19)

Launch Daemons:
****[Running] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-14)
****[Running] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-14)
****[Running] com.adobe.adobeupdatedaemon.plist (? f00845ea - installed 2016-10-08)
****[Loaded] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-12-24)
****[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2019-04-30)
****[Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2019-03-21)
****[Loaded] com.malwarebytes.HelperTool.plist (Malwarebytes Corporation - installed 2017-04-22)
****[Loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2017-04-13)
****[Loaded] com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2015-08-15)
****[Loaded] com.native-instruments.NativeAccess.Helper2.plist (Native Instruments GmbH - installed 2019-03-29)
****[Loaded] com.teamviewer.Helper.plist (? 7f4bf3e7 - installed 2016-09-19)
****[Not Loaded] com.teamviewer.teamviewer_service.plist (? e6c7921e - installed 2016-09-19)

User Launch Agents:
****[Loaded] com.adobe.AAM.Updater-1.0.plist (? 0 - installed 2016-08-25)
****[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-02-03)
****[Loaded] com.google.keystone.agent.plist (EQHXZ8M8AV - installed 2019-05-12)
****[Loaded] com.google.keystone.xpcservice.plist (EQHXZ8M8AV - installed 2019-05-12)
****[Loaded] com.skype.skype.shareagent.plist (Skype Communications S.a.r.l - installed 2017-11-27)
****[Running] com.spotify.webhelper.plist (? 0 - installed 2019-04-17)
****[Loaded] com.valvesoftware.steamclean.plist (? 0 - installed 2019-03-29)

User Login Items:
****NIHardwareAgent.app (Native Instruments GmbH - installed 2019-03-29)
********(Application - /Library/Application Support/Native Instruments/Hardware/NIHardwareAgent.app)

****NIHostIntegrationAgent.app (Native Instruments GmbH - installed 2019-03-29)
********(Application - /Library/Application Support/Native Instruments/Hardware/NIHostIntegrationAgent.app)

****NTKDaemon.app (Native Instruments GmbH - installed 2019-03-29)
********(Application - /Library/Application Support/Native Instruments/NTK/NTKDaemon.app)

Internet Plug-ins:
****Silverlight: 5.1.50709.0 (? - installed 2016-10-07)
****AdobePDFViewerNPAPI: 17.012.20098 (Adobe Systems, Inc. - installed 2019-04-17)
****AdobePDFViewer: 19.010.20099 (Adobe Systems, Inc. - installed 2019-04-17)
****Flash Player: 32.0.0.192 (Adobe Systems, Inc. - installed 2019-05-14)
****FlashPlayer-10.6: 32.0.0.192 (Adobe Systems, Inc. - installed 2019-05-14)
****AdobeAAMDetect: 3.0.0.0 (? - installed 2016-10-08)

Audio Plug-ins:
****AppleTimeSyncAudioClock: 1.0 (Apple - installed 2019-04-11)
****BluetoothAudioPlugIn: 6.0.11 (Apple - installed 2019-04-11)
****AirPlay: 2.0 (Apple - installed 2019-04-11)
****AppleAVBAudio: 740.1 (Apple - installed 2019-04-11)
****BridgeAudioSP: 5.39 (Apple - installed 2019-04-11)
****iSightAudio: 7.7.3 (Apple - installed 2019-04-11)

3rd Party Preference Panes:
****Flash Player (installed 2019-04-30)
****Tuxera NTFS (installed 2016-08-25)

Time Machine:
****Time Machine information not available without Full Drive Access.
****2 local snapshots
****Oldest local snapshot: 2019-05-18 01:10:10
****Last local snapshot: 2019-05-18 10:36:19

Performance:
****System Load: 2.59 (1 min ago) 1.84 (5 min ago) 1.68 (15 min ago)
****Nominal I/O speed: 0.19*MB/s
****File system: 39.50 seconds
****Write speed: *487*MB/s
****Read speed: *517*MB/s

CPU Usage Snapshot:
****Type Overall
****System 10*%
****User 24*%
****Idle 67*%

Top Processes Snapshot by CPU:
****Process (count) CPU (Source - Location)
****Other processes 48.88*% (?)
****firefox 38.61*% (Mozilla Corporation)
****plugin-container (5) 26.23*% (Mozilla Corporation)
****EtreCheck 7.87*% (App Store)
****Adobe Illustrator 3.55*% (? - /Applications/Adobe Illustrator CC 2015.3/Adobe Illustrator.app)

Top Processes Snapshot by Memory:
****Process (count) RAM usage (Source - Location)
****EtreCheck 513*MB (App Store)
****firefox 420*MB (Mozilla Corporation)
****plugin-container (5) 260*MB (Mozilla Corporation)
****App Store 143*MB (Apple)
****Spotify 91*MB (Spotify)

Top Processes Snapshot by Network Use:
****Process Input / Output (Source - Location)
****mDNSResponder 5*MB / 625*KB (Apple)
****netbiosd 258*KB / 57*KB (Apple)
****Spotify 170*KB / 50*KB (Spotify)
****firefox 61*KB / 3*KB (Mozilla Corporation)
****WhatsApp 18*KB / 15*KB (WhatsApp Inc.)

Virtual Memory Information:
****Physical RAM: 8*GB

****Free RAM: 193*MB
****Used RAM: 5.78*GB
****Cached files: 2.03*GB

****Available RAM: 2.22*GB
****Swap Used: 3.86*GB

Software Installs (past 30 days):
****Install Date Name (Version)
****2019-05-02 XProtectPlistConfigData (2103)
****2019-05-02 MRTConfigData (1.41)
****2019-05-07 Remote Mouse (2.908)
****2019-05-14 Adobe Flash Player
****2019-05-14 Gatekeeper Configuration Data (166)
****2019-05-18 EtreCheck (5.2)

Diagnostics Information (past 7 days):
****Directory /Library/Logs/DiagnosticReports is not accessible.
****Enable Full Drive Access to see more information.

End of report
         

Hallo,

Entschuldige das ich mich jetzt erst melde, falls das Problem noch besteht erstelle ein neues Log mit EtreCheck - aber bitte mit Festplattenvollzugriff.

Seit Mojave besitzen die meisten apps keinen Vollzugriff auf die Festplatte/SSD mehr. Das muss manuell durchgeführt werden.

1. Systemeinstellungen -> Sicherheit -> Festplattenvollzugriff
2. Klicke auf das Schloss um das rechte Fenster zu entsperren
3. Klicke auf das +-Symbol und füge bitte Etrecheck zu den Ausnahmen.
4. Starte Etrecheck und erstelle ein neues Log.

Hallo Dante,

hier ein neuer Check mit den geänderten Einstellungen.

EtreCheck version: 5.2 (5029)
Report generated: 2019-05-25 09:34:18
Download EtreCheck from https://etrecheck.com
Runtime: 2:45
Performance: Excellent
Sandbox: Enabled
Full drive access: Enabled

Problem: Other problem

Major Issues:
****Anything that appears on this list needs immediate attention. 

****Time Machine backup out-of-date - The last Time Machine backup is over 10 days old.

Minor Issues:
****These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. 

****High battery cycle count - Your battery may be losing capacity.
****Unsigned files - There are unsigned software files installed. They appear to be legitimate but should be reviewed.
****Heavy I/O usage - Your system is under heavy I/O use. This will reduce your performance.

Hardware Information:
****MacBook Pro (13-inch, Mid 2012)
****MacBook Pro Model: MacBookPro9,2
****1 2,5*GHz Intel Core i5 (i5-3210M) CPU: 2-core
****8*GB RAM - At maximum
********BANK 0/DIMM0 - 4*GB DDR3 1600* ok
********BANK 1/DIMM0 - 4*GB DDR3 1600* ok
****Battery: Health = Replace Soon - Cycle count = 1224

Video Information:
****Intel HD Graphics 4000 - VRAM: 1536*MB
********Color LCD 1280 x 800

Drives:
****disk0 - Samsung SSD 850 EVO 500GB 500.11*GB (Solid State - TRIM: Yes)
****Internal SATA 6 Gigabit Serial ATA
********disk0s1 - EFI (MS-DOS FAT32) [EFI] 210*MB
********disk0s2 [APFS Container] 499.90*GB
************disk1 [APFS Virtual drive] 499.90*GB (Shared by 4 volumes)
****************disk1s1 - Macintosh HD (APFS) (Shared - 406.87*GB used)
****************disk1s2 - Preboot (APFS) [APFS Preboot] (Shared)
****************disk1s3 - Recovery (APFS) [Recovery] (Shared)
****************disk1s4 - VM (APFS) [APFS VM] (Shared - 1.07*GB used)

Mounted Volumes:
****disk1s1 - Macintosh HD 499.90*GB (91.25*GB free)
********APFS
********Mount point: /

****disk1s4 - VM [APFS VM] (Shared - 1.07*GB used)
********APFS
********Mount point: /private/var/vm

Network:
****Interface en0: Ethernet
****Interface fw0: FireWire
****Interface en1: Wi-Fi
********802.11 a/b/g/n
****Interface en3: Bluetooth PAN
****Interface bridge0: Thunderbolt Bridge

System Software:
****macOS Mojave 10.14.4 (18E226) 
****Time since boot: Less than an hour

Configuration Files:
****File /etc/sysctl.conf exists but not expected
****/etc/hosts - Count: 6

Notifications:
****~/Downloads/EtreCheck.app
********one notification
****/Applications/EtreCheck.app
********one notification

Security:
****Gatekeeper: Enabled
****System Integrity Protection: Enabled

****Antivirus apps: MalwareBytes

Unsigned Files:
****Launchd: ~/Library/LaunchAgents/com.valvesoftware.steamclean.plist
********Executable: ~/Library/Application Support/Steam/SteamApps/steamclean Public
********Details: Exact match found in the whitelist - probably OK

****Launchd: ~/Library/LaunchAgents/com.skype.skype.shareagent.plist
********Executable: /Applications/Skype.app/Contents/Library/LaunchServices/com.skype.skype.shareagent.bundle/Contents/MacOS/com.skype.skype.shareagent
********Details: Exact match found in the whitelist - probably OK

Kernel Extensions:
****/Library/Extensions
********SteamInput.kext (Valve Corporation, 4345.50.02 - SDK 10.13)
********SteamInput-DS4v1.kext (Valve Corporation, 4345.50.02 - SDK 10.9)

Startup Items:
****TuxeraNTFSUnmountHelper Path: /Library/StartupItems/TuxeraNTFSUnmountHelper 

System Launch Agents:
****[Not Loaded] 17 Apple tasks
****[Loaded] 182 Apple tasks
****[Running] 102 Apple tasks

System Launch Daemons:
****[Not Loaded] 36 Apple tasks
****[Loaded] 192 Apple tasks
****[Running] 108 Apple tasks

Launch Agents:
****[Not Loaded] com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2019-04-17)
****[Other] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist (Adobe Systems, Inc. - installed 2018-02-14)
****[Not Loaded] com.adobe.AdobeCreativeCloud.plist (? faec172d - installed 2016-10-08)
****[Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2019-05-19)
****[Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2019-05-19)
****[Not Loaded] com.teamviewer.teamviewer.plist (? bb938493 - installed 2016-09-19)
****[Not Loaded] com.teamviewer.teamviewer_desktop.plist (? 5984e04 - installed 2016-09-19)

Launch Daemons:
****[Loaded] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-14)
****[Loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-14)
****[Running] com.adobe.adobeupdatedaemon.plist (? f00845ea - installed 2016-10-08)
****[Running] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2019-05-19)
****[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2019-04-30)
****[Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2019-03-21)
****[Loaded] com.malwarebytes.HelperTool.plist (Malwarebytes Corporation - installed 2017-04-22)
****[Loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2017-04-13)
****[Loaded] com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2015-08-15)
****[Loaded] com.native-instruments.NativeAccess.Helper2.plist (Native Instruments GmbH - installed 2019-03-29)
****[Loaded] com.teamviewer.Helper.plist (? 7f4bf3e7 - installed 2016-09-19)
****[Not Loaded] com.teamviewer.teamviewer_service.plist (? e6c7921e - installed 2016-09-19)

User Launch Agents:
****[Loaded] com.adobe.AAM.Updater-1.0.plist (? 0 - installed 2019-04-17)
****[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2019-05-19)
****[Loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2019-05-12)
****[Loaded] com.google.keystone.xpcservice.plist (Google, Inc. - installed 2019-05-12)
****[Loaded] com.skype.skype.shareagent.plist (? 0 - installed 2017-11-27)
****[Running] com.spotify.webhelper.plist (Spotify - installed 2019-05-19)
****[Loaded] com.valvesoftware.steamclean.plist (? 0 - installed 2019-03-29)

User Login Items:
****NIHardwareAgent.app (Native Instruments GmbH - installed 2019-03-29)
********(Application - /Library/Application Support/Native Instruments/Hardware/NIHardwareAgent.app)

****NIHostIntegrationAgent.app (Native Instruments GmbH - installed 2019-03-29)
********(Application - /Library/Application Support/Native Instruments/Hardware/NIHostIntegrationAgent.app)

****NTKDaemon.app (Native Instruments GmbH - installed 2019-03-29)
********(Application - /Library/Application Support/Native Instruments/NTK/NTKDaemon.app)

Internet Plug-ins:
****Silverlight: 5.1.50709.0 (? - installed 2016-10-07)
****AdobePDFViewerNPAPI: 17.012.20098 (Adobe Systems, Inc. - installed 2019-05-23)
****AdobePDFViewer: 19.012.20034 (Adobe Systems, Inc. - installed 2019-05-23)
****Flash Player: 32.0.0.192 (Adobe Systems, Inc. - installed 2019-05-14)
****FlashPlayer-10.6: 32.0.0.192 (Adobe Systems, Inc. - installed 2019-05-14)
****AdobeAAMDetect: 3.0.0.0 (? - installed 2016-10-08)

Audio Plug-ins:
****AppleTimeSyncAudioClock: 1.0 (Apple - installed 2019-04-11)
****BluetoothAudioPlugIn: 6.0.11 (Apple - installed 2019-04-11)
****AirPlay: 2.0 (Apple - installed 2019-04-11)
****AppleAVBAudio: 740.1 (Apple - installed 2019-04-11)
****BridgeAudioSP: 5.39 (Apple - installed 2019-04-11)
****iSightAudio: 7.7.3 (Apple - installed 2019-04-11)

3rd Party Preference Panes:
****Flash Player (installed 2019-04-30)
****Tuxera NTFS (installed 2016-08-25)

Time Machine:
****Auto backup: Yes
****Volumes being backed up: 
********Macintosh HD: Disk size: 499.90*GB - Disk used: 408.65*GB 
****Destinations: 
********L***i [Local] (Last used)
************Total size: 899.83*GB
************Total number of backups: 15
************Oldest backup: 2016-08-26 01:38:18
************Last backup: 2018-10-21 01:52:12
****One local snapshot
****Oldest local snapshot: 2019-05-25 09:26:37
****Last local snapshot: 2019-05-25 09:26:37

Performance:
****System Load: 1.92 (1 min ago) 2.69 (5 min ago) 2.36 (15 min ago)
****Nominal I/O speed: 23.97*MB/s
****File system: 32.11 seconds
****Write speed: *495*MB/s
****Read speed: *515*MB/s

CPU Usage Snapshot:
****Type Overall
****System 3*%
****User 4*%
****Idle 93*%

Top Processes Snapshot by CPU:
****Process (count) CPU (Source - Location)
****Other processes 16.35*% (?)
****EtreCheck 8.89*% (App Store)
****NIHostIntegrationAgent 0.41*% (Native Instruments GmbH)
****firefox 0.17*% (Mozilla Corporation)
****plugin-container 0.08*% (Mozilla Corporation)

Top Processes Snapshot by Memory:
****Process (count) RAM usage (Source - Location)
****EtreCheck 1.07*GB (App Store)
****firefox 376*MB (Mozilla Corporation)
****Microsoft Word 232*MB (Microsoft Corporation)
****plugin-container 191*MB (Mozilla Corporation)
****Mail 144*MB (Apple)

Top Processes Snapshot by Network Use:
****Process Input / Output (Source - Location)
****Mail 2*MB / 9*KB (Apple)
****firefox 493*KB / 8*KB (Mozilla Corporation)
****mDNSResponder 10*KB / 7*KB (Apple)
****apsd 4*KB / 3*KB (Apple)
****CalendarAgent 2*KB / 2*KB (Apple)

Virtual Memory Information:
****Physical RAM: 8*GB

****Free RAM: 93*MB
****Used RAM: 4.97*GB
****Cached files: 2.94*GB

****Available RAM: 3.03*GB
****Swap Used: 0*B

Software Installs (past 30 days):
****Install Date Name (Version)
****2019-05-02 XProtectPlistConfigData (2103)
****2019-05-02 MRTConfigData (1.41)
****2019-05-07 Remote Mouse (2.908)
****2019-05-14 Adobe Flash Player (32.0.0.192)
****2019-05-14 Gatekeeper Configuration Data (166)
****2019-05-18 EtreCheck (5.2)
****2019-05-23 Adobe Acrobat DC (19.012.20034) (19.012.20034)

Diagnostics Information (past 7 days):
****2019-05-18 10:11:59 BitdefenderVirusScanner.app CPU
********Executable: /Applications/BitdefenderVirusScanner.app


End of report
         

Danke!

Also ich sehe da nichts ungewöhnliches hast du Malwarebytes mal durchlaufen lassen?