MacBook Pro randomly force shuts down - malware

Question

Level 1

4 points

MacBook Pro randomly force shuts down - malware

I have a mid to late 2014 MacBook Pro that was recently infected with a form of malware that would force both Safari and Chrome to randomly open windows with ads. I believe it was a malware that masked itself as an Adobe Flash Player installer. (Yeah I know lol).

in the process of removing any malware and associated files with Malwarebites and another trusted antivirus scanner, the browser problems have disappeared, as well I deleted a program that would allow remote access that I never installed. Found all associated files to this, and removed them. So far, malware wise, they have been successfully removed.... except for on serious side effect.

While in normal mode, the MacBook will randomly forcefully shutdown. It will happen as if someone is pressing and holding the power button. I have tried to source this problem unsuccessfully. Now if I leave the MacBook alone, it will take 15-20 minutes to happen. If I begin doing something, even in Parallels Windows, the shutdown will happen randomly within 10 minutes. The more you work, the sooner a shutdown will happen. If I boot to Safe Mode, it will not happen.

due to limitations of space and external drives, reinstalling iOS is out of the question at this point. Instead, I need to know where to look to stop this shutdown.

MacBook Pro 15", macOS 10.13

Posted on Jul 3, 2019 6:36 AM

Reply

Answer 1

Top-ranking reply

macjack

Level 10

111,204 points

Jul 3, 2019 6:57 AM in response to Nascar_Perry

Uninstall one of the anti-malware apps. More than one can get in the way of normal OS operation. Malwarebytes is about the most proven anti-malware software for Mac and the one recommended by Apple Support folks. So the first thing I'd do is to uninstall the other one.

If that doesn't help you can run Etrecheck It is just a diagnostic tool that's very useful to us in finding problems. It just provides a snapshot of your system. After it runs post the log file here. It will contain no personal information. Allowing full drive access will improve the quality of the report.

To post the log file click on share report and use the Page icon in your reply window. See video:

How to use the Add Text Feature When Post… - Apple Community

Reply

Answer 2

Nascar_Perry Author

Level 1

4 points

Jul 3, 2019 7:23 AM in response to macjack

Report Posted. It says I still have two anti viruses installed, but this is not the case any longer. I have removed the other one and left Malwarebytes. The random shutdowns were occurring before I installed the second one.

EtreCheck Log

Reply

Answer 3

macjack

Level 10

111,204 points

Jul 3, 2019 7:42 AM in response to Nascar_Perry

Nascar_Perry wrote:

Report Posted. It says I still have two anti viruses installed, but this is not the case any longer.

Probably because it still found a .plist for Aero in /LaunchAgents and in /Launch Daemons and /Library/Application Support. I suggest you delete these by hand.

I don't see any other obvious reason for the shutdowns but I'm not familiar with all the apps you're running. Your system is heavily modified.

Take a look at this Apple Support Topic:

If your Mac spontaneously restarts or displays a message that it restarted or shut down because of a problem - Apple Support

Be sure to keep a good daily backups, either Time Machine or a clone.

Back up your Mac with Time Machine - Apple Support

You can use a cloning software like SuperDuper! or CarbonCopy Cloner.

You may also want to run Apple Diagnostics to check for any hardware issue:

How to use Apple Diagnostics on your Mac - Apple Support

Reply

Answer 4

Nascar_Perry Author

Level 1

4 points

Jul 11, 2019 9:18 AM in response to Nascar_Perry

I am continuing to have these shutdown occur no matter what steps I try. I wanted to post some logs to see if anyone can help gauge what is going on.

in my ~/Library/Logs/DiagnosticReports/ I have no new crash reports or any .panic reports

However in /Library/Logs/DiagnosticReports/ I have the following that came up:

Sim City 4_2019-07-11-120009 - 12:00pm

disk writes_2019-07-11-002723_*-MacBook-Pro 11:44A

The MacBook Shutdown at around 12:01pm

I hav also posted the EtreCheck report below:

EtreCheck Report

Reply

Answer 5

Nascar_Perry Author

Level 1

4 points

Jul 3, 2019 7:47 AM in response to macjack

I will give that a check. The only other thing I am looking at is this entry:

Name:com.adobe.SwitchBoard.monitor.plistShow in Finder

Author:?

Executable:/etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist

Type:MachInit

Reply

Answer 6

Nascar_Perry Author

Level 1

4 points

Jul 8, 2019 7:31 PM in response to macjack

I have an update in the random shutdown issues. Perhaps this will help shed some light on what is going on.

I can operate the MacBook in SafeMode. So while in SafeMode, I went into Keychain access and removed all unknown, untrusted keys and certificates.

I then went into my prefs and changed the password to my computer to login. I then restarted into normal mode. I was able to use the MacBook in normal mode for the entire day, until around now when the shutdowns began happening again.

I tried to recharge the password again, no luck. I also double checked any certificates or keys, nothing other then this one:

member: 09880BDB-0629-4390-95E0-3A856A03BB40 D956D1A8-B394-4B9E-9987-F1E02AF85202 which comes up in the LOGIN area of keychain access. The issue with this one is the certificate says:

member: 09880BDB-0629-4390-95E0-3A856A03BB40 D956D1A8-B394-4B9E-9987-F1E02AF85202 Certificate is not trusted.

Originally this issue began because of a malware masked under a false warning that my Adobe Flash Player needed to be updated type nonsense. It started opening random new windows in Safari and Chrome yet they did not have changed homepages. The shutdowns only started happening when I found all files causing these popups hidden on my computer so something else is lingering doing this. Unfortunately I didn't get any help with the above link previously given.

Definitely Needing Help

Reply