Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

LKM Trojan please help remove


  • Please log in to reply
36 replies to this topic

#16 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 11 September 2023 - 09:16 PM

Also, I need to remove all these different network devices here on this thing there’s like 7-8 when I run the ifconfig
I have
gif0: flags-8010<POINTOPOINT, MULTICAST>
Ap1:
En0
Awd10
En1
En2
Llw0
Bridge0
Members en1
En2

Utun0
Utun1
Utun2

Like what are all theses

BC AdBot (Login to Remove)

 


#17 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 11 September 2023 - 10:21 PM

how did you get rid of your pesky crypto miner? here's logs from etrecheck 

 

EtreCheckPro version: 6.8.1 (68024)

Report generated: 2023-09-11 22:11:11

Download EtreCheckPro from https://etrecheck.com

Runtime: 5:08

 

Performance: Below Average


Problem: Other problem

Description: 

I ran rkhunter and spent days looking at all files and I’m positive I

have a Rootkit its modified my kernel modules 


Major Issues:

    Anything that appears on this list needs immediate attention. 


    Heavy CPU usage - Some processes are using an unusually high amount of CPU.


Minor Issues:

    These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. 


    No Time Machine backup - Time Machine backup not found.

    Runaway user process - A user process is using a large percentage of your CPU.

    Low performance - EtreCheck report took an unusually long time to run.

    Limited permissions - More information may be available with Full Disk Access.


Hardware Information:

    MacBook Air (Retina, 13-inch, 2019)

        Status: Supported

    MacBook Air Model: MacBookAir8,2

    1.6 GHz Dual-Core Intel Core i5 (i5-8210Y) CPU: 2-core

    8 GB RAM - Not upgradeable

        BANK 0/DIMM0 - 4 GB LPDDR3 2133 

        BANK 1/DIMM0 - 4 GB LPDDR3 2133 

    Battery: Health = Normal - Cycle count = 489


Video Information:

    Intel UHD Graphics 617 - VRAM: 1536 MB

        Color LCD (built-in) 2880 x 1800


Drives:

    disk0 - APPLE SSD AP0128N 121.33 GB (Solid State - TRIM: Yes)

    Internal PCI-Express 8.0 GT/s x4 NVM Express

        disk0s1 - EFI [EFI] 315 MB

        disk0s2 [APFS Container] 121.02 GB

            disk1 [APFS Virtual drive] 121.02 GB (Shared by 6 volumes)

                disk1s1 - A******** - Data (APFS) [APFS Virtual drive] (4.69 GB used)

                disk1s2 - Preboot (APFS) [APFS Preboot] (1.86 GB used)

                disk1s3 - Recovery (APFS) [Recovery] (1.15 GB used)

                disk1s4 (APFS) [APFS Container] (9.17 GB used)

                    disk1s4s1 - A******D (APFS) [APFS Snapshot] (9.17 GB used)

                disk1s5 - Update (APFS) (1 MB used)

                disk1s6 - VM (APFS) [APFS VM] (20 KB used)


Mounted Volumes:

    disk1s1 - A******** - Data [APFS Virtual drive]

        Filesystem: APFS

        Mount point: /System/Volumes/Data

        Encrypted

        Used: 4.69 GB

        Shared values

            Size: 121.02 GB

            Free: 104.03 GB


    disk1s2 - Preboot [APFS Preboot]

        Filesystem: APFS

        Mount point: /System/Volumes/Preboot

        Used: 1.86 GB

        Shared values

            Size: 121.02 GB

            Free: 104.03 GB


    disk1s4s1 - A******D [APFS Snapshot]

        Filesystem: APFS

        Mount point: /

        Read-only: Yes

        Used: 9.17 GB

        Shared values

            Size: 121.02 GB

            Free: 104.03 GB


    disk1s5 - Update

        Filesystem: APFS

        Mount point: /System/Volumes/Update

        Used: 1 MB

        Shared values

            Size: 121.02 GB

            Free: 104.03 GB


    disk1s6 - VM [APFS VM]

        Filesystem: APFS

        Mount point: /System/Volumes/VM

        Used: 20 KB

        Shared values

            Size: 121.02 GB

            Free: 104.03 GB


Network:

    Interface en0: Wi-Fi


System Software:

    macOS Ventura 13.5.2 (22G91) 

    Time since boot: Less than an hour


Security:

    Gatekeeper: App Store and identified developers

    System Integrity Protection: Enabled


    Antivirus software: Apple


Applications:

    406 apps

    3 x86-only apps

    2 unsigned apps


System Launch Daemons:

    [Not Loaded] 37 Apple tasks

    [Loaded] 197 Apple tasks

    [Running] 152 Apple tasks

    [Other] 2 Apple tasks


System Launch Agents:

    [Not Loaded] 20 Apple tasks

    [Loaded] 225 Apple tasks

    [Running] 150 Apple tasks


App Extensions:

    QuickLook Previews:

        EtreCheckQuickLook - ~/Downloads/EtreCheckPro.app

            com.etresoft.etrecheck4 *.etrecheck


Backup:

    Time Machine Not Configured!


Performance:

    System Load: 10.17 (1 min ago) 4.98 (5 min ago) 2.96 (15 min ago)

    Nominal I/O usage: 4.44 MB/s

    File system: 33.51 seconds

    Write speed: 329 MB/s

    Read speed: 1071 MB/s


CPU Usage Snapshot:

    Type Overall

    System: 21 %

    User: 5 %

    Idle: 74 %


Top Processes Snapshot by CPU:

    Process (count) CPU (Source - Location)

    find (2) 121.77 % (Apple)

    tccd (2) 11.24 % (Apple)

    WindowServer 10.08 % (Apple)

    EtreCheckPro 6.66 % (Etresoft, Inc.)

    trustd (4) 6.12 % (Apple)


Top Processes Snapshot by Memory:

    Process (count) RAM usage (Source - Location)

    EtreCheckPro 746 MB (Etresoft, Inc.)

    kernel_task 313 MB (Apple)

    com.apple.WebKit.WebContent (3) 266 MB (Apple)

    AppleSpell 151 MB (Apple)

    MTLCompilerService (7) 122 MB (Apple)


Top Processes Snapshot by Network Use:

    Process Input / Output (Source - Location)

    mDNSResponder 55 KB / 41 KB (Apple)

    remoted 33 KB / 40 KB (Apple)

    SubmitDiagInfo 67 KB / 949 B (Apple)

    biometrickitd 28 KB / 24 KB (Apple)

    corekdld 293 B / 28 KB (Apple)


Top Processes Snapshot by Energy Use:

    Process (count) Energy (0-100) (Source - Location)

    find (2) 35 (Apple)

    WindowServer 2 (Apple)

    Terminal 0 (Apple)

    launchd 0 (Apple)

    ContinuityCaptureAgent 0 (Apple)


Virtual Memory Information:

    Physical RAM: 8 GB


    Free RAM: 1.06 GB

    Used RAM: 4.53 GB

    Cached files: 2.41 GB


    Available RAM: 3.47 GB

    Swap Used: 0 B


Software Installs (past 60 days):

    Install Date Name (Version)

    2023-09-11 macOS 13.5.2 (13.5.2)

    2023-09-11 Command Line Tools for Xcode (14.3)


Diagnostics Information (past 7-30 days):

    2023-09-11 17:04:25 /Library/Logs/DiagnosticReports/ProxiedDevice-Bridge/recoverylogd-2023-09-11-170425.ips - Crash (2 times)


    2023-09-11 16:42:07 /Library/Logs/DiagnosticReports/ProxiedDevice-Bridge/recoverylogd-2023-09-11-164207.ips - Crash (2 times)


    2023-09-11 16:27:54 /Library/Logs/DiagnosticReports/ProxiedDevice-Bridge/recoverylogd-2023-09-11-162754.ips - Crash (2 times)


    2023-09-11 16:10:59 /Library/Logs/DiagnosticReports/ProxiedDevice-Bridge/recoverylogd-2023-09-11-161059.ips - Crash (2 times)


    2023-09-11 15:33:35 /Library/Logs/DiagnosticReports/ProxiedDevice-Bridge/recoverylogd-2023-09-11-153335.ips - Crash (2 times)


End of report



#18 greg18

greg18

  •  Avatar image
  • Members
  • 1,743 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles, CA
  • Local time:06:04 AM

Posted 11 September 2023 - 10:32 PM

Again, what makes you think that there is a infection?  You do realize that Parrot OS is created for hacking and hardening testing. https://www.guru99.com/best-os-hacking.html#:~:text=Parrot%20OS%20is%20a%20platform,%2C%20computer%20forensics%2C%20and%20more.



#19 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 11 September 2023 - 10:51 PM

yes I do!! and because of all the things that been happing not only on parrot os but like I said iOS pdf books I had uploaded to virus total and I saw a visual map of the networks it connected back to, one of them was highlighted red and said malicious. my Mac OS has the same problems there are virtual disks that I never put there. I never stared a server ether what more would you like !!?  or does not anyone know how to remove these things I stated ,,LKM trojan the variant type A trojan and a ADM worm is what's being reported from tools.. 



#20 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 35,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:04 AM

Posted 12 September 2023 - 04:31 AM

Post the direct links to the results not screenshots

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra


#21 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 13 September 2023 - 06:21 AM

What program are you having people use to get logs you need? Can you help please

#22 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 35,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:04 AM

Posted 13 September 2023 - 10:45 AM

Post the links to your virus total submissions.

The logs from your computer can be from

journalctl -b1 | nc termbin.com 9999

netstat -ano | nc termbin.com 9999

sudo dmesg | nc termbin.com 9999

ss -pno | nc termbin.com 9999

Share the links it creates

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra


#23 greg18

greg18

  •  Avatar image
  • Members
  • 1,743 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles, CA
  • Local time:06:04 AM

Posted 13 September 2023 - 01:23 PM

yes I do!! and because of all the things that been happing not only on parrot os but like I said iOS pdf books I had uploaded to virus total and I saw a visual map of the networks it connected back to, one of them was highlighted red and said malicious. my Mac OS has the same problems there are virtual disks that I never put there. I never stared a server ether what more would you like !!?  or does not anyone know how to remove these things I stated ,,LKM trojan the variant type A trojan and a ADM worm is what's being reported from tools.. 

Of course you are going to get false flags that there is a infection with a distro directed at hacking and hardening.



#24 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 16 September 2023 - 06:40 AM

this is my process on Mac OS air launchctl print system

https://dpaste.com/GBZGAYNCJ

 

also I used knockknock app to see process and looked up via virus total this is one one the many issues where I find some signs of things connected back to or connections that are malware

https://www.virustotal.com/gui/file/0cb5352ac33727fd7979e454f6ac1a56b7795a8ab5a25d7cc955133fb47cf9c4/detection



#25 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 16 September 2023 - 02:58 PM

https://dpaste.com/96AU6LPS9



#26 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 16 September 2023 - 02:59 PM

 

yes I do!! and because of all the things that been happing not only on parrot os but like I said iOS pdf books I had uploaded to virus total and I saw a visual map of the networks it connected back to, one of them was highlighted red and said malicious. my Mac OS has the same problems there are virtual disks that I never put there. I never stared a server ether what more would you like !!?  or does not anyone know how to remove these things I stated ,,LKM trojan the variant type A trojan and a ADM worm is what's being reported from tools.. 

Of course you are going to get false flags that there is a infection with a distro directed at hacking and hardening.

 

its. not just that system its spread threw all my systems I know whats happing I'm not question that, how is my issue rn thank you 



#27 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 35,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:04 AM

Posted 16 September 2023 - 03:04 PM

this is my process on Mac OS air launchctl print system
https://dpaste.com/GBZGAYNCJ
 
also I used knockknock app to see process and looked up via virus total this is one one the many issues where I find some signs of things connected back to or connections that are malware
https://www.virustotal.com/gui/file/0cb5352ac33727fd7979e454f6ac1a56b7795a8ab5a25d7cc955133fb47cf9c4/detection


Nothing in your virustotal points to malware.

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra


#28 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 35,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:04 AM

Posted 16 September 2023 - 03:06 PM

https://dpaste.com/96AU6LPS9


Nothing in here looks abnormal

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra


#29 XxghostsyncxX

XxghostsyncxX
  • Topic Starter

  •  Avatar image
  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 17 September 2023 - 10:57 AM

The Trojan is bundling apps together in reading the code and can clearly see what its done. I cant even update my system say toask my administrator trust me Im not fine you just dont see what Im saying. Ill find something that helps you understand or lets just say for a minute I was infected and nothing is picking it up how can I remove those files do I need to unbundle them somehow or how do I get the permissions to just delete the bad ones when I dont have access.

#30 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 35,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:04 AM

Posted 17 September 2023 - 11:01 AM

What files make you think that you are infected?

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users