For a little while I've been dealing with malware (I know, eliminating this from the source would be ideal.. but I've no idea how). I can usually get around and do what I need to but it's become extremely bothersome.
I spent a lot of time looking at the activity monitor to see for anything to stick out and investigate. I looked at a bunch of diagnostic logs and spindumps for anything unusual. Until now I haven't found anything that REALLY looks wrong.
Sorry to continue dumping, but I noticed some keybags stuff in another log which I understand to be a keylogger. There's also lots of attempted and rejected or blocked "persona" events that scare me. I linked that fairly extensive log here: https://justpaste.it/8gjfr
In the spindump file in my mdsdiagnostic folder we have, among many similar messages, the following:
Thread 0xae3 Thread name "IOAccelFenceMachine" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xaea Thread name "AMDRadeonX6000_AMDAccelDisplayPipe" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xaeb Thread name "AMDRadeonX6000_AMDAccelDisplayPipe" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xaec Thread name "AMDRadeonX6000_AMDAccelDisplayPipe" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xaed Thread name "AMDRadeonX6000_AMDAccelDisplayPipe" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xaee Thread name "AMDRadeonX6000_AMDAccelDisplayPipe" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xb01 Thread name "X86PlatformShim" 1000 samples (1-1000) priority 81 (base 81) *1000 IOWorkLoop::threadMain() + 0 (kernel + 8245200) [0xffffff80009ecfd0] Thread 0xb02 1000 samples (1-1000) priority 95 (base 95) *1000 call_continuation + 46 (kernel + 139582) [0xffffff800023213e] *1000 ??? (kernel + 1881017) [0xffffff80003db3b9] *1000 ??? (kernel + 1881230) [0xffffff80003db48e] *1000 ??? (kernel + 1881391) [0xffffff80003db52f] *1000 lck_mtx_sleep + 104 (kernel + 595656) [0xffffff80002a16c8] *1000 thread_block_reason + 175 (kernel + 660367) [0xffffff80002b138f] *1000 ??? (kernel + 666610) [0xffffff80002b2bf2] *1000 machine_switch_context + 203 (kernel + 1769083) [0xffffff80003bfe7b] Thread 0xb03 1000 samples (1-1000) priority 95 (base 95) *1000 call_continuation + 46 (kernel + 139582) [0xffffff800023213e] *1000 ??? (kernel + 1882802) [0xffffff80003dbab2] *1000 lck_mtx_sleep + 104 (kernel + 595656) [0xffffff80002a16c8] *1000 thread_block_reason + 175 (kernel + 660367) [0xffffff80002b138f] *1000 ??? (kernel + 666610) [0xffffff80002b2bf2] *1000 machine_switch_context + 203 (kernel + 1769083) [0xffffff80003bfe7b] Thread 0xb04 1000 samples (1-1000) priority 95 (base 95) *1000 call_continuation + 46 (kernel + 139582) [0xffffff800023213e] *1000 ??? (kernel + 1882802) [0xffffff80003dbab2] *1000 lck_mtx_sleep + 104 (kernel + 595656) [0xffffff80002a16c8] *1000 thread_block_reason + 175 (kernel + 660367) [0xffffff80002b138f] *1000 ??? (kernel + 666610) [0xffffff80002b2bf2] *1000 machine_switch_context + 203 (kernel + 1769083) [0xffffff80003bfe7b]Google tells me IOAccelFenceMachine (first line of snippet) is potentially nefarious.
In my last several paragraphs, what are all these ??? before the kernel execution`? Has something been obfuscated?
lck_mtx_sleep -- is this normal for kernel thread? Similarly to thread_block_reason?
Finally, the repeated machine_switch_context have me worried. Is this referring to the possibility of someone else controlling my laptop?
Moreover, my network tab appears as follows. I'm connected to my network and set up the bluetooth but the other two connections are foreign to me.
As is surely obvious at this point hardware and networking are not my strengths.
Let me know if there is a better way/place to look for help with this.