macbook pro a1286

I am helping  a friend with her macbook pro. Now I know you MAC folks will take offense to my use of saying it has a virus but it does have issues with a movie she downloaded and it sounds like she also installed an app that she used to download that movie. I can't seem to get a clear explanation of exactly what happened. She did say that she got one of those fake calls from "apple support" saying they are calling to help her--but she hung up on them and asked me for advice. Told her to just turn it off and bring it to me. Now trying to use chrome and doing any kind of search takes you to websites we don't want to go--similar to been hijacked in Windows. And if I try to go to sophos to download its app for virus the download page in chrome continuously refreshes and is impossible to click on what I downloaded (I used safari to download it and then installed it). It is running now and says it has found some issues (not sure what they are yet--has been running for 3 hours already). At this point I think the best thing to do is to reinstall osx but wanted to make sure you mac experts agree with me. Most apps take a very long time to start and intunes won't play any music or videos. My plan is to do a backup and then boot into the recovery partition and reinstall--is this the best thing to do considering the above? If you agree with me how do I make sure that none of the data that gets backed up is infected? Anything else I need to think about/prepare for? Thanks.
LVL 26
Lionel MMSmall Business IT ConsultantAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lionel MMSmall Business IT ConsultantAuthor Commented:
Re-installing the OS might or might not help. That is Windows sort of thing to do and Mac people almost never have to.

Try doing a safe boot by booting while holding down the shift key.

Then pull down the Apple menu to System Preferences.

Click on Network, the Advanced, then DNS.

Click on the + sign at the bottom left and add as a DNS server.

Then open Safari and download, install and run Avast.
Lionel MMSmall Business IT ConsultantAuthor Commented:
Once sophos finishes I will try your suggestion but how will this deal with the chrome refreshing issue?
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

The Chrome refreshing issue may be cause by the trojan and may go away after cleaning..
Lionel MMSmall Business IT ConsultantAuthor Commented:
going into safe mode, after signing in I had that similar page refresh experience for several seconds before I got to the desktop--quick, fast refreshes like I was getting on Chrome--mean anything? Running avast now.
Page refresh of what?

Did Sophos find anything?
While Clamxav became paid, you can still install clamav with Homebrew or Macports for free.  ClamXaV is/was built off the original open source code as the backend.  If you're ok with just the command line, then you can still get it free.  I would run several AV, since they don't completely overlap in the virus signatures they detect.

You probably don't need to resort to a reinstall OS X.  You may be able to just check Chrome for plugins or addons and delete whatever got installed.  If that fails to turn up anything, you could just go and delete the Chrome preferences.

To delete your Chrome preferences and proflie, open from /Application/Utilities/ and type the following.

rm -r "~/Library/Application Support/Google/Chrome"
This will delete all bookmarks and preferences for Chrome.  Start Chrome and see if it's working correctly again.

Another thing to check is the Activity Monitor and see what may be running in the background.  What did your friend download.  If you can identify the product that might be running, you can just stop it.  Check System Preferences --> Users & Groups --> Login Items for things that may be started up that shouldn't be started.  I don't run an AV on my own home Mac by choice, but I do run AV on my work Mac as required by our security policy.  The only things our corporate AV ever spots are Windows viruses, mostly in spam and donloads on Windows.  The reports of Mac clients basically show Windows viruses.

If you do a reinstall, it will fix the OS files, but won't fix any Applications, so it's fine to reinstall OS X.  It shouldn't wipe any User preferences or Applications.
Lionel MMSmall Business IT ConsultantAuthor Commented:
strung -- the refresh is of the desktop -- the screen you get after signing in. FYI when I went to change the DNS setting when in safe mode there were no bad dns setting there--just the IP for my router. Sophos found "issues" but did not say want--said no infections. However I installed Avast and ran it twice--first time it found 23 infected files, 4 of which it ided as trojans. Deleted all those files instead of even messing with cleaning them. Second scan came back clean but with 245 files unable to scan. After rebooting I could get itunes to play both music and video now however the starting of apps of any sort still takes a very long time (for me--but this may be normal but since I did not have it before this I can't judge what is actually slow or not). So the question now is how do I test to make sure all is right and working properly. I have installed teamviewer and I am going to ask user to remote on and test it herself but other than that is there some sort of system utilities I can run to make sure it is working "normally"?
Lionel MMSmall Business IT ConsultantAuthor Commented:
serialband--I am running a backup now--says it will take 6 hours. Once that is done I will try another AV and follow your chrome suggestions. She downloaded a video.
Lionel MMSmall Business IT ConsultantAuthor Commented:
These are the only items in "activity monitor" -- anything unusual, not normal?
Lionel MMSmall Business IT ConsultantAuthor Commented:
anything unusual, not normal in this application list?
I don't see your Activity Monitor.  You're showing the login items and they seem to be ok, but the iTunes helper seems strangely set to unknown and hidden.

You also mentioned that she downloaded some sort of download helper to download the video.  Never install those from unknown sites.  They are likely some sort of trojans that monitor your activity.  I avoid any sites that require them.
Lionel MMSmall Business IT ConsultantAuthor Commented:
ok so how do I get to activity monitor? and what should I do about itunes helper, uninstall it? is that part of itunes?
Lionel MMSmall Business IT ConsultantAuthor Commented:
found activity monitor--found the "search" (like windows, start, search) and that makes it easier to find stuff.
That's called spotlight.

Utilities are generally found in /Applications/Utilities/

Here's a link to some basic tips to start you off.
Lionel MMSmall Business IT ConsultantAuthor Commented:
when I type in terminal
rm -r "~/Library/Application Support/Google/Chrome"
i get error message, "no such file or directory"
however when i try to run google it keeps crashing saying "pages have become unresponsive"; so I uninstalled it, downloaded it from web, and re-installed get--same results.
Lionel MMSmall Business IT ConsultantAuthor Commented:
OK I had the user remote on the system and test speed and responsiveness and they said it is very slow--things that used to take a few seconds are now taking minutes. I suspected there was more issues but could not tell since I did not have a benchmark. So at this point what is going to be the best thing to do--keep trying to chase down the cause of the slowness or reinstall the OS? I have already spent more than 4 hours on this and I know from my Windows experience that if you can't get an infected system working normally within the first 2 to 3 hours it is best to start over. So I am relying on your experience with MACs to guide me here. I don't want to keep chasing things down if in the end you may end up telling me to reinstall anyways but if you are 100% sure you can find the cause of the slowness/unresponsiveness I will trust your judgment.
David AndersTechnician Commented:
Etrecheck will list processes, applications, machine specs. It is built for troubleshooting.
AdwareMedic removes most trojans, adware, and hijacks. It has manual instructions also.
Running Disk Utility's Repair Disk on the boot drive may help (depending on OSX ver and if a recovery partition is present.)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
You can safely reinstall just the OS on a Mac.  It will not delete the user file and applications.  If you have a fast connection and a newer Mac with an SSD, it should take about 30 minutes.  If you have a spinning disk, it should take about an hour or two depending on the age of your system.

Unfortunately, that may not fix Chrome, if the problem is with Chrome.

If you want to do a full wipe like windows, you will have to first erase the disk, then you can install the OS on a blank disk, bringing everything back to what it was.  You should only have to back up the user's data from the user's home folder before you wipe it.  It's best to back up everything including suspected files.  When you do the restore, you can copy back the parts you need.  If you want to keep the user preferences including all the user settings for various apps, then copy the user's Library folder back.  If you want to start fresh, then don't copy that back first.

You can also create a 2nd admin account and back up, then delete, the user's Library folder Contents.  That might be quicker than a full OS reinstall.
If it weren't for the explicit mention of the download helper app, I would have also mentioned the SMC reset, then PRAM reset, then Disk Repair.

SMC reset.

Turn off laptop.
Plug in Power.
Hold left Shift Control Option then press and hold the Power Button for at least 15 seconds.

PRAM reset

Turn off Mac
Turn on Mac, and press and hold Command Option p r
Wait for Chime or Bong 3 times.
Release the keys and allow it to boot normally.
Also, check the (/Applications/Utilitiies/ or use Spotlight) for error messages that might indicate what might be slowing you down.
Lionel MMSmall Business IT ConsultantAuthor Commented:
OK so that seems to be a mix of reinstall and troubleshooting recommendations. So if you were me what would you do? I don't mind either approach I just don't want to start down one path that will lead to another eventually. I already have a full backup using timemachne onto an external drive--took about 6 hours to complete. It seems to me that you may also be saying that the problem could be with this user's "profile" so is this similar to Windows where if I create a new user that this should give me some indication as to whether the problem is with the system if the problems persist with a new user or with the users "profile" if the disappear with a new users?
David AndersTechnician Commented:
Running Etrecheck takes less than five minutes.
Running AdwareMedic takes less than seven minutes.

Starting in Safe Mode is just like Windows, indicates if added software, drivers, etc is the fault.
Creating and logging into a new admin user, indicates if it is a system or user problem.
Lionel MMSmall Business IT ConsultantAuthor Commented:
On Apple what is the deal with applications--are all apps that user Abc installs available to all other users? I know with some Windows and most Ubuntu apps you can decide when you install but how does it work on Apple products? thanks.
Normally all applications are available to all users and are installed in the /Applications folder at the root of the hard drive.

Applications can be installed for individual users by installing them in the Applications folder in the user's home folder instead, but that is very seldom done.
Lionel MMSmall Business IT ConsultantAuthor Commented:
I have to say I getting very frustrated with this OS--there was an update pending for it--asked me if I wanted to reboot and install it so I said yes. Took about 15 minutes to get back to a desktop. Now the screen dims and brightens and dims and brightens--I checked the power saver settings and those are exactly what they were before, no changes. Now about every 30 seconds or so the screen will dim, stay dim for about 10 to 15 seconds, then brighten then dim again. ??????????????????????????????
Lionel MMSmall Business IT ConsultantAuthor Commented:
I will run these tests as suggested but this mac book pro was fine for 2 days, with regards to this dim/brightness issue that is--then when the OS updated itself these problems started. Is there a way I can revert back to before this update? Do I use timemachine or is there some other way to remove "updates"?
Have you reinstalled the OS yet?
Lionel MMSmall Business IT ConsultantAuthor Commented:
Apple Hardware Test -- OK
Etrecheck - all seems OK but please review report attached
AdwareMedic found 7 infected files
disk scan came back with "disk seems ok"
New user definitely starts apps faster but now old user is much better but when logging in takes a long time and starting apps, fresh start is still significantly slower but much better than yesterday.
PRAM & SMC reset have not done these yet--what will these do?
It looks like you are running more than one A/V program (Avast, ClamAV and Sophos). Uninstall ClamAv and Sophos.
Lionel MMSmall Business IT ConsultantAuthor Commented:
I did "uninstall" -- it actually had a uninstall icon so I did not just drag it to trash but ran an uninstaller so how do I go about removing what you are seeing? Still will that account for slowness--when I start system monitor and watch resources in use when I start an app CPU hardly ever gets above 40 to 50% and there is always RAM open although it does get close to 100% quite often.
Lionel MMSmall Business IT ConsultantAuthor Commented:
Thanks for all the help but never again do i want hear that Apple devices do not get "viruses"/malware--have had to deal with this now on this MAC book and on iPhones.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Mac OS X

From novice to tech pro — start learning today.