2016 rMBP weirdness, malware, repeated iCloud password ask

My girlfriend’s 2016 MacBook Pro is acting weird.
It repeatedly asks for the iCloud/Apple password. I’ve logged out and logged back in, rebooted several times.
Another weirdness is that the internet seems to selectively work. For example, google.com works, as does apple.com, but macpaw.com, and sophos.com, do not. This is true in Safari, FireFox, and Chrome.

I ran Sophos, and it found two Potentially Unwanted Apps, which were classed as adware: genieo, and bundlore. I had Sophos clean them.

Problems detailed above persist.

Doing a TimeMachine backup now (260 days since last backup, groan).

I would appreciate any advice.

Are there any profiles installed that you don’t recognize?

1 Like

No, only her two users, a guest user, and a group for MacPorts (which is probably something I installed long ago).

Open Keychain and look for any multiple entries with the same login credentials. Delete duplicates. It could have caused issues, but I doubt it’s the cause. But deleting dupes won’t hurt.

I’d:

• Disable 2-factor-auth for now at appleid.apple.com

• On the Mac go to System Preferences > iCloud and uncheck off all apps.

• Sign out of FaceTime in FaceTime > Preferences.

• Then sign out of iCloud on the Mac at System Preferences > iCloud

• Restart.

• Go to System Preferences > iCloud and sign back in, then reselect apps/services to sync with iCloud.

2 Likes

Pay close atention to the password that is being asked for. At some point you need to enter the Admin / User password and NOT apple iD.

Been there done that…:see_no_evil:

1 Like

I did a backup, format, install, restore (I guess that’s a nuke and pave).
So far all websites are working. I removed Flash. There are a couple of system extensions that I haven’t enabled yet. I think at least one is a virtual serial port for my GF’s cutter/scanner.

Thanks everyone for the input. Hopefully this resolves whatever it was.

Those are users & groups I think?

I meant if you look in systems preferences: profiles
(if it’s not shown you can search for it)

is there anything installed?

When I search for “profile” in System Preferences, all I find are Display profiles.

Then it is probably empty. So you should be ok on that front.

DNS settings are also as expected?

and if so:
Have you considered a nuke&pave?
(when was the last clean install?)

1 Like

Very recent :wink:

whoops, did not see that :slight_smile:

@JohnAtl if you restore data right after the OS install with a migration assistant, it’s NOT a nuke and pave. To Nuke and Pave, you need to install the OS, then install each apps from the apple store or with the installer, then copy your data from a backup selectively, meaning you don’t copy the whole user/library folder or something like that. Its certainly a pain to do compared to just restoring from a TM backup but you are sure to start fresh and not bring the bug that got you in the first place. Although, if your backup is 260 days old, probably not;-) If restoring from you TM worked, that’s even better, but if you ever find the need to really do a Nuke and Pave, now you’ll know:-)

1 Like

Thanks to all!
She used it all day yesterday without any issues, so I think she’s good to go.

I’m considering a proper nuke and pave on mine (as detailed by @JeffLambert670) when Catalina drops.
Kind of scary though.