Solved! Random words or old searches appearing on my cursor - is it a virus?

[Arabella123]

Hi there - I've noticed that whne I scan around with my mouse from my mac book pro lap top - (track pad mouse) that words from previous searches randomly pop up.....or it may just say a friends name from Facebook ....it's really odd. It doesn't only happen when I scan across the tab which one might expect - it happens randomly wherever on the screen and sometimes MONTHS past when I did the original search. Here's an example.....oh I can't seem to insert image from my desktop. It's basically a floating white text box. Any ideas?

 

[Robert Neville]

you might be infected with a virus if you want to be safe you can reinstall your operating system and see if the problem comes back

 

[Cloudy1]

A reinstall will certainly tell you if it is a software or hardware problem I.e., if a reinstall fixes the issue then it was software related, if not then you have a hardware issue.

Before jumping into that though, I am wondering if this might be the "Lookup and data detectors" setting... and I say that somewhat hesitantly as I have very little experience with MAC to be honest.

Worth a shot though IMO so if you wanna give it a whirl:

System Preferences - > Trackpad - > Point and click - > Uncheck Lookup and data detectors.

Crossing my fingers for you whilst I also possibly clutch at straws... a screenshot of the problem would be handy

 

[verndewd]

sudo nmap -sV -Pn --script=http-malware-host 192.168.0.4
use your own ip address. get homebrew and nmap on the mac app store.brew is a command line installer just makes life easier.http://macappstore.org/?s=nmap

 

[verndewd]

sudo chkrootkit

you will need to install rootkit hunter or chkrootkit from the mac app store

http://macappstore.org/?s=chkrootkit running this in a moment myself
sample output:
Checking syslogd'... not infected Checking tar'... not infected


Checking tcpd'... not infected Checking tcpdump'... not infected


Checking top'... not infected timed will show as infected due to apple changing how it behaves. Checking telnetd'... not found


Checking timed'... INFECTED Checking traceroute'... not infected

chkrootkit -- locally checks for signs of a rootkit

chkrootkit locally checks for signs of a rootkit. Includes ifpromisc.c to check if the interface is in promiscuous mode, chklastlog.c and chkwtmp.c to check for lastlog and wtmp deletions and chkproc.c for signs of LKM trojans.

www.chkrootkit.org

 

[verndewd]

sudo find / -user 502 -exec chown camf {} \; try this to reset any hijacked permissions