Do I have a virus, trojan, or...?

Recently experiencing unusual issues, not sure if random or related, though all started happening within short timeframe & never had them before. Here's what's happened in order of occurrence: Delayed typing lag in email app for a week or so; email "NOTE" could not be saved then automatically erased itself;

[I'm sorry it's long, I tried to edit original, but not working!] Recently experiencing unusual issues, not sure if random or related, though all started happening within short timeframe & never had them before. Here's what's happened in order of occurrence: Ran OS auto software update (to 10.6.8); Ext. WD backup drive began mounting & unmounting on its own, after update, stopped working via FW cable, was able to access via usb temporarily, then it stopped working completely (no power, no nothing, apparently dead); Delayed typing lag in email app for a week or so; email "NOTE" could not be saved then automatically erased itself; one of my email accts. has been blocked from Earthlink, due to apparent spamming (which I have never done!), although Earthlink continually states my IP is not blocked, then they bounce my emails back; and now I just purchased a replacement WD drive (different model than before), which worked perfectly for 3 days of Time Machine backups (I only b/u a couple times a wk--not much on my mac), and it just died. Seriously. I have tried to access both WD drives via hubby's pc (WD's suggestion) with no success. I see no evidence of MacDefender, etc. in my Activity Monitor, have not installed any 3rd party stuff, don't d/l or open anything I can't completely trust, yet something is going on. I would truly appreciate help, as I'm baffled!

Similar Messages

I have a virus/trojan that's still lingering after formatting my macbook twice!

Hi, so i downloaded parallels and now I have some kind of virus that's hiding somewhere in my macbook. i've erased my entire hard drive twice. Once where it's just the 'macintosh' partition and the other is the entire thing. it seems that this is only restoring it to factory settings because the virus is still causing a fake mackeeper advertisement pop up to keep appearing. i've tried using things like clamXav to try and find the problem but it looks as though this is pretty deeply rooted. i've also had a look into login items and there's only itunes helper. i'll take a screenshot of the pop up and put it in here ASAP.
-thanks.

The trojan can be removed by killing the process "MacDefender" in Activity Monitor, deleting the application and the preference file, and removing the login item. There would also be a receipt in /var/db/receipts if you ran the installer.
more info:
http://www.reedcorner.net/news.php/?p=82
https://discussions.apple.com/thread/3032201?start=0&tstart=0

My security software says that I have a virus Trojan.Script.483139. It is located in the AppData\Roaming\Thunderbird\Profiles folder. Is this from you?

The directly path is Users\Chris\AppData\Roaming\Thunderbird\Profiles\sqmsakij.default\ImapMail\imap.googlemail.com\...changelog.htm

I can't find a changelog.htm in my folders.
Maybe that's an attachment to a message you got? I think it's dangerous to have security software try to rip out an attachment -- who knows what that might do to your mailbox. But if you see an attachment with that name, ''don't open it''. (Unless you are software developer, you probably weren't going to be tempted by a change log anyway.)
If you can figure out the full path (the missing ... part might be helpful), maybe it will show which folder this message is in. Could be in Junk.

Mail - Virus/Trojan/Worm got in?

I noticed during a send and receive and email being sent when I had not created one.
The subject is not one related to anything I have done or received...
Have a virus/trojan/worm?
I did a screen grab....
Check out the send http://images47.fotki.com/v1498/photos/2/537502/7582427/EmailSend-vi.jpg

I have got the same problem. None of my mailboxes are IMAP, only POP. Im looking at the activity screen as you suggested. But it only states what is going on. So it is difficult to track (occurs seldom and quickly)
Also our server is blacklisted, bc someone of us is sending out spam (I could be me)
thanks for the help

How to tell if you have a virus on imac

I sent an email with a word document attachment created by myself and was told by the recipient that it contained a virus. how are we able to see if we have a virus or Trojan we have an imac. can we carry out some system check?

I suspect your recipient's computer is in error.
Helpful Links Regarding Malware Protection
An excellent link to read is Tom Reed's Mac Malware Guide.
Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.
See these Apple articles:
          Mac OS X Snow Leopard and malware detection
          OS X Lion- Protect your Mac from malware
          OS X Mountain Lion- Protect your Mac from malware
          About file quarantine in OS X
If you require anti-virus protection I recommend using VirusBarrier Express 1.1.6 or Dr.Web Light both from the App Store. They're both free, and since they're from the App Store, they won't destabilize the system. (Thank you to Thomas Reed for these recommendations.)

How do I know that Foxfire has found a virus/trojan? I see the foxfire logo, but when I click on the protect button, it wants me to download an other site.

I logged on to Foxfire, Google then did a search for a pattern for a Belly Dancers hip scarf with bangles. After checking out a few sites, a Security Alert appears on my screen with the FOXFIRE logo and a list of Virus/Trojan with critical and high risk. At the bottom of this Alert it request that to protect I click button. When I do an other window pops-up requesting me to download a site that will remove the virus/Trojans. It said if I don't my computer will crash. I have not done this, but in the past I had something like this happen and I downloaded a site that requested that I pay money, before they would remove virus/Trojan. My question is HOW DO I TELL IF THE SECURITY ALERT IS FROM FOXFIRE and how to remove the virus/Trojans that Foxfire has discovered.

Hi Im Alexander and i will be helping you today
That is dangrous when you clicked on the link you got a virus and its already installed on your computer to see how it works click on this link http://www.youtube.com/watch?v=F4fI9B9VXB0 (if it dosent work copy and paste it in you adress bar) and to download the virus protection click this link http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html if it dosent work copy and paste it in your adress bar !!!!!!!!! if you have any questions email me at [email protected]
Thanks

How do i get rid of the pop ups that are constantly popping up on my mac. Everytime i search for anything on google an ad for mac keeper comes up and every time i access Netflix another stream of ads pop up... Do i have a virus HELPPPPPP

How do i get rid of the pop ups that are constantly popping up on my mac. Everytime i search for anything on google an ad for mac keeper comes up and every time i access Netflix another stream of ads pop up... Do i have a virus HELPPPPPP

You may have installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

My Mac keeps freezing in the middle of applications (most notable Safari) requiring me to shut down and restart. It also freezes during video playback (online and using Quicktime). Do I need to wipe and reinstall OS? I'm thinking I have a virus........

Please help!! It's driving me nuts. I've reinstalled the OS via the disc about 3 times so far, but haven't yet erased the drive (and am seriously considering doing so). I barely have any files on my HD because I run everything off of external drives (after losing a TON of stuff after my Mac crashed in the first 3 months of having it). I bought the computer in 2007 and was running Tiger. I passed on Leopard but gave in for Snow Leopard because I wanted an iPhone and iPad. When I installed SL, I had to reformat the HD and made it Journaled......it's been acting ******** ever since.

First you don't have a virus because none exist for OS X. So you can stop worrying about hat. If you recently got a warning about a Virus and accepted downloaded some software then you fell for a Trojan. Here is an article about that and how to rid yourself of it.
If you did not download anything like that then doing a Erase and Install would be the way to go. Here is a video that will show you exactly what to do.

I don't know what is going on with my mac. (10.9.5) Do I have a virus? What to do?

I accidentally clicked a link and downloaded something I did not mean to. I put in my administrators password and it downloaded. Now every time I click on Safari, instead of google as my home page like normal, it redirects me to this "Only Search" site which has a lot of ads and looks like a very shady evil twin of google. Also whenever I click a link, an ad pops up in another tab. I have pop ups blocked in my settings, I have also tried multiple times to change my home page back to google. But each time it changes itself back to the "Only Search" site. Computer is also being very slow and laggy. Do I have a virus or trojan? If so what do I do about it?

Click here and follow the instructions, or if you'd rather use removal software, download and run Adware Medic. The second link is a direct download; if it gives you an error message, see this page.
(116746)

I am told I have 6 viruses. I am trying to buy softward, but all three cards are declined. How can I protect my computer?

I am trying to buy a mac protector. My computer is telling me I have 6 viruses. I am shocked b/c I thought Mac didn't get them, but anyway, every credit card I own is being declined. Help me...I am trying to save my computer.

Your Mac does not have any viruses. There are no viruses that affect or infect OS X, not one.
You have fallen for a trick, which is called social engineering. This is malware - a trojan, and a phishing scam to get your credit card number to take your credit card account to the cleaners.
http://www.spywared.com/news/remove-mac-protector-mac-protector-removal-1088.htm l

I think I have a virus/spyware/adware???

Hello!
Last week while I was on www.google.com searching images, my Safari download manager popped up and began downloading "soft_58s7.exe". I immediately deleted it and assumed that I had clicked on an image that took me to a link that gave me a virus. I continued on using google, and when searching something completely different the download occurred again, and again. Each time I deleted the file from my computer by locating it in Finder and dragging it to the trash.
However, not I get random pop-ups everyone once in awhile while using sites that I know do not have pop-ups (Google search, aol.com, facebook). So I think I have a virus.
I also tried to download ProtectMac Antivirus, but it tells me that it cannot be downloaded because there is another antivirus software on my computer that it is not compatible with. I checked my applications and there was an app called "VirusProtect", which I drug to the trash as well. However I still received this message that ProtectMac could not be installed because of another antivirus application. I believe that I either did not uninstall VirusProtect correctly, which I need help doing because the icon is no longer there, or this is also an effect of the virus.
Please help!!
Im on a MacBook, running OS X 10 .5.8
Thank you!
I think this is also an effect of the virus because I have no virus protection on my com

.exe files are Windows executables that do not run on Macs, and simply downloading one will not give you a virus. Random pop-ups in your browser may occur but as long as you dismiss them there should nothing of concern.
You cannot delete virus protection software by dragging it to the Trash. You must use the appropriate uninstaller that is included with the software.
Also see:
Do You Need Anti-Virus Protection for Your Mac?
According to Rich Mogull's article, Should Mac Users Run Antivirus Software?,
"The reality is that today the Mac platform is relatively safe. There are hundreds of thousands of viruses and other malicious software programs floating around for Windows, but less than 200 are known to target the Mac, and many of those are aimed at versions of the Mac OS prior to Mac OS X (and thus have no effect on a modern Mac).
It's not that Mac OS X is inherently more secure against viruses than current versions of Windows (although it was clearly more secure than Windows prior to XP SP2); the numerous vulnerabilities reported and patched in recent years are just as exploitable as their Windows equivalents. But most security experts agree that malicious software these days is driven by financial incentives, and it's far more profitable to target the most dominant platform."
Mr. Mogull is a computer security expert. I recommend reading the entire article as it is quite informative.
For additional information on viruses, trojans, and spyware visit The XLab FAQs and read the FAQs on viruses and spyware.

How can I figure out if I have a virus?

I'm afraid that I may have caught a virus on my Macbook, because when I'm into safari things keep popping up. How can I determine whether or not i have a virus? Or is that even possible?

There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form
          com.something.daemon.plist
and
           com.something.helper.plist
Here something is a variable string of characters, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes it's a meaningless string such as "e8dec5ae7fc75c28" rather than a word. Sometimes the string is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.
If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:
/Library/LaunchAgents
In this folder, there may be a file named
          com.something.agent.plist
where the string something is the same as before.
If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.
The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.
Open this folder:
/Library/Application Support
If it has a subfolder named just
           something
where something is the same string you saw before, drag that subfolder to the Trash and close the window.
Don't delete the "Application Support" folder or anything else inside it.
Finally, in this folder:
/System/Library/Frameworks
there may an item named exactly
            v.framework
It's actually a folder, though it has a different icon than usual. This item always has the above name; it doesn't vary. Drag it to the Trash and close the window.
Don't delete the "Frameworks" folder or anything else inside it.
If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
          Install system data files and security updates (OS X 10.10 or later)
or
          Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.

I have got a TROJAN from your webbside when I uppgrade. File name W97M/Downloader.afp!! What to do?????

I have got a TROJAN from your webbside when I uppgrade. File name W97M/Downloader.afp!! What to do?????

This is a user to user forum.
Use the contact page to get a hold of Adobe and give them as much detail as possible on where you received the virus. It is possible that the virus became active about the same time you downloaded from Adobe making you think that is where it came from. But viruses have been known to activate after a set time. That may or may not be the case for you, just making you aware that something else could have been the culprit.

Do I have a virus that isn't showing up?

i went into a website and then something came up saying i had a virus, the website went off my computer and something came up that looked like a virus scanner and said my computer was infected. i exited the "virus" and my macbook pro seems unaffected. Since then i have done a system update and deleted all my history on both safari and firefox (i was using firefox when this happened) on my macbook pro. I know it is highly unlikely but still possible that my mac was infected. Should I be worried?

Could be a flakey PC trap and that message comes up automatically for every visitor. Lots of these use FUD to scare visitors enough to download their phony virus protection program. Which turns out being a virus, trojan horse of some kind of adware that does nothing beneficial for the visitor.
(FUD - Fear Uncertainty Doubt) Often used by sneaky politicians, attorneys and used car salesmen to get you to do something not in your best interest.

Do I have a virus on my Mac Air because I keep getting ads for MacBooster and MacKeeper?

Do I have a virus on my Mac Air because I keep getting ads for MacBooster and MacKeeper?

You may have installed the "VSearch" trojan. Remove it as follows.
Malware is always changing to get around the defenses against it. These instructions are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Internet criminal behind VSearch has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Do I have a virus, trojan, or...?

Similar Messages

Maybe you are looking for