How do I find if iMac infected by virus?

how do I find if iMac infected by virus?

dz5 wrote:
I just installed Avast on my iMac. It did a full scan and found ( Win32:MalOb-C[Cryp] )
I deleted the 30 infections and 7 warnings. I hope this fixes the problem 4/30/13
Sorry, but that's Windows only malware, so unless you are having Windows issues, it's not going to solve your problem, whatever it is.
I got this from an email and I changed my email password, but it surfaced again
before I did this scan.
Be careful how you deal with infected e-mails as you can easily corrupt the mailbox index and cause a few other issues, including leaving that e-mail on the server.  Always delete e-mails from within your e-mail client.

Similar Messages

  • How do I scan my iMac for a virus, we may have opened an email with a virus

    how do I scan my iMac for a virus, we may have opened an email with a virus

    http://www.thesafemac.com/mmg/

  • How can I find and remove b.scorecardresearch virus ?

    FOUND THIS BUT NO SOLUTION: 
    This link does not work - it gives that 4400 error message.
    Re: b.scorecardresearch.com 
    Apr 17, 2014 10:14 PM (in response to Austin Kinsella1)
          Try reading this report on Lingua Franca.
    How do you find this in LION OS Mac Pro Desktop, and get rid of it entirely? After reading discussions on the web,
    and when it began,  I agree.  It began with iCloud intially and got worse with the addition of iPhone.
    Is there an EASY way to get rid this,  AND  stop the Cloud connection without losing all my things on the
    desktop ?   The last place I was sent re: removing iCLoud they said to copy and paste each file (one at a time)
    back to my computer, then remove iCloud.  I have over 4200 Files - there has to be an easier way.

    If you want to get this issue out of the way once and for all, in a few minutes, see below.
    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.
    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
    There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
    3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) on the advice of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
    Here's a summary of what you need to do, if you choose to proceed:
    ☞ Copy a line of text in this window to the Clipboard.
    ☞ Paste into the window of another application.
    ☞ Wait for the test to run. It usually takes a few minutes.
    ☞ Paste the results, which will have been copied automatically, back into a reply on this page.
    The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
    4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
    5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
    6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
    Triple-click anywhere in the line of text below on this page to select it:
    PATH=/usr/bin:/bin:/usr/sbin:/sbin;clear;c01='\nRAM details\n%s\n';c02='pmset -g';c03='boot-args';c04=(/ "");c05=(System User);c06='user %s%%, system %s%%';c07='/usr/libexec/PlistBuddy -c Print';c08='%s\n\t(%s)\n';c09='defaults read';c10=networksetup;c11='^[[:space:]]*((127\.0\.0\.1|::1|fe80::1%lo0)[[:space:]]+local|(255\.){3}255[[:space:]]*broadcast)host[[:space:]]*$';c12='com.autodesk.AutoCAD com.evenflow.dropbox com.google.GoogleDrive';c13=(Desktop L*/Keyc*);c14=(20 7);c15=(100 25);c16=(down up);c17=(recvfrom sendto);c18='\n%s\n\n%s\n';c19='\n%s: %s\n';F01(){ ((s00==0));};F02(){ o=;a=;((s01==0));};F03(){ system_profiler SP${1}DataType;};F04(){ o=`echo $o`;[[ ! "$o" =~ ^0?$ ]]&&printf "$c19" "$1" "$o";};F05(){ o=$((o<$2?o:0));F04 "$1";};F06(){ [[ "$o" ]]&&o=`sed -E '/^ *$|CSConfigDot/d;s/^ */   /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/(\/Users\/)[^/]+/\1-/g'<<<"$o"`&&printf "$c18" "$1" "$o";};F07(){ o=$((o>=$2?o:0));F04 "$1";};F08(){ $c07\ :CFBundleIdentifier "$1";};F09(){ $2 launchctl list|awk 'NR>1&&!/0x|\.[0-9]+$|com\.apple\.(AirPortBaseStationAgent|launchctl\.(Aqua|Background|System))$/{print $3}'|grep -Fv "$1";};F10(){ find -L "$1" -type f|while read f;do file -b "$f"|egrep -lq XML\|exec&&echo $f;done;};F11(){ o=`grep -v '^ *#' "$2"`;l=`wc -l<<<"$o"`;((l>25))&&o=`head -n25<<<"$o"`$'\n'"and $((l-25)) more line(s)";F06 "$1";F12 "$1";};F12(){ o=`file -b "$1"|egrep -v '^(A.{16}t$|cann)'`;F04 "${1##*/} format";};F13(){ o=`$c07 "$2"|awk -F'= ' \/$3'/{print $2}'`;F06 "$1";};F14(){ [[ "$a" ]]||return;n=$((${#a[*]}-1));c="${a[*]}";a[$n]=${a[$n]%[.+-]*};o=$((a[n]/$1));F07 "Current $3 activity by process \"${c% ${a[$((n-1))]}*}\" with UID ${a[$((n-1))]} ($4)" $2;};id -G|grep -qw 80;s00=$?;F01&&sudo true;s01=$?;s02=`date +%s`;clear;s03=$((s02-`sysctl -n kern.boottime|cut -c9-18`));{ F01||echo $'No admin access\n';F01&&! F02&&echo $'No root access\n';F03 Software|sed -n 's/^ *//;5p;6p;8p;12p';a=(`F03 Hardware|awk '/ Id/{print $3};/Mem/{print $2}'`);o=$a;F04 Model;o=${a[1]};F05 "Total RAM (GB)" 4;o=`F03 Memory|sed '1,5d;/[my].*:/d'`;[[ "$o" =~ s:\ [^EO]|x([^08]|02[^F]|8[^0]) ]]&&printf "$c01" "$o";o=`F03 Diagnostics|sed '5,6!d'`;[[ "$o" =~ Pass ]]||F06 POST;s04=`F03 Power`;o=`awk '/Cy/{print $NF}'<<<"$s04"`;F07 "Battery cycles" 300;o=`sed -n '/Cond.*: [^N]/s/^.*://p'<<<"$s04"`;F04 "Battery condition";for i in FireWire Thunderbolt USB;do o=`F03 $i|sed -En '/:$/{s/ *:$//;x;s/\n//;/Apple|Genesy|Intel|SMSC/d;s/\n.*//;/\)/p;};/^ *(V.+ [0N]|Man).+ /{s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;}'`;F06 $i;done;o=`$c02 therm|sed 's/^.*C/C/'`;[[ "$o" =~ No\ th|pms ]]&&o=;F06 Heat;o=`$c02 sysload|grep -v :`;[[ "$o" =~ =\ [^GO] ]]||o=;F06 "System load";o=`nvram $c03|awk '{$1=""};1'`;F04 $c03;o=`fdesetup status|sed -En '/Of/!{s/^.+is |\.//g;p;}'`;F04 FileVault;for i in 0 1;do o=`cd ${c04[$i]}L*/Lo*/Diag*||continue;for j in *.{cr,h,pa,s}*;do [[ -f "$j" ]]||continue;d=$(stat -f%Sc -t%F "$j");[[ "$j" =~ h$ ]]&&grep -lq "^Thread c" "$j"&&j="$j *";echo "$d ${j%%_2*} ${j##*.}";done|sort|tail`;F06 "${c05[$i]} diagnostics";done;grep -lq '*$'<<<"$o"&&printf $'\n\t* Code injection\n';o=`syslog -F bsd -k Sender kernel -k Message CReq 'caug|dead[^l]|GPU |hfs: Ru|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN' -k Message Ane 'SMC:' -o -k Sender fseventsd -k Message CReq 'SL'|tail -n25|awk '/:/{$4=""};1'`;F06 Log;o=`df -m /|awk 'NR==2{print $4}'`;F05 "Free space (MiB)" 5120;o=$(($(vm_stat|awk '/eo/{sub("\\.","");print $2}')/256));F07 "Pageouts (MiB)" 1024;a=( `sar -u 1 10|sed '$!d'` );((a[4]<85))&&o=`printf "$c06" ${a[1]} ${a[3]}`||o=;F04 "Total CPU activity"&&{ a=(`ps acrx -o comm,ruid,%cpu|sed '2!d'`);F14 1 0 CPU %;};o=`iostat -n1|awk 'NR==3{printf "%d",$3}'`;F07 "Average I/O (MB/s)" 5;F02&&a=(`sudo iotop -C 10 1 -m/|awk '$8~/[RW]/{print $4,$1,$9}'|tail -1`);F14 10000000 5 I/O MB/s;a=(`top -R -l1 -n1 -o prt -stats command,uid,prt|tail -1`);F14 1 25000 port \#; s05=`pkgutil --regexp --only-files --files com.apple.pkg.*|sort|uniq|sed 's:^:/:'`;s06=`egrep '\.(kext|xpc)/(Contents/)?Info.plist$'<<<"$s05"|while read i;do [[ -f "$i" ]]&&F08 "$i";done`;o=`kextstat -kl|grep -Fv "$s06"|cut -c53-|cut -d\< -f1`;F06 kexts;s07=`egrep 'Launch[AD].+\.plist$'<<<"$s05"`;s08=`while read i;do [[ -f $i ]]&&$c07\ :Label $f;done<<<"$s07"`$'\n'"$s06";F02&&o=`F09 "$s08" sudo`;F06 Daemons;o=`F09 "$s08"`;F06 Agents;o=`for i in {/,}L*/Lau*;do F10 $i;done|grep -Fv "$s07"|while read i;do j=$($c07\ :Label "$i")||j="No job label";printf "$c08" "$i" "$j";done`;F06 launchd;o=`for i in /{S*/,}L*/StartupItems;do F10 $i;done`;F06 "Startup items";s09=`sed -E '/^.+Lib.+\/Contents\/Info.plist$/!d;s/\/Info.plist$//;/Contents\/./d'<<<"$s05"`;s10=`egrep '^/usr/lib/.+dylib$'<<<"$s05"`;s11=`lsbom -pfc /var/db/*/*.BSD.bom|sed -En '/peri.+\/.+\./s/^\.\/[^/]+//p'`;[[ "$s09"&&"$s10"&&"$s11" ]]&&{ o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune|grep -Fv "$s09"|while read i;do j="$i"/Info.plist;[[ -f "$j" ]]||continue;k=$(F08 "$j")||k="No bundle ID";printf "$c08" "${i%/Contents}" "$k";done`;F06 Bundles;o=`find /usr/lib -type f -name *.dylib|grep -Fv "$s10"`;F06 dylibs;o=`find -L {,/u*/lo*}/e*/periodic -type f -exec cksum {} \;|awk '{print $3"\t"$1}'|grep -Fv "$s11"|awk '{print $1}'`;F06 periodic;:;}||echo $'\nReceipts missing';o=`for i in Ic10ERT_LIBRARIES LIBRARY_PATH;do launchctl getenv DYLD_$i;done`;F06 "Inserted dylibs";o=;$c09 /Library/Preferences/com.apple.alf globalstate|grep -q 0||o=On;F04 Firewall;o=`scutil --proxy|egrep 'Prox.+: [^0]'`;F06 Proxies;o=`scutil --dns|awk '/r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./{print $NF;exit}'`;s12=`route -n get default|awk '/e:/{print $2}'`;s13=`$c10 -listnetworkserviceorder|sed -En '/ '$s12'\)$/{x;s/^\(.+\) //p;q;};x'`;s14=`$c10 -getdnsservers "$s13"|awk '!/^T/{printf "not ";exit}'`;F04 "DNS (${s14}from DHCP)";o=`$c10 -getinfo "$s13"|awk '/k:/&&$3!~/(255\.){3}0/;/bi:/&&$2!~/A/'`;F06 TCP/IP;[[ "$s13" =~ [AW]i ]]&&{ o=`/S*/*/P*/*/*/*/*/airport -I|awk '/lR/{print $2}'`;F05 RSSI -86;};s15=(`netstat -b -I $s12|tail -1|awk '{print $7,$10}'`);for i in 0 1;do o=$((s15[i]/s03/1024));F07 "Average ${c16[$i]}load activity (KiB/s)" ${c15[$i]};F02&&a=(`sudo dtrace -n 'syscall::'${c17[$i]}':return {@[execname,uid]=sum(arg0)} tick-10sec {exit(0)}'|tail -1`);F14 10240 0 ${c16[$i]}load KiB/s;done;F02&&o=`sudo profiles -P|grep :|wc -l`;F04 Profiles;i=auto_master;[[ `md5 -q /etc/$i` =~ ^b166 ]]||F11 $i /etc/$i;for i in fstab sysctl.conf crontab launchd.conf;do F11 $i /etc/$i;done;i=/etc/hosts;F11 hosts <(egrep -v "$c11" $i );F12 $i;F11 "User launchd" ~/.launchd*;F02&&F11 "Root crontab" <(sudo crontab -l);F11 "User crontab" <(crontab -l);F02&&o=`sudo $c09 com.apple.loginwindow LoginHook`;F06 "Login hook";s16="$(`find /S*/*/F* -type f -name lsregister|head -n1` -dump)";o=`for i in $c12;do [[ "$s16" =~ $i ]]&&echo $i;done`;F06 Apps;F13 "Global login items" /L*/P*/loginw* Path;F13 "User login items" L*/P*/*loginit* Name;F13 "Safari extensions" L*/Saf*/*/E*.plist Bundle|sed -E 's/(\..*$|-[1-9])//g';o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)|wc -l`;F07 "Restricted files" 50;cd;o=`find .??* -path .Trash -prune -o -type d -name *.app -print -prune`;F06 "Hidden apps";o=`F03 Fonts|egrep 'id: N|te: Y'|wc -l`;F04 "Font issues";o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist|while read i;do plutil -s "$i" >&-||echo $i;done`;F06 "Bad plists";for i in 0 1;do o=`find "${c13[$i]}" -type f -maxdepth 1|wc -l`;F07 "${c13[$i]##*/} files" ${c14[$i]};done;o=;((UID==0))&&o=root;F04 UID;o=$((`date +%s`-s02));F04 "Elapsed time (s)";} 2>/dev/null|pbcopy;exit 2>&-
    Copy the selected text to the Clipboard by pressing the key combination command-C.
    7. Launch the built-in Terminal application in any of the following ways:
    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
    ☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
    Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
    8. If you see an error message in the Terminal window such as "syntax error," enter
    exec bash
    and press return. Then paste the script again.
    9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
    10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
    [Process completed]
    to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
    11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
    At or near the top of the results, there will be a line that begins with "System Version." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
    12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
    Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
    Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Terms of Use of the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

  • How do i find my iMac id which was lost ?

    I lost my apple id and do not know hoe to find it. help? 

    - If you previously turned on FIndMyiPod on the iPod in Settings>iCloud and wifi is on and connected go to iCloud: Find My iPhone, sign in and go to FIndMyiPhone. If the iPod has been restored it will never show up.
    - You can also wipe/erase the iPod and have to iPod play a sound via iCloud.
    - Change the passwords for all accounts used on the iPod and report to police
    - There is no way to prevent someone from restoring the iPod (it erases it) using it.
    - Apple will do nothing
    Reporting a lost or stolen Apple product              
    - iOS: How to find the serial number, IMEI, MEID, CDN, and ICCID number

  • How do i find specs for my imac

    please how do I find what imac I have

    Click on the Apple icon top left of your screen, then on 'About this Mac'.

  • Finding my iMac serial number for applecare registration

    How do I find my iMac  serial number?

    Choose About this Mac from the Apple menu and click the version twice. If you can't do so, click here.
    (124533)

  • How can I find what apple ID I used to register my iMac when I first booted up? I am being told that by using this ID I will be able to go on to the App store and down load iPhoto at no cost. Is this true? My iMac does not have iPhoto resident on it now

    How can I find what apple ID I used to register my iMac when I first booted up? I am being told that by using this ID I will be able to go on to the App store and down load iPhoto at no cost. Is this true? My iMac does not have iPhoto resident on it now and I only purchased my new iMac in December 2012
    Thanks....

    Launch Keychain Access and click on Login in the left hand pane and then on Passwords.  Next do search for Apple in the search field at the top and click on Apple ID Authenicication in the list that comes up.  That will give you the ID no. and password.
    OT

  • How can I find my serial number for Adobe Acrobat 11. I got a new iMac and I don't want to use the new version at £18.00 per month. I don't need it. Thank you

    I used to use CS5 and I want to use the Acrobat version on my new iMac.
    How can I find my serial number for Adobe Acrobat 11.  I don't want to use the new version at £18.00 per month. I don't need it. Thank you

    Hi Anthony Aduhene
    Please refer : Find your serial number quickly

  • My iMac holds my main iTunes account.  How do I find out a list of all the devices that are authorized from this computer?

    My iMac holds my main iTunes account and it shows 4 devices are authorized to play iTunes.  I can only name 3.  How do I find out a list of all the devices that are authorized from this computer?

    I don't believe this is possible, but you can deauthorize all your computers and start over if you are concerned.
    See here
    Best of luck

  • How do I find out the date in which I registered my imac?

    How do I find out the date in which I registered my imac?

    It doens't really matter what date you registered it. However if you are looking to see when your expiration on AppleCare is/was it is 3 years from the original date of purchase. You can use the Apple Online Service Assistant afer you input the serial number click the link that says See your service and support coverage.

  • I used Duplicate Annihilator to isolate dups in iPhoto on my iMac. At the end it told me it had marked the word duplicate in the comments / description field. How do I find and delete the marked photos?

    I used Duplicate Annihilator to isolate dups in iPhoto on my iMac. At the end of its search, it told me it had marked the word duplicate in the comments / description field. How do I find and delete the marked photos?

    File -> New Smart Album
    Description -> contains -> Duplicate
    will find them.
    Then the keystroke to delete depends on which version of iPhoto you have. All the keyboard shortcuts are under the Help menu.

  • How do i find the url for my iMac

    How di I find the URL for my iMac?

    Can you explain in more detail what you mean? A URL is the address of a website - such as Apple.com or Harvard.edu. A computer will only have a URL if it has been set up as a web server and has name servers pointing to it (so that people looking for yourcomputer.com will be sent to the right place).
    Conversely, every computer has an IP address, which is numerical. If you're connected directly to your internet, you will have a public IP address (it might look like 245.46.120.30, for example). Most people connect to the internet through a router, though, which gives them a private IP address only visible within their own network (something like 192.168.1.4).
    Matt

  • How do I find the password for my iMac on version 10.7.4?

    How do I find the password for my iMac on version 10.7.4?

    DO NOT FOLLOW THE INSTRUCTIONS IN THE ABOVE LINKS.
    Boot into Recovery by holding down the key combination command-R at startup. Release the keys when you see a gray screen with a spinning dial.
    When the Mac OS X Utilities screen appears, select Utilities ▹ Terminal from the menu bar.
    In the Terminal window, enter “resetpassword” and press return. A Reset Password window opens.
    Select your boot volume if not already selected.
    Select your username from the menu labeled Select the user account if not already selected.
    Follow the prompts to reset the password. It's safest to choose a password that includes only the characters a-z, A-Z, and 0-9.
    Select  ▹ Restart from the menu bar.
    You should now be able to log in with the new password, but you won't be able to unlock the Keychain. If you've forgotten the Keychain password (which is ordinarily the same as your login password), there's no way to recover it. You’ll need to reset your keychain in the preferences of the Keychain Access application.

  • How do i find the music i sync from my ipad to imac

    how do i find the music i sync from my ipad to imac

    How did you sync the music from the iPad to the iMac? Did you plug the iPad in and choose File -> Transfer Purchases from <name of iPad> in iTunes?
    B-rock

  • How can I find out how much space iMovie content is taking up on my iMac?

    My hard drive is almost full.  I have begun deleting photos, but I think my videos are taking up the majority of the space on my iMac's hard drive.  How can I find out exactly how much space my videos are taking up?
    Thanks!

    , About This Mac, then click on the Storage tab at the top to see a simple graphic display, with detailed numbers below.
    (This example is from a new Mac with very little installed.)

Maybe you are looking for