Mac Malware/poisoned images

Question

Two detailed articles that go into greater depth of the malware attacking Mac users.
http://www.securelist.com/en/blog/6211/Rogueware_campaign_targeting_Mac_users
http://blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-p oison-google-image-search-results/
If your new to the party:
Mac targeted trojans are making their rounds mostly by poisoned images from Google.
The exploit depends upon Javascript, you can choose to turn it off in Safari preferences, however large portions of the web don't display or operate correctly without Javascript running.
A easier preventative option would be to use Firefox and the NoScript Add-on, use Firefox toobar customization to drag a NoScript button to the toolbar.
NoScript turns off all scripts and plug-ins by default, which you enable on a per site, per need, per visit type basis by clicking the NoScript button.
Firefox also has a pop-up window with a opt out before the downloads occurs, another safety step.
If you have click happy types types, it's advised to install the Public Fox ad-on as well, set a password on the broswer downloads.
If you have the trojan web page on your Mac's screen, simply use Apple Menu > Force Quit to quit the browser.
If you've downloaded but not run the installer, delete it immediatly from your downloads folder.
If you've installed the trojan and gave it your admin password, you need to backup your files to a external drive and c boot off the installer disk and Disk Utility > Erase with Zero your whole boot drive and reinstall  OS X fresh, re-install all programs from original sources, scan your files with a AV software and then return them to your computer.
If you gave the AV software your credit card information, you need to call the credit card company and cancel the charge and freeze it. Assume your identity has been stolen and take appropriate action to defend your identity.
http://www.ftc.gov/bcp/edu/microsites/idtheft/
Some other advice:
Use only low amount debit/credit cards online with amounts your willing to risk losing.
Do not enable overdraft protection with these on line type cards.
Maintain the bulk of your funds in more secure, no user electronic access accounts (keep the blame for loss entirely on the bank)
Beware that banks and credit card companies like to increase your credit/debit card limits without notice.
If you lose a considerable amount of funds through a electronic means in your control, like a ATM, credit card, debit card or on line banking, expect a very long and tiresome legal battle to hopefully regain those funds and prove fault.
(note: I receive no compensation from mentioning these sites/article or their solutions, etc)

Answer 1

WZZZ wrote:
Still don't understand you're recommendation for a clean install, if user gives password. Again, I thought it had been established that just cleaning out the malware files was adequate. That's why I'm asking what new did you learn, if anything, to lead you recommend  this drastic remedy?
None other than the website at the link stating it need the root password to install.
"For the application to be installed, the user needs to input his root password."
http://www.securelist.com/en/blog/6211/Rogueware_campaign_targeting_Mac_users
It's wrong to assume this malware or any malware is going to remain what it is. Or assume what you see is what you get.
If the code was examined of this present version of the malware and found not to cause any further damage outside of installing itself, then that's one thing, but the potential to do more damage is there in future or other versions of this exact malware is there.
Remember a goal of a lot of these malware authors is to gain control of the machine for later use.
If they know their rogue code is going to attract attention, they could be using the "MACDefender" as a cover, hope to get some fools dropping $99, let people THINK that it's a easy removal when in truth it installs or changes something much more covert, calls home, opens a port or some other action that will allow return access later.
So far this malware has changed
Best Mac Antivirus, MACDefender, MACProtector, MACSecurity, Apple Security Center...
If the user doesn't give it (or any malware) the admin password, perhaps just removing the files like before will be adequate depending upon the privilege level the malware was run in and upon close examination of it's code.
However, most users can't just can't simply assume the malware they see is the same one as before and a simple deletion is fine and dandy.
To refresh:
OS X has three "privilege levels": General, Admin and Root
Without using some sort of privilege escalation exploit, any malware running uses the privileges of the user level it's running in.
Root user is turned off by default, however a Admin level user can access the "sudo window" 5 minutes of Root User privileges by giving their Admin Password to a rogue program.
This is how Software Updates and program installs across users, hooks into the operating system etc., are performed.
So the following situations can occur depending what the user privilege level is and what the user does with the malware.
A: Very bad:  (root level access)
If the user gives the admin password to any malware, the malware has a 5 minute "root user" time window to do whatever it pleases to the computer.  Complete and total access to everything, including firmware. There is hope that if the firmware(s) wasn't attacked, the user can simply boot off the installer disk, zero their boot drive in Disk Utility and reinstall OS X.
Most likely, if a user gives malware their admin password, they are going to need professional help to ensure the firmware isn't compromised or the malware can return.
B: Can be very bad: (admin level access)
If the user is a Admin User and any malware is run, with no password entered, it can certainly do considerable amount of damage, alter programs and root the machine eventually by slow methods including privilege escalation(s). Most certainly can delete or encrypt user files.
Since OS X is setup as the first user being a Admin, and a lot of people remain that first Admin user, in this case it's perhaps best not to take any chances and backup > reinstall OS X, fresh programs from sources etc., to completely clear the machine.
If one has the capability to examine the malware code before it's run and has the opportunity to delete parts of itself, is well trained in programing and so forth. Naturally a compete wipe and reinstall is unnecessary, they know that already.
C: Is bad, but easily recovered if certain things don't happen. (general user access)
If the user is a General User and any malware is run, with no password entered, it can do damage to user files,. If they are then encrypted like what ransom ware does, then it's bad if there is no uninfected backup of the data.
Rogue code has the least amount of access in General User, thus it's easier to remove as it's confined to the General User's access folders. Once it's all found and removed, the computer's security should be restored.
Still the malware could upload all user files and unencrypted files read by others.
So, since this malware asks for the Admin password to install, it has to be assumed it had total and complete access to the machine.
If the user can't understand the code, then they really don't know if the simple removal methods were adequate enough.