Malware scan

Yesterday I was enticed to answer a phishing e-mail. Although I stopped entering information after the first step, my bank warned me that there could be a trojan or other mal_ware installed on the iMac and I should have it scanned. I googled MacKeeper and found that peopel have too many problems with it. Has anyone encountered such mal_ware? How did you clean it up? Is there a system scan_clean software for iMac that works well at a reasonable cost?

As most malware is made for Windows it is most unlikely that you have anything to worry about, but:
You may find this User Tip on Viruses, Trojan Detection and Removal, as well as general Internet Security and Privacy, useful: The User Tip seeks to offer guidance on the main security threats and how to avoid them.
https://discussions.apple.com/docs/DOC-2435
More useful information can also be found here:
www.thesafemac.com/mmg

Similar Messages

Have been advised by my email provider (recently blocked account requiring password reset) that they will only reset the password after a proven anti viru and malware scan has been done on ipad and iphone. Is this necessary and if so what do i use

Have been advised by my email provider (recently blocked account requiring password reset) that they will only reset the password after a proven anti virus and malware scan has been done on ipad and iphone. Is this necessary and if so what do i use

As KP has pointed out, there actually aren't any anti-virus programs in the App Store. There are a few that allow you to scan e-mail or stuff like that, and a few that provide you with information about malware and new threats for other systems. But none are available that can scan your iOS device for malware, because the security restrictions in iOS do not permit any apps to have that kind of access to anything. Which means that you also cannot be infected with a virus (unless you have jailbroken your device).
If your account got compromised, that had nothing whatsoever to do with your iPad. Someone simply hacked it remotely. Happens all the time. It's really amazing that, in this day and age, e-mail providers are so ignorant of technology and how their own systems get compromised that they would try to require you to run software that does not exist!

Do I need to run a malware scan after removing uTorrent?

I know this is a dumb question, but I don't know of any malware scan sites for Mac that I trust. I'm using Mavericks and my OS is up-to-date. Do I need to run a malware scan after uninstalling uTorrent? If so, where would I get one I can trust?
Here is my scenario - On a recommendation (which I no longer trust) I installed uTorrent, as I wanted to download a file that was only available in torrent form. (This file is a legally available file, so I would not be violating copyright.)
What made me worry was the when I downloaded uTorrent, it installed without asking me to enter my admin password. This raised a red flag for me. So I immediately uninstalled uTorrent, by moving the Application to trash.
So, now that I have it uninstalled, is there a danger it may have left unwanted files on my Mac?
I don't see any evidence of unwanted files. Just wondering. Am I worrying for nothing?

darrenfromoakland wrote:
I don't know of any malware scan sites for Mac that I trust.
There aren't any. It is not possible to scan one's computer from a web-site, they are all scams. All or most of the Windows sites are, as well.
when I downloaded uTorrent, it installed without asking me to enter my admin password. This raised a red flag for me. So I immediately uninstalled uTorrent, by moving the Application to trash.
So, now that I have it uninstalled, is there a danger it may have left unwanted files on my Mac?
Many applications can be installed without the need for an admin password since they don't need to install files in any common or system locations. As long as everything goes into the Applications folder and your user folder, you should never need admin permissions.
uTorrent itself is a perfectly legit application that can be used for illegal activities, like all BitTorrent apps. I'm sure it comes with an Apple developer ID signature and under normal circumstances should not be able to harm your OS X or it's applications. But to some extent it depends on where you obtained the app itself. Any app you obtain from AppStore, a legit developer site or MacUpdate should be just fine. If you got it from C|Net's download.com or Softonic then it may have come with an installer that will also install annoying adware. It would have notified you that it was being installed (and again, no admin password is required), but a large majority of users never read those dialogs and blindly click through them to get their app installed and in use as soon as possible. If you think the latter is a possibility, then the Adware Removal Guide that Carolyn tipped you to has a Adware Removal Tool that should make quick work of anything like that.

What malware scanning software should I use

What malware scanning software should I use? Any suggestions for good free software? Also is there a good free antivirus software too?
I use malwarebytes & FEP for Windows 7 pc but need to know what to install of this mac.
Thank you

None is really needed at present.
Helpful Links Regarding Malware Protection
An excellent link to read is Tom Reed's Mac Malware Guide.
Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.
See these Apple articles:
          Mac OS X Snow Leopard and malware detection
          OS X Lion- Protect your Mac from malware
          OS X Mountain Lion- Protect your Mac from malware
          About file quarantine in OS X
If you require anti-virus protection I recommend using ClamXav.

How to exclude a file/folder from Windows Defender malware scan in Windows 8/8.1?

How to exclude a file/folder from Windows Defender malware scan in Windows 8/8.1?
http://answers.microsoft.com/en-us/protect/wiki/protect_defender-protect_scanning/how-to-exclude-a-filefolder-from-windows-defender/f32ee18f-a012-4f02-8611-0737570e8eee

Hi,
Thank you for sharing the solutions & experience here. It will be very beneficial for other community members who have similar questions.
Regards,
Kelvin hsu
TechNet Community Support

Just ran a Malware scan and a list of suggested fixes, before I let it autofix is there a way I can send the list to be sure these are safe to correct?

I installed the updated Malwarebytes Anti Malware and ran a full scan. I got a few items I understand some in the registry keys but it also gave me a long list of possible problems all related to Firefox/Mozilla. I had hoped there was a way to send the list to Mozilla to see if these are real problems.

Here is the first part of the list, it was to long to post the entire list that was generated:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 3/31/2014
Scan Time: 9:32:49 PM
Logfile: anti malware.txt
Administrator: Yes
Version: 2.00.0.1000
Malware Database: v2014.03.31.09
Rootkit Database: v2014.03.27.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: JT
Scan Type: Threat Scan
Result: Completed
Registry Keys: 2
PUP.Optional.PCSpeedUp.A, HKLM\SOFTWARE\SPEEDCHECKER LIMITED\PC Speed Up, , [fed775942e4d5dd975f8dea62cd7b34d],
PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, , [05d00306d5a6a294a67dc7bf18eb25db],
Registry Values: 4
PUP.Optional.HomePageProtector.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [52834ebbd6a5a393e0315aae06fc08f8],
PUP.Optional.HomePageProtector.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, , [52834ebbd6a5a393e0315aae06fc08f8]
PUP.Optional.Incredibar, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\IB Updater\Firefox, , [fbda11f8daa1df5717880288ca3955ab]
PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, , [05d00306d5a6a294a67dc7bf18eb25db],
Registry Data: 0
(No malicious items detected)
Folders: 2
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\toolbarImages, , [7f56db2eaccf10260fb1c096ca386b95],
Files: 108
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.1000082.currentList, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.1000082.localStations, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.1000082.nowPlaying, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.1000082.publisherStations, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.130068661007799818.search.selectedEngineId, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.130068661007799818.search.settings, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.appOptions, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.cookiesRepo, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.NotificationSettings, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.NOTIFICATION_ID.notifications-repository, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847.NOTIFICATION_ID.notifications-servicemap, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_10.14.350.31.serviceLayer_services_toolbarSettings, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_10.14.350.31.serviceLayer_services_translation, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_appsMetadata, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_appTrackingFirstTime, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_gottenAppsContextMenu, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_location, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_login, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_otherAppsContextMenu, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_searchAPI, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_serviceMap, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_setupAPI, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_toolbarContextMenu, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_toolbarSettings, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\CT3289847_RAW.serviceLayer_services_translation, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\serviceLayer_userApps_added, , [7f56db2eaccf10260fb1c096ca386b95],
PUP.Optional.Conduit.A, C:\Users\JT\AppData\Roaming\Mozilla\Firefox\Profiles\nmenilbu.default-1351988925677\CT3289847\toolbar_initializing_logger.txt, , [7f56db2eaccf10260fb1c096ca386b95],

IIS malware scan on survey server

I received an email from a survey respondent that said they got a warning when trying to complete a survey on our IIS website. I’ve used a few free online tools to scan the URL but all came back clean. I’ve also running a full virus scan on the server
which also came back clean. As I haven’t be able to find any evidence it makes me think the issue is at the respondents end, but I’d rather be safe than sorry.
I've tried running the following analysis but the SEO Toolkit didn't appear to scan all the website files:
http://blogs.msdn.com/b/carlosag/archive/2009/06/24/finding-malware-using-iis-seo-toolkit.aspx
Is there a better way of checking IIS websites for malicious code?

Hi,
Since the issue is related to iis issue, i suggest you may ask in iis forums.
And i will change the type to discussion.
Thanks for your understanding.
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

SSD Cash Memory and Malware Scans

Do conventional virus and malware scanners automatically scan an mSATA SSD device that is configured as a cache with the Lenovo-supplied ExpressCache software? (Maybe this is not the best forum section for this question?)
I have a relatively new W530 that was ordered with Windows 7 SP1 and a 16 GB solid-state cache drive that is enabled by a verified-working copy of ExpressCache (basic, not upgraded). As you know, the SSD should not be formatted and does not show up as a recognized drive when running under ExpressCache. Does anybody know whether malware scanners (e.g., MSE, MalwareBytes) effectively scan this memory (prehaps as part of system memory), or if it's a place that malware can hide indefinitely?
One reason I'm concerned: The last day or two my hard drive is working almost continuously (as indicated by the activity light on the front panel), enen though little or no CPU usage is showing up for any process listed under Task Manager/Processes. I've completed full scans with MSE and MalwareBytes (free), but they don't find anything... -- JCW2
Solved!
Go to Solution.

AFAIK, a good caching software should invalidate the cached file if the hash differs from the on-drive file hash.
W520: i7-2720QM, Q2000M at 1080/688/1376, 21GB RAM, 500GB + 750GB HDD, FHD screen
X61T: L7500, 3GB RAM, 500GB HDD, XGA screen, Ultrabase
Y3P: 5Y70, 8GB RAM, 256GB SSD, QHD+ screen

How do you run a virus/ malware scan on Gen3 Time Capsule

My late 2010 MacBook Pro was completely wiped out the other day, and a friend of mine who is a techie determined that something completely everything. I mean everything! No boot function...nothing!
I was hoping it was just a HDD failure, since I've had it replaced once before. I noticed before the crash, when I ran "repair disc," then "verify disc" that all these error messages came up. I called Apple Care, and he made me an Apple Genius appointment that day at my nearest store. Long story short, he could not do anything more, since once he removed the casing, he noticed what could have been a liquid spill, which of course, voids Apple Care. Thank God my friend is a tech wizard.
He took it home with him, completely took it apart, rane various hardware diagnostics on it, there was no liquid spill, the HDD does work, the logice board isn't damamged, it was just wiped out.
My Mac was acting funny the last few days, and the fan kept running constantly, so as a precaution I backed everything up to the Time Capsule and another portable hard drive. So the problem is, if I downloaded something and it's now just waiting in one, if not both, of those backups, how can I make sure it doesn't get transfered over once I restore all my files?
Thanks.
Mike

It's most likely not due to any malware infection.
http://www.thesafemac.com/mmg-infected/#spam
If you still want to do a scan, then a good bet is to get the free Sophos. But be warned, no A-V will find everything (definitions for any particular infection first have to be in the A-V catalog), and it may turn up false positives.

Stopping anti-virus and anti-malware scans from scanning diasabled user files?

Using Windows Server 2008
If I only disable old user profiles, does anti-virus and anti-malware still scan their profiles and all files contained there within? Is this something that will happen regardless of the old users status and during a "whole computer" scan?
And if so, are computer resources still being used for these old profiles?
Thanks!

Hi LaEmperor,
From my experience with different AV softwares, I can say that they continue scanning them as part of the filesystem, despite of being disabled.
I am not sure about your question for the resources, but I´ll give two shots:
1. From the system perspective: basically affects the space that the files from that profile are using. The leave also some information on the Registry hive, on .USERS\ but unless it is a large numbre, I will not be concerned.
2. From the Antivirus perpective: Well, as usual, Disk I/O, RAM, CPU, etc...; so as much as disabled profiles, as much they will add to the usual amount of resource comsumption.
Hope you find this informative.

Malware scan a partition from mac

2012 WIndows anti-virus infected my windows partition. Is there any way to run anti-malware programs from my mac onto the partition that will clean it of invasion. Or is there any way to enable a parallel run off my mac to scan my windows partition.

You could try ClamXav. Run it on the Mac and scan the Windows partition. And cross your fingers.
That said, there's no guarantee ClamXav (or any other AV program) will be able to fix anything it finds, so be prepared to wipe the Windows partition if you really get in a bind. (IOW, while booted to OSX, copy your documents out of the Windows partition.) Many times the only way to clean, or the most cost effective way, is to just erase Windows and reload. Consider if you spend several days trying clean, and may still have an unstable Windows if the malware corrupts some critial Windows files, versus "just" a few hours with a clean reload and confidence that Windows is malware free.

Firefox doesn't load my banking website but other browsers do even after virus and malware scan and cookies & cache cleared

I have cleared cookies and cache, scanned with Panda and still can't load my banking website. I can load the website with any other browser I've tried with no problems.
This is with Firefox in safe mode and in regular mode.

It sounds as though you have worked through this article: [[Firefox can't load websites but other browsers can]].
Do you notice any difference between secure sites and non-secure sites in what error message you get?
Do you use any kind of content filtering or parental control software?

Malware Scan? Something tried to access my MacBook...

Hi all,
I'm having trouble finding any information about what to do.
This morning, my Macbook Pro was sitting on my desk, and I was doing something else. Then, I noticed that the Spotlight Search Box in the top right had opened, and, as I watched, the letter "v" appeared in the search box, as if someone was looking for something. I wasn't touching the laptop at the time.
My immediate thought was someone was hacking my machine. Unfortunately I panicked and moved the mouse - the activity stopped. I should have waited, I guess. I'm thinking maybe someone was remotely accessing my computer and looking up the Sharing prefs...
Question is: what do I do? How can I check if I've been infected with a Trojan? Is there any good Malware Detection software? I've run ClamXav, and it's found 146 Phishing / SpoofedDomain emlx files in my mailbox, but I'm guessing that's not it.
Can anyone help? I'm trying to find advice, but I'm reading very contradictory stuff online.
Thanks!
Sarah

Are you saying there's no possibility of accidentally being infected by a Trojan online which can do this kind of stuff?
I can't say it's impossible, but I think it unlikely. None of the verified trojans install remote-control software of their own. And you would have to have downloaded that trojan yourself, so if you are certain you've not installed anything from an untrustworthy site, you probably could not have been infected by a trojan.
Given that your system otherwise seems uncompromised and there has been no recurrence of the problem, I'd guess that it was just an anomaly of some keystrokes having been buffered erroneously. There doesn't appear to be any strong evidence that your system has been compromised. The only way to be absolutely certain that your system is clean, though, would be to rebulid your system. Antivirus utiltiies can only detect malware they know about and would not detect some legitimate remote-control software that someone had managed to sneak onto your system.
Regards.

I need to turn off Firefox when running malware scan-how is it done??

checked all your help-no answer
help!

If you still get that error after you have closed Firefox then see:
* http://kb.mozillazine.org/Kill_application

I just had an update of Firefox, and next thing I knew, I had a message from "Mozilla Security" telling me it had found "critical process activity on my system and will perform fast scan of system files.

This is the message in the dialog box that showed up:
Firefox security alert
Scanning of your system is currently on, please wait until the end. Your system affected by numerous virus attacks, Mozilla Firefox recommends you to install proper software to protect your computer
Quick scan system:
Scan complete
Number of scanned objects: 3676
Number of infected objects: 97
It then directs me to Click "Start Protection" button to erase all threats. If I do that, an install program window pops up with: installInternetDefender_143.exe
from http://monozsa.ce.ms
I don't automatically click on those unless I know they are legitimate. I'm just concerned that the security issue came about after I received an update to my Firefox.
I already have a security program installed on my computer through my internet provider--why would it not have picked up these infected objects? Is this legitimate? It

The scanning is most likely an animation and not a real scan.<br />
As long as you didn't download and install that program then you should be safe.
To be sure you can do a malware check with some malware scanning programs.<br />
You need to scan with all programs because each program detects different malware.<br />
Make sure that you update each program to get the latest version of their databases before doing a scan.<br />
* http://www.malwarebytes.org/mbam.php - Malwarebytes' Anti-Malware
* http://www.superantispyware.com/ - SuperAntispyware
* http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Windows Defender: Home Page
* http://www.safer-networking.org/en/index.html - Spybot Search & Destroy
* http://www.lavasoft.com/products/ad_aware_free.php - Ad-Aware Free
See also:
* "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

Malware scan

Similar Messages

Maybe you are looking for