Recent Trojan Horse Stories
I've been a Mac User for more than 5 years and I've never bought an Antivirus, however I've been seeing articles of Mac's getting something called a Trojan Horse now I'm kind of nervous that I will get it. Can anyone recomend a antivirus?
jnjaquez wrote:
I've been seeing articles of Mac's getting something called a Trojan Horse now I'm kind of nervous that I will get it. Can anyone recomend a antivirus?
(1) Debates about the distinction (if any) between Trojan Horses and viruses are, IMHO, best left to the specialists, who have the time to engage in them and the training to understand the arguments. For us, as average users, they don't matter that much. After all, if my bank account password was stolen, I couldn't care less if it was stolen by a virus, a Trojan Horse, or the frumious bandersnatch.
(2) The latest versions of Flashback installed themselves without any user interaction. They were not "invited" in any way; the user did not have to "download and execute something". Whether this means that Flashback is "no longer entirely a trojan", as Thomas A Reed puts in the page linked by shldr2thewheel, or that it's a backdoor (or whatever), leave the fun of arguing over it to others. We can just call it malware and be done with it.
(3) There are two problems with A/V software.
(a) Macs are a very small market compared to Win; moreover, (for whatever reason) Macs have been much less affected by malware. Consequently, it doesn't make business sense for any commercial A/V developer to put his A Team on developing Mac A/V software. And the products on offer show the signs of being developed by the B Team—by and large, they are intrusive, not very well programmed, and not very well tested.
(b) A/V software is only as good as the latest upate, and protects only against known threats. In the past five or six weeks, Flashback evolved constantly and fairly rapidly, while A/V updates in general didn't match the pace.
So, for A/V software, I'd go with BGreg's suggestion of ClamXav (which is not commercial, but a free Mac port of an open-source A/V engine). However, don't assume that, once it is installed, you are fully protected.
(4) A common thread in the last weeks of the Flashback soap opera has been the reverse firewall. Mac OS X has a built-in firewall (one that controls in-coming connections); but it doesn't have a reverse firewall (which controls outgoing connections). Some versions of Flashback self-immolated when they detected Little Snitch, a popular reverse firewall (Hands Off! is another); others were caught and blocked by Little Snitch. I'd say, this day and age, a reverse firewall is essential.
In short, what should you do?
Use your common sense (best and most useful tool).
Keep yourself informed. (The danger posed by Java vulnerabilities was fairly well known.)
Get a reverse firewall (Little Snitch or Hands Off!).
Install ClamXav.
Adopt good working habits, including using a standard (rather than admin) account for most of your work.
Back up, back up, and back up some more (eg, Time Machine). And always have an emergency boot device at hand.
Similar Messages
-
After installing a recent java software update(trojan horse) have not been able to open several bookmarked pages.
Was this the Security Update that disabled Java in the Browsers?
If so & you need Java, just reverse these unchecks to checks...
http://support.apple.com/kb/HT5241?viewlocale=en_US
http://support.google.com/chrome/bin/answer.py?hl=en-GB&answer=142064
http://support.mozilla.org/en-US/kb/How%20to%20turn%20off%20Java%20applets -
Hey guys, Im expierencing problems with itunes after the latest update yesterday(1/22) and the problem im having is when i plugged my iphone into my PC today a virus detection came up and said a trojan horse was present. I also cant open itunes at all. Im confused and dont know what to do. thanks in advance
Place the device in DFU mode (google it) and restore.
-
I have Norton AntiVirus for Mac which runs a full scan once a month. My recent scan shows 4 trojan horses all with the same name in the Java/Cache/6.0/33 file. Norton is unable to remove, quarantine or fix these. I've Googled the virus and no results show up so I don't know if this is a true Tojan Horse or a problem with Norton detection. I have Apple Care so can take the laptop in to the Apple store but not sure if it's necessary yet. The laptop does connect to a wireless drive at my office that is Windows based. Any ideas are welcome - Thanks.
OMGosh... I think I may know this one. (I generally don't speak mac or pc). I'm a first time mac user for now three weeks. last weekend, after surfing all day, my PB had some scary box open with "DANGER" blah blah... than lots of horse blah blah..."INFECTED"
I freaked out and asked my husband and he told me to get off line! and started out to the store with "I told you so" to get some virus soft w.
Than I remembered that I read something about how Apple is safest and doesn't get virus or something. so I searched for a bit but couldn't get a quick answer on line. so, I grabbed my PB and ran to the nearest Apple store.
After quick look, apple guys said that it was all a bloody marketing scam to scare people to buy their soft w. He was right, as soon as we rebooted, all was fine. He explained something about why apple isn't open to these sickness like PC...blah, blah... I didn't understand and I was looking at all the pretty apples that I had already planned on switching my entire house with... LOL. My husband would have an attack of some sort.
So, I hope this is the same case for you. My husband still don't believe or understand why apple isn't open to same thing as PC. To his defense, I have seen soft w. for virus for mac. so..... can someone answer if I need to purchase virus SW like my husband PC?
AND please to all the SMART apple guys out there, simple yes or no in English would be so appreciate it. Not that I hear "blah blah" when u speak apple, but I just want to understand what II need to know. THANK U APPLE GUYS!! UR AWSOME. -
A little while ago, my macbook was very slow and I went into the Apple store and they recommended that I turn Norton Antivirus off. I did.
A few months later (now) I ran it just for the heck of it to see if it found anything - and it did. Two or three Trojan Horse malware files. Looking at Nortons descriptions, I think that they were (I located and deleted them) all PC based virus BUT, I am wondering:
1. I have Microsoft Office for Mac on my Macbook and I am wondering if those files might have been compromised by a PC virus?
2. I am assuming that if these files have been compromised there is nothing that I can do about retrieving that information as it could be anywhere.
3. If I have other PC based drives hooked up to my macbook wirelessly - were they vulnerable while I had these Trojan Horses on my Macbook?
Thanks.
A.Don't always believe what Norton tells you. It is incompatible with OS X.
Norton Antivirus has a very long and illustrious reputation for mangling Mac OS X systems, sometimes to the point where a complete reinstall is necessary. Among other things, it installs kernel extensions which are known to cause kernel panics and system freezes; it contains known and documented bugs which can silently corrupt Adobe Photoshop and Adobe InDesign files, destroy a user's ability to authenticate as an administrator, and (on PPC systems) can cause Classic to stop functioning; and Symantec has on at least two occasions now released flawed .dat file updates which erroneously report certain critical Mac OS X files as "viruses." (Deleting these "viruses" causes damage to the system that in some cases renders it unbootable.)
1. No
2. Need more details about what you call 'compromised'
3. Yes.
No viruses that can attack OS X have so far been detected 'in the wild', i.e. in anything other than laboratory conditions.
It is possible, however, to pass on a Windows virus to another Windows user, for example through an email attachment. To prevent this all you need is the free anti-virus utility ClamXav, which you can download for Tiger and Leopard from (on no account install Norton Anti-Virus on a Mac running OS X):
http://www.clamxav.com/
The new version for Snow Leopard is available here:
http://www.clamxav.com/index.php?page=v2beta
(Note: ClamAV adds a new user group to your Mac. That makes it a little more difficult to remove than some apps. You’ll find an uninstaller link in ClamXav’s FAQ page online.)
If you are already using ClamXav: please ensure that you have installed Apple Security Update 2010-005 and that your version of ClamXav is the latest available.
However, the appearance of Trojans and other malware that can possibly infect a Mac seems to be growing, but is a completely different issue to viruses.
If you allow a Trojan to be installed, the user's DNS records can be modified, redirecting incoming internet traffic through the attacker's servers, where it can be hijacked and injected with malicious websites and pornographic advertisements. The trojan also installs a watchdog process that ensures the victim's (that's you!) DNS records stay modified on a minute-by-minute basis.
You can read more about how, for example, the OSX/DNSChanger Trojan works here:
http://www.f-secure.com/v-descs/trojanosxdnschanger.shtml
SecureMac has introduced a free Trojan Detection Tool for Mac OS X. It's available here:
http://macscan.securemac.com/
The DNSChanger Removal Tool detects and removes spyware targeting Mac OS X and allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users' DNS records will be repaired.
(Note that a 30 day trial version of MacScan can be downloaded free of charge from:
http://macscan.securemac.com/buy/
and this can perform a complete scan of your entire hard disk. After 30 days free trial the cost is $29.99. The full version permits you to scan selected files and folders only, as well as the entire hard disk. It will detect (and delete if you ask it to) all 'tracker cookies' that switch you to web sites you did not want to go to.)
A white paper has recently been published on the subject of Trojans by SubRosaSoft, available here:
http://www.macforensicslab.com/ProductsAndServices/index.php?mainpage=document_general_info&cPath=11&productsid=174
Also, beware of MacSweeper:
MacSweeper is malware that misleads users by exaggerating reports about spyware, adware or viruses on their computer. It is the first known "rogue" application for the Mac OS X operating system. The software was discovered by F-Secure, a Finland based computer security software company on January 17, 2008
http://en.wikipedia.org/wiki/MacSweeper
On June 23, 2008 this news reached Mac users:
http://www.theregister.co.uk/2008/06/23/mac_trojan/
More on Trojans on the Mac here:
http://www.technewsworld.com/story/63574.html?welcome=1214487119
This was published on July 25, 2008:
Attack code that exploits flaws in the net's addressing system are starting to circulate online, say security experts.
The code could be a boon to phishing gangs who redirect web users to fake bank sites and steal login details.
In light of the news net firms are being urged to apply a fix for the loop-hole before attacks by hi-tech criminals become widespread.
Net security groups say there is anecdotal evidence that small scale attacks are already happening.
Further details here: http://news.bbc.co.uk/2/hi/technology/7525206.stm
A further development was the Koobface malware that can be picked up from Facebook (already a notorious site for malware, like many other 'social networking' sites like Twitter etc), as reported here on December 9, 2008:
http://news.bbc.co.uk/newsbeat/hi/technology/newsid_7773000/7773340.stm
You can keep up to date, particularly about malware present in some downloadable pirated software, at the Securemac site:
http://www.securemac.com/
There may be other ways of guarding against Trojans, viruses and general malware affecting the Mac, and alternatives will probably appear in the future. In the meantime the advice is: be careful where you go on the web and what you download!
If you think you may have acquired a Trojan, and you know its name, you can also locate it via the Terminal:
http://theappleblog.com/2009/04/24/mac-botnet-how-to-ensure-you-are-not-part-of- the-problem/
As to the recent 'Conficker furore' affecting Intel-powered computers, MacWorld recently had this to say:
http://www.macworld.co.uk/news/index.cfm?email&NewsID=25613
Although any content that you download has the possibility of containing malicious software, practising a bit of care will generally keep you free from the consequences of anything like the DNSChanger trojan.
1. Avoid going to suspect and untrusted Web sites, especially p'orn'ography sites.
2. Check out what you are downloading. Mac OS X asks you for you administrator password to install applications for a reason! Only download media and applications from well-known and trusted Web sites. If you think you may have downloaded suspicious files, read the installer packages and make sure they are legit. If you cannot determine if the program you downloaded is infected, do a quick Internet search and see if any other users reported issues after installing a particular program. A recent example is of malware distributed through innocent looking free screensavers: http://www.zdnet.com/blog/security/malware-watch-free-mac-os-x-screensavers-bund led-with-spyware/6560?tag=nl.e589
3. Use an antivirus program like ClamXav. If you are in the habit of downloading a lot of media and other files, it may be well worth your while to run those files through an AV application.
4. Use Mac OS X's built-in Firewalls and other security features.
5. Stop using LimeWire. LimeWire (and other peer-to-peer sharing applications and download torrents) are hotbeds of potential software issues waiting to happen to your Mac. Everything from changing permissions to downloading trojans and other malicious software can be acquired from using these applications. Similar risks apply to using Facebook, Twitter, MySpace, YouTube and similar sites which are prone to malicious hacking: http://news.bbc.co.uk/1/hi/technology/8420233.stm
6. Resist the temptation to download pirated software. After the release of iWork '09 earlier this year, a Trojan was discovered circulating in pirated copies of Apple's productivity suite of applications (as well as pirated copies of Adobe's Photoshop CS4). Security professionals now believe that the botnet (from iServices) has become active. Although the potential damage range is projected to be minimal, an estimated 20,000 copies of the Trojan have been downloaded. SecureMac offer a simple and free tool for the removal of the iBotNet Trojan available here:
http://macscan.securemac.com/files/iServicesTrojanRemovalTool.dmg
Also, there is the potential for having your entire email contact list stolen for use for spamming:
http://www.nytimes.com/2009/06/20/technology/internet/20shortcuts.html?_r=1
NOTE: Snow Leopard, OS 10.6.x, offers additional security to that of previous versions of OS X, but not to the extent that you should ignore the foregoing:
http://www.apple.com/macosx/security/
Apple's 10.6.4 operating system upgrade silently updated the malware protection built into Mac OS X to protect against a backdoor Trojan horse that can allow hackers to gain remote control over your treasured iMac or MacBook.
http://www.sophos.com/blogs/gc/g/2010/06/18/apple-secretly-updates
Finally, do not install Norton Anti-Virus on a Mac as it can seriously damage your operating system. Norton Anti-Virus is not compatible with Apple OS X.
And if you are using iPhone Apps you are also at risk of losing all privacy:
http://www.engadget.com/2010/10/03/hacker-claims-third-party-iphone-apps-can-tra nsmit-udid-pose-se/ -
I think I have some Malware/Trojan Horse on MacBook Pro. How to get rid of it?
My MacBook Pro has worked perfect for the last 2 years, but over the last 2 days when I am on Chrome it has started clicking onto random websites when I click other links, and showing certain words as underlined and as hotlinks. I think I recognise that from having a PC as Malware or Trojan Horse? What is the best way to remove this as I have read through a few threads on here and they advise not downloading any anti virus software as it slows down your Mac instead of helping.
<Post Edited By Host>You installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
Last night, I made the mistake of downloading an app called "Wine" and "Winebottler". These are apps that allow Windows programs to be played on Macintosh without installing Windows. I ended up with 13 new OSX Trojan Horses on my Macintosh. These apps kept on installing add ons to the iTunes Store. I knew I was in trouble immediately, I guess, by instinct.I had also installed Wineskin for the same purpose, but I don't think that was the problem as I found no Trojan Horses associated with this app. I had my security set to download from App Store and Trusted Developers only. I am now going to upgrade my security to download from App Store only now, but I don't know for sure if that will help.
Luckily, I had Kaspersky on my Mac, and it kept on finding Trojan Horses on a full scan. I had firevault on and iCloud on. I am wondering now if my iCloud account is infected. I am currently erasing my whole hard drive and reinstalling. I will not turn on iCloud until I get some advice. For those that are unaware, I know we are in a cyberwar. I don't know where these apps originated, but I wanted the community to know this. I've used Macintosh since the first day it was available in 1984. I've never had troubles with viruses and Trojan Horses like this, except for two that were found by Kaspersky a couple of months ago and were easily found, isolated and disinfected. Not these. Most were easily disinfected: all but two. I had to restart the computer and Kaspersky got rid of them. Kaspersky is a great program, but I wasn't sure if it got rid of everything, which led me to erase and reinstall.
Please inform my about how secure iCloud is against attached viruses or should I delete my account.etresoft wrote:
straycat23 wrote:
I downloaded from WineHQ.org.
I doubt that because WineHQ doesn't have any Mac versions of Wine available. They distribute Linux binaries and source. If you downloaded a Mac version, it must have come from somewhere else.
As soon as I downloaded it and the Winebottler, I knew I had problems.
Why?
I took your earlier advice: left OS10.9.1 in place and turned iCloud back on. I hope I made the right decision. I did not delete Kaspersky because OSX did not delete the Trojan or prevent it from being downloaded. Kaspersky did.
But you are in a catch-22 situation here. These forums are full of people reporting problems with computers and antivirus is a very common cause. By comparison, there are far fewer people reporting problems with trojans. Are these programs really trojans? And even if they are, would they cause as much trouble and be as difficult to remove as antivirus? I doubt it
As far as I can tell WineHQ must be a trusted developer, because that is how my computer is set as I previously stated.
I would definitely consider WineHQ to be trustworthy (more so than antivirus vendors) but they definitely do not have an Apple Developer ID that would enable them to distribute software past Gatekeeper. Someone malicious may have repackaged Wine, added trojans, and signed it with a Developer ID. The only way to address that problem is to identify where you got the software so that the illicit Developer ID can be revoked.
I did not download these programs to play games. That's for Millenials. I downloaded these because Windows is a disaster, and I didn't want to load Windows on my computer. There are Windows programs that there is no equivalent in Mac.
It doesn't matter why you downloaded them. If they are Windows programs, you are going to have to run Windows. Wine is a cool project, but very little software actually works on it.
I also deleted Adobe Flash Player as was advised in another thread. Now I can't see instructions in YouTube. Does the App Store have a recommended flash player to see You Tube?
Download Adobe Flash directly from Adobe and installer. Then download the Click2Flash Safari extension: http://hoyois.github.io/safariextensions/clicktoplugin/ so you can avoid Flash, if possible. If you ever get any Flash popup asking for an update, always close it - always. Then go to the Adobe Flash site yourself and see if there is an update and download it.
I downloaded the program from WineHQ. It's in my history. I went back and looked today. I don't think Linux has an iTunes version. I downloaded a program I didn't request that attached itself to iTunes. This is how I knew I had problems.
I appreciate all the advice: dismissive or not. It did give me confidence there's nothing wrong with my computer. I just don't have faith in Mac like I used to. I'm guessing that the trojans were not real, but I'm glad I had a device to delete the false positives, if for no other reason than it made me feel better. Any website can be attacked by hackers. Maybe that's what happened to WineHQ. -
Email phishing, malware, trojan horses, key stroke
I have a iMac with the new Yosemite 10.10.1 SW installed. I received an email and clicked on a web link that was characterised as Phishing and I enterred private information. I have since truned off all online contacts that may be compromised. What is the likelyhood that when I went to this scam website and enterred information that Malware, Trojan Horse, Key stroke counting type SW was installed? Would the new Yosemite OS prevented this from happening?
Those sites are mostly designed for Windows PCs, so OS X should not be affected. Furthermore, OS X Yosemite uses Gatekeeper, which only allows to install apps from the Mac App Store and identified developers by default.
If you want to be sure there is nothing bad in your Mac, you can use ClamXav and scan the hard disk. -
Trojan Horse Generic 11.PWW in my AIR download!
Last week I downloaded and installed the latest version of
Adobe (vers. 9) from the Adobe.com site. However, it wouldn't run
and gave me a message that ran along the lines "Your software has
been successfully installed. However, it might run slower than
normal because your disc needs defragmenting," plus some advice to
defrag the disc then run the program again. Well my disc was fine
as I'd run a defrag a day earlier. All the same I defragged it
again then re-tried the new Adobe program. Same message. So I
uninstalled the whole thing and did a new d/load and install. Same
problem still. Finally I gave up on it and uninstalled it. What's
the point of having it if I can't use it?
Well today I ran my anti-virus program (AVG 8) and it found
this:
Infection Trojan horse Generic11.PWW
And the path:
C:\Documents and Settings\Owner\Local Settings\Application
Data\Adobe\Reader 9.0\Setup Files\AIR\Adobe AIR Installer.exe
This Trojan is now locked away in the AVG virus vault. What
beats me is how this is still hanging around on my comp after I'd
uninstalled, run CCleaner etc. I'm not a geek though so if anyone
can advise then I'd be glad for it.
Also, having browsed some recent AIR topics and seeing the
problems people have been having, I'd like to know if anyone else
has picked up a trojan in AIR in their virus scans. I'd appreciate
any feedback, because until I can be sure this problem is fixed I'm
not d/loading any new versions of the main Adobe s/ware.
Many thanks,
MikeHi Luis,
I downloaded the Adobe Reader v.9 s/ware again to see if
things were now different, but the problems persist. Because it
might be helpful to you I took screen shots of the following, which
in respect of issues tell the story well enough:
the download confirmation (while on the Adobe.com download
page),
the Run query box prior to running it that confirms it's
ready to be run,
the Setup Successful box with its confirm of a successful
install but an advisory that the program might not launch as
quickly as possible as my disk needs defragmenting,
the defragment disk report which shows my disk doesn't need
defragmenting,
the download page of an official govt. site where I wished to
download some .pdf format application forms,
the Mozilla Crash Report that I got as soon as I clicked on
the download link in the above page, and
the "Adobe Reader 9.0 has encountered a problem and needs to
close" box that I got when I tried to read one of the same .pdf
files (downloaded via another comp that doesn't have Adobe 9.0).
Please note that same .pdf file reads fine on my PC which runs
Adobe v 7.
Summary: the newly installed Adobe v. 9.0 wrongly says that
my disk needs defragmenting; it crashes my Mozilla v.3 browser as
soon as I try to download a .pdf file from a safe (Capital City
Govt. Dept) website; it cannot read .pdf documents but has to close
- even though those documents clearly show with the usual "Adobe"
icon, showing that Adobe reader is installed on the laptop.
I have uploaded all of those screen shots to a photobucket
site and am sending you a private message with the link. I hope
this will help. Meanwhile, because I never had a Mozilla crash
prior to installing Adobe v 9.0, I am uninstalling this software
again to avoid any more possible crashes. I have also used the
Mozilla Crash Report facility to advise them that I had installed
Adobe 9.0 only minutes prior to the crash and would uninstall the
new s/ware and see if that fixes the problem. (Because the fact is
that there may be another issue involved.)
Meanwhile if there is any way to download an older version of
Adobe reader I'd like to have it. My Adobe 8 was excellent.
Many thanks for taking the time to review this for us. (As
I'm surely not the only one.) I understand that as it's freeware,
Adobe has no liability or onus to do anything so your helpful
approach is brilliant.
EDIT to add: On second thoughts I'll leave the new Adobe 9.0
installed. Makes more sense as there's no way to try any fixes if I
uninstall it :) -
Trojan horse virus..can't remove
Greetings,
recently I downloaded a video reader from a website.....but since I've done this it's taken over all the google, yahoo, and ask paid links and instead launched a website that directs me away from the paid links.
I've tried a few virus removers but they don't seem to remove the virus. Tried to clear all my cookies and cache..but it still comes back..need Help!
Any ideas??
best regardsYou downloaded a file claiming it was a video codec from a **** site, which is why you now have a Trojan Horse. To remove it, download and run this program: DNSChanger Removal Tool, then reboot your Mac and the problem should be gone.
To avoid this problem in the future, don't visit **** sites, and definitely don't download things that are not from trusted sources, or at least legitimate sources. All legitimate video codecs come from real companies with real names and information about their codec.
Mulder -
I read about a Trojan Horse on the Mac and the MacScan came up and offers a way to prevent it. MacScan appears to be free. Is it valid? I the Trojan Horse a real problem?
Just to supplement BDAqua's good advice:
From MacWorld, January 10, 2008:
SecureMac has introduced a free Trojan Detection Tool for Mac OS X. It's available here:
http://www.securemac.com/
The DNSChanger Removal Tool detects and removes spyware targeting Mac OS X. Called DNSChanger Trojan and also known as OSX.RSPlug.A Trojan Horse the software attacks users attempting to play a fake video file.
Upon attempting to play the video, the victim receives the following message:
“Quicktime Player is unable to play movie file. Please click here to download new version of codec.”
Upon running the installer, the user's DNS records are modified, redirecting incoming internet traffic through the attacker's servers, where it can be hijacked and injected with malicious websites and pornographic advertisements. The trojan also installs a watchdog process that ensures the victim's DNS records stay modified on a minute-by-minute basis.
SecureMac's DNSChanger Removal Tool allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users' DNS records will be repaired.
There may be other ways of guarding against Trojans, viruses and general malware affecting the Mac. A white paper has recently been published on the subject by SubRosaSoft, available here:
http://www.macforensicslab.com/ProductsAndServices/index.php?mainpage=document_general_info&cPath=11&productsid=174
Also, beware of MacSweeper:
MacSweeper is malware that misleads users by exaggerating reports about spyware, adware or viruses on their computer. It is the first known "rogue" application for the Mac OS X operating system. The software was discovered by F-Secure, a Finland based computer security software company on January 17, 2008
http://en.wikipedia.org/wiki/MacSweeper
You should also read what a major contributor called tacit has to say here:
http://tacit.livejournal.com/238112.html -
Trojan Horse? -- "Don't ask me about buying music again"
I'm really worried -- I clicked to buy a song from the itunes store and instead of downloading, a strange screen popped up reading something like: "Don't ask me about buying music again!" I did not click again, thinking I just opened up a trojan horse. I shut it down and began running my Norton Antivirus immediately. It's still scanning; no results yet.
I'd appreciate a response from anyone else who has seen this or knows something about it. Thanks!Thanks for your help, B!
I have Norton Internet Security 2006, fully updated, which is supposed to pick up on adware, spyware and the like. It found nothing.
I also use "NoAdware," which caught a few adware items and an "unidentified malware" item (could've been it). I let it delete all of those things.
I also let my Iolo System Mechanic 2006 do a complete clean-off, just for good measure, then re-started.
I haven't had trouble since, but I'm still nervous about the message that popped up because it did not seem to be related to any sort of advertisement and no one seems to have encountered the problem before.
Anything else I should do? Anyone else ever seen this?
Thanks,
WR -
just wondering if there any resent trojan horse to be careful about or mac specific viruses
1. This comment applies to malicious software ("malware") that's installed unwittingly by the victim of a network attack. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the victim's computer. That threat is in a different category, and there's no easy way to defend against it. If you have reason to suspect that you're the target of such an attack, you need expert help.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user, but internally Apple calls it "XProtect." The malware recognition database is automatically checked for updates once a day; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets (see below.)
It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
3. Starting with OS X 10.7.5, there has been another layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't actually been tested by Apple (unless it comes from the Mac App Store), but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. For most practical purposes, applications recognized by Gatekeeper as signed can be considered safe.
Gatekeeper has, however, the same limitations as XProtect, and in addition the following:
It can easily be disabled or overridden by the user.
A malware attacker could get control of a code-signing certificate under false pretenses, or could find some other way to evade Apple's controls.
For more information about Gatekeeper, see this Apple Support article.
4. Beyond XProtect and Gatekeeper, there’s no benefit, in most cases, from any other automated protection against malware. The first and best line of defense is always your own intelligence. All known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and the malware attacker. If you're smarter than he thinks you are, you'll win.
That means, in practice, that you never use software that comes from an untrustworthy source. How do you know whether a source is trustworthy?
Any website that prompts you to install a “codec,” “plug-in,” "player," "extractor," or “certificate” that comes from that same site, or an unknown one, is untrustworthy.
A web operator who tells you that you have a “virus,” or that anything else is wrong with your computer, or that you have won a prize in a contest you never entered, is trying to commit a crime with you as the victim. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
Pirated copies or "cracks" of commercial software, no matter where they come from, are unsafe.
Software of any kind downloaded from a BitTorrent or from a Usenet binary newsgroup is unsafe.
Software with a corporate brand, such as Adobe Flash Player, must be downloaded directly from the developer’s website. If it comes from any other source, it's unsafe.
5. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was never a good idea, and Java's developers have had a lot of trouble implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style "virus" affecting OS X. Merely loading a page with malicious Java content could be harmful. Fortunately, Java on the Web is mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice.
Java is not included in OS X 10.7 and later. A discrete Java installer is distributed by Apple, and another one by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it — not JavaScript — in your browsers. In Safari, this is done by unchecking the box marked Enable Java in the Security tab of the preferences dialog.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a specific task, enable Java only when needed for the task and disable it immediately when done. Close all other browser windows and tabs, and don't visit any other sites while Java is active. Never enable Java on a public web page that carries third-party advertising. Use it, if at all, only on well-known, password-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.
Follow these guidelines, and you’ll be as safe from malware as you can practically be, short of not using the Internet at all.
6. Never install any commercial "anti-virus" or "Internet security" products for the Mac, as they all do more harm than good, if they do any good at all. If you need to be able to detect Windows malware in your files, use the free software ClamXav — nothing else.
Why shouldn't you use commercial "anti-virus" products?
Their design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere.
In order to meet that nonexistent threat, the software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
By modifying the operating system, the software itself may create weaknesses that could be exploited by malware attackers.
7. ClamXav doesn't have these drawbacks. That doesn't mean it's entirely safe. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
ClamXav is not needed, and should not be relied upon, for protection against OS X malware. It's useful only for detecting Windows malware. Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else.
A Windows malware attachment in email is usually easy to recognize. The file name will often be targeted at people who aren't very bright; for example:
♥♥♥♥♥♥♥♥♥♥♥♥♥♥!!!!!!!H0TBABEZ4U!!!!!!!.AVI♥♥♥♥♥♥♥♥♥♥♥♥♥♥.exe
ClamXav may be able to tell you which particular virus or trojan it is, but do you care? In practice, there's seldom a reason to use ClamXav unless a network administrator requires you to run an anti-virus application.
8. The greatest harm done by anti-virus software, in my opinion, is in its effect on human behavior. It does little or nothing to protect people from emerging threats, but they get a false sense of security from it, and then they may behave in ways that expose them to higher risk. Nothing can lessen the need for safe computing practices.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default. -
My computer has been infected by a Trojan Horse. It has taken over my Mac email account and began sending out malicious emails to everyone in my address book. I cleared out my MAC address book and began using my AOL email account. It took a few days and then my AOL email account was infected and has now been send out malicious email to all my contacts for over a month. It has also infected my iPhone--I am no longer able to send or receive emails on my iPhone. Also, once the Trojan Horse began using my AOL email it completely blocked me from using my MAC account by sending never ending popups asking for my email password to access my MAC email account, but it never accepts my pass word. The TH has also slowed down everything on my computer. It's like I am working on an old PC with dial up connection instead of the high speed digital connection that I have. The little color wheel spins constantly as I wait for sometimes over a minute for a page to pull up. If it pulls up at all. I have tried to use the 2 disks that came with my computer to completely remove everything on my computer and then reinstall all the programs, but I am not allowed to sweep my computer clean. I thought maybe my disks that came with my computer were defective so I called Apple and they sent me 2 new disks. I am not able able to clear my computer with the 2 new disks either. I have done this before successfully so it's not something new to me. I do remember when I believe my computer became infected: I had googled an unusual sewing term, and I was opening what appeared to be legitimate sites, when all of a sudden a pop up appeared that said that my computer had been infected. I immediately shut my computer off, but it was too late. I downloaded a virus program for Mac, and it has never found a virus or problem at all. I think it is part of this Trojan Horse, but I am unable to delete it from my computer. It refuses to uninstall. The Mac Trojan Horse is real and it is terrible. If anyone has any suggestions for me I would be very appreciative,
Beth
vuInstall ClamXav and run a scan with that. It should pick up any trojans.
17" 2.2GHz i7 Quad-Core MacBook Pro 8G RAM 750G HD + OCZ Vertex 3 SSD Boot HD
Got problems with your Apple iDevice-like iPhone, iPad or iPod touch? Try Troubleshooting 101 -
I have received an email from a friend with a link which I clicked. It took me to the google home page. I am now suspicious that my friend's email account has been hijacked and the link contained a virus or a Trojan horse. I would know what to do on my PC but am new to the IPad. Can any form of Trojan horse be planted on IOS 6 or am I worrying unnecessarily? Reassurance would be most welcome as I do use the IPad for checking bank details and web purchases. Thanks for any help.
PC virus won't run on iPad.
Maybe you are looking for
-
How to specify SWF instead of an image in loading
I hope it is not too much over my head as I would like to make it work. Some time ago I recieved help in constracting an interactive image thumb scroller using greensock features. My biggest problem at the moment is that I can not figure out how to c
-
Is there a way to change the look of the new ical in Lion?
Is there a way to change the look of the ical in Lion?
-
4th gen tc and wd book live work to gather?
i have a 4th gen tc and was going to use it specificlay for backing up my macbook pro, i also have multiple pc running windows and wanted to back those up also but not on the tc because i dont want to mix them all on one back up. i saw that wd has a
-
Problem with Between operator in condition
Hi I am using Discoverer Desktop 11g. In my report, I have 2 parameters for start-date and end-date. I want the report to display records which have an order date that falls within the period indicated by start-date and end-date. E.g. if I run report
-
Where are my printer preferences in ipad2?
I'm trying to print from my iPad and it has become mission impossible. I do not have an airprinter but I have a wireless lermax. I can fallow any suggestions because I can find printer setting anywhere of my iPad