Trojan Man

Question

I found a folder that I thought had been deleted from my trash.  My folder's name is titled "Icons."  The problem is when I open the folder, all of my files are not viewable.  Each item says BRLaser has 4 numbers and then ends in .icns.  They are all pictures of different printers...seriously?  The were all accounting files initially, mostly spreadsheets and some PDF files.
This all started when I ran Clam and detected several Trojans.  After I cleaned them up, Quarantined them and sent them to the trash, this is when I had problems.  Does anybody have a solution to this?

Answer 1

Reds_fan wrote:
Actually I just found a couple.  Filename is 36317.emlx, infection name Email.Trojan-432.  Another is 36321.emlx, Win.Trojan.Agen
OK, so those are both e-mails, so you will need to do a little repair work.
The only Trojan's known to impact OS X were sent to Tibetan sympathizers, so unless you are in that catagory, you have nothing to worry about. The second one is Windows only.  I need to check on the first one, but odds are great that it is also.
First of all, here's an easy way to locate find out what mailbox they came from:
Open the Terminal app (found in /Applications/Utilities/), then copy and paste the following after the "$ " prompt:
grep 'FOUND' ~/Library/Logs/clamXav-scan.log
and hit return.
Now open the Mail app and highlight each of the mailboxes where infected files were found and select "Rebuild" from the bottom of the Mailbox menu.
If this was from a Gmail account let me know as there is probably still more work to be done.
And for the future:
Never use ClamXav (or any other A-V software) to move (quarantine) or delete e-mail. It will corrupt the mailbox index which could cause loss of other e-mail and other issues with functions such as searching. It may also leave the original e-mail on your ISP's e-mail server and will be re-downloaded to your hard drive the next time you check for new mail.
So, if you choose to "Scan e-mail content for malware and phishing" in the General Preferences, make sure you do not elect to either Quarantine or Delete infected files.
When possibly infected e-mail files are found:
- Highlight the entry in the ClamXav window's top pane that needs to be dealt with.
- Right-click/Control-click on the entry.
- Select "Reveal In Finder" from the pop-up menu.
- When the window opens, double-click on the file to open the message in your e-mail client application.
- Read the message and if you agree that it is junk/spam/phishing then use the e-mail client's delete button to delete it (reading it is especially important when the word "Heuristics" appears in the infection name).
- If you disagree and choose to retain the message, return to ClamXav and choose "Exclude From Future Scans" from the pop-up menu.