iTunes not loading; possible victim of "phishing"

[Swissbird]

Several days ago, when opening iTunes and trying to access the store, I got a pop-up message appearing to be from VirusBarrier 6 which said that this was a 'phishing' site; gave several options - block, ignore, something else (sorry, I didn't copy it or give it much thought, so I'm doing this from memory). I basically clicked it away. After that, iTunes would never entirely load, and took forever to load just a few images. Now, it doesn't load at all. I can play music, but the store is just a blank page and eventually pops up with "iTunes could not connect to the iTunes Store; make sure your network connection is active and try again". Connection is fine everywhere else. I tried the Terminal thing to disable Ping, but that didn't work.

Hubby says to uninstall it (he's a PC guy) and download a new copy, but I'm afraid I'll lose my music!

I have an iPod Classic 80 6th gen; and an iPod Touch 64 3rd gen, and am afraid to sync either one in case it is a virus.

Anyone have an idea? I have searched here and on the internet, but nothing sounds like this problem.

I'm on a MacBook Pro 17", 2.6GHz Intel Core 2 Duo;4GB 667 MHz DDR2 SDRAM; Mac OSX 10.5.8
Also have a Power Mac G4 (Quicksilver) from about 10 yrs ago, which I haven't sync'd to all this newer stuff because of it's age - just running Tiger there.
~~~~~~~
Incidentally, my account WAS compromised back in May. Someone charged $62 about 5 times (same amount over and over), before my credit card company notified me that something was going on. I closed the cc account, got a new password at iTunes. Could these people be back? I haven't accessed my account since this started several days ago, and the cc account looks ok, but was shown the window where you give your password as late as today.

 

[Bernard SG]

Uninstall VirusBarrier.
You. Don't. Need. An. Antivirus. Using. A. Mac.
If iTunes still doesn't work, you'll have to re-install probably. To avoid losing your media files, backup using time-machine then after re-install, restore your account data with migration assistant.

 

[rprebel]

Uninstall Virusbarrier. You don't need it, and it's slowly killing your mac.

 

[Swissbird]

Bernard SG, I am afraid of backing up anything at this point; my computer is acting a little weird (lag time in typing; screen jumps around when googling, etc). I did a Time Machine backup several days ago, and 10 days before that. Would it be better to go back to one of those and restore?

What about the incident in May - virus? And I stupidly clicked on one of those malware links (a "friend" send me an email; I clicked; it was a viagra site and of course, the mail program sent it out to every contact!.....a virus?)

Seems to me we are vulnerable, or getting that way.

 

[munkery]

When you delete iTunes your music remains in your "user"/music/iTunes folder. If you are really worried about losing your music, copy that file then return it to that location after the reinstall.

In my experience, that folder remains upon deletion and iTunes is set to look for that folder upon reinstall.

If you want an antivirus app for your mac, use ClamXav

ClamXav is free to download and use. Its virus database actually includes threats for older versions of Mac OS (pre OS X), unlike many commercial mac antivirus solutions that only have windows definitions. It is not preconfigured to scan emails but, using the "Sentry", can scan your download folder. Sentry setup is in preferences. (EDIT: Email scanning has to be set with the Sentry)

Do not set up automatic deletion or quarantine in ClamXav as these features create issues. If it does detect something, locate it in finder and delete it manually.

Honestly, at this point in time, antivirus software on macs only prevents you from unintentionally passing along windows viruses to windows users. No threats at this time for Leopard or Snow Leopard other than three trojans. But, there are no viruses or worms.

Snow Leopard has a built in utility that warns you if you are about to install any of the three trojans currently available for Mac OS X. I see that you are running Leopard which does not have this feature.

All OSes are vulnerable to phishing as there is little that can be effectively built in to an OS to prevent it. The only method to effectively prevent phishing is a good understanding of security certificates (SSL, etc.) on the part of the user. (EDIT: The capacity to view digital certificates for important websites, such as banks and paypal, is integrated into the browser but you must know how to use that function for it to be beneficial. Relying on anti-phishing database services, such as PhishTank and Google Safe Browsing, that are built into browsers are not nearly as effective when solely relied upon.)

iTunes should open whenever you click a legitimate link to the iTunes store in your browser or an email. If iTunes does not open then that site is most likely a phishing site and you should never enter your iTunes password into anything other than the actual iTunes app unless you know for sure.

 

[InfoSecmgr]

Bernard SG, I am afraid of backing up anything at this point; my computer is acting a little weird (lag time in typing; screen jumps around when googling, etc). I did a Time Machine backup several days ago, and 10 days before that. Would it be better to go back to one of those and restore?

What about the incident in May - virus? And I stupidly clicked on one of those malware links (a "friend" send me an email; I clicked; it was a viagra site and of course, the mail program sent it out to every contact!.....a virus?)

Seems to me we are vulnerable, or getting that way.

Hi Swissbird. Time machine backups are automatic, and occur hourly. As far as the whole "virus" or "phishing" (there is no software defense against phishing, it comes down to user education) thing goes, trust me you are just fine. This sort of thing is my specialty (see my profile).

If you are that concerned about things, you should make sure you have a current backup and wipe/reformat/restore your hard drive. If the issue persists then there is something wrong, but still not a virus. In that case, manually backup what is important to you to an external drive (documents, movies, etc). Reformat/reinstall OS 10 then drag/drop your backed up files over. That should solve any issue that may be carried over from the time machine backup (if any). If you still have problems, take it to an Apple store.

As far as the iTunes store issue you had, to put it simply yes you could be compromised again if you keep doing things that aren't in the best interest of security. I don't mean to talk down to you, but I don't know what "level" you are at with this sort of thing. You have a "strong" password, right? At least 8 characters, special characters, etc?

 

[Swissbird]

Thanks, All!

Thanks, Munkery, InfoSecmgr, rprebel, and Bernard. I've uninstalled it using an uninstaller. It's gone. I've copied all the good suggestions and will shut down now and take this on when I return from Vacay! Good tips!

 

[Swissbird]

It's working great! Everything is!

I opened iTunes, and the store opened right up! Not only that, I noticed that it was not iTunes playing my music, but FoxyTunes.

I'll look into that Clam thing.

Good job! This is a huge relief!

 

[Bernard SG]

Glad your issue was solved.
I would recommend you to update your system to Snow Leopard. It sucks that Apple is charging for it but it's not that expensive anyway. In terms of security, I think it's safest to be on the latest iteration of the OS, which is under more intensive scrutiny and gets regular patching. Just my opinion.
FoxyTunes doesn't "play" your music, it's just controlling iTunes from your web browser, AFAIK.

 

[GGJstudios]

For further education: Mac Virus/Malware Info