MB Pro appears to have Win32 FakeAlert Trojan

[mw021j1728]

Hi,

Despite reading that macs cannot be affected by the Win32 FakeAlert trojan, I have a malware virus on my mac that shows all the symptoms I read about.

In most webpages, words will appear as links and when I move the cursor over them, I get popups- the sign of FakeAlert.
I have scanned the web for Mac Users reporting similar symptoms but found virtually nothing.

I used avast to do a system scan, and perhaps no surprise, it found a virus:

Path: /Library/Application Support/Symantec/AntiVirus/QuarantineFile.qtn
Infection Details: Win32: FakeAlert-AFS [Trj]

I am really not sure how to proceed- this is the first virus I've ever had to deal with, let alone a MBP, and there is no advice anywhere on the net. Maybe I should start by deleting the file at the path above? But I do not know how far it has spread and what is affected.

Any ideas greatly appreciated 🙂

----------

I forgot to mention, at first my web actions were only affected when I used the Firefox browser.
But now on some sites, Safari is beginning to be affected by the same problem 😕

 

[GGJstudios]

Despite reading that macs cannot be affected by the Win32 FakeAlert trojan, I have a malware virus on my mac that shows all the symptoms I read about.

You don't have anything to worry about. It's not a virus. It's a trojan. Specifically, it's a Windows trojan, that cannot execute or infect Mac OS X in any way, as no Windows programs can run in OS X.

In most webpages, words will appear as links and when I move the cursor over them, I get popups- the sign of FakeAlert.

Take a screen shot of such a pop-up and post it.

I have scanned the web for Mac Users reporting similar symptoms but found virtually nothing.

That's because it's impossible for a Windows trojan to infect OS X.

I used avast to do a system scan, and perhaps no surprise, it found a virus:

Path: /Library/Application Support/Symantec/AntiVirus/QuarantineFile.qtn
Infection Details: Win32: FakeAlert-AFS [Trj]

It's a Windows trojan, not a virus. Read the FAQ below to understand the difference.

I am really not sure how to proceed- this is the first virus I've ever had to deal with, let alone a MBP, and there is no advice anywhere on the net.

You don't need to do anything. The file has already been quarantined. Your Mac is not affected at all.

Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. The only malware in the wild that can affect Mac OS X is a handful of trojans, which can be easily avoided by practicing safe computing (see below).

3rd party antivirus apps are not necessary to keep a Mac malware-free, as long as a user practices safe computing, as described in the following link.

Read the What security steps should I take? section of the Mac Virus/Malware FAQ for tips on practicing safe computing.

 

[mw021j1728]

​

Here you go.

They are quite temperamental, I mean the apperance or not of the links at all. But whenever they do appear a pop-up usually appears. The one captured above is from what must be a secure site, www.independent.co.uk, major UK newspaper, and no site seems guaranteed to be immune to this problem.

 

[MBPDiva]

View attachment 402298​

Here you go.

They are quite temperamental, I mean the apperance or not of the links at all. But whenever they do appear a pop-up usually appears. The one captured above is from what must be a secure site, www.independent.co.uk, major UK newspaper, and no site seems guaranteed to be immune to this problem.

Those are link ads for the website you're visiting. Link ads are not caused by a virus. That would be an extremely sophisticated hacking of a large website. 🙂

 

[rigid]

Yeah just get some form of ad blocker to be rid of those.

 

[glenthompson]

Some websites use keyword ads that highlight the keyword in the text and it triggers a popup who you hover over the text. In addition to popup blockers, I try to avoid such sites if possible.

 

[yusukeaoki]

Those are just ads as mentioned above.
Notice that all of those dont happen on all websites but only particular ones.
Its not a malware or virus or whatever. Its a ad.