Virus/Worm issue?

[Ccrew]

I'll add to this.

I've made no secret here that I'm an IT engineer, and I will say that I am at a place in the DC area that would be recognized by probably everyone on this board.

When I get Mac's flagged by my intrusion systems, subsequently pulled off the floor by lapel pin wearing FBI agents, and sent to the NSA for evaluation and returned with hard drives removed, and the words from the handlers that "We've never seen this one before" and you know that the machine was talking directly to China, AND the user on it had no admin rights to install anything, AND root not enabled, AND all admin password protocols are at DOD qualification, some guy off an internet board saying "there's never been a virus on a Mac" doesn't make me sleep at night. There's none that YOU know of.

 

[/user/me]

I'll add to this.

I've made no secret here that I'm an IT engineer, and I will say that I am at a place in the DC area that would be recognized by probably everyone on this board.

When I get Mac's flagged by my intrusion systems, subsequently pulled off the floor by lapel pin wearing FBI agents, and sent to the NSA for evaluation and returned with hard drives removed, and the words from the handlers that "We've never seen this one before" and you know that the machine was talking directly to China, AND the user on it had no admin rights to install anything, AND root not enabled, AND all admin password protocols are at DOD qualification, some guy off an internet board saying "there's never been a virus on a Mac" doesn't make me sleep at night. There's none that YOU know of.

How many users are going to be subjected to attacks from china that are directed at governmental organizations?

 

[GGJstudios]

"there's never been a virus on a Mac" doesn't make me sleep at night. There's none that YOU know of.

I'll repeat my standard statement about malware, for clarity's sake:

Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. The Mac Virus/Malware FAQ that I link to clearly describes what "in the wild" means:

in order for a virus to be considered in the wild, "it must be spreading as a result of normal day-to-day operations on and between the computers of unsuspecting users." This definition excludes "proof of concept" code that is used in a testing situation under strictly controlled conditions, and which poses zero threat to average computer users.

 

[DVD9]

How many users are going to be subjected to attacks from china that are directed at governmental organizations?

Do you think the Chinese are leaps and bounds better than everyone else? They just aren't rolling in an anything goes capitalist nation like Russia, so the Chinese hackers/crackers work for the Chinese government and target other governments.

And it's not just the Russians.

Most of what's going on we never hear about, because it's never discovered by design. It's the sloppy, out of control people who feed the public discussion.

 

[chrono1081]

Maybe I'm just jaded by working with Windows all my life and doing malware control as part of my living but I'm not concerned...not sure why everyone else is so scared...

 

[/user/me]

Do you think the Chinese are leaps and bounds better than everyone else? They just aren't rolling in an anything goes capitalist nation like Russia, so the Chinese hackers/crackers work for the Chinese government and target other governments.

And it's not just the Russians.

Most of what's going on we never hear about, because it's never discovered by design. It's the sloppy, out of control people who feed the public discussion.

Nope, I was merely referencing the fact that the poster that I quoted worked for a governmental agency, which is getting worms that are sent from chinese computers... They don't care about the average Joe/Jane that wants to play WoW on their computer.

 

[blatopilot]

Try CMD+R before boot to get into recovery.

Go to utilities from the top menu and select terminal.

Without quotes, type "resetpassword"

Select your drive then your user account and at the bottom hit reset home directory.

Quit terminal. Select disk utility. Repair permissions on your disk and restart.

Any luck?

 

[kaielement]

Agreed however, there are reasons to run antivirus/malware on OS X especially if you are dealing with a mixed environment passing on malicious code even inadvertently does you no favours in the profesional world, let alone family and friends. What does not hurt your Mac may bring a PC to it`s knees

You do need to be careful on the choice of program ClamXav is extremely light and only looks in realtime at what you specify and it`s free. If anyone seriously believes that running ClamXav on todays modern hardware impacts performance, the sentry is presently utilising 0.2% of CPU consuming just over an hours worth of CPU time over several weeks and this is on a machine over four years old. The paid for packages I agree are a waste of $ offering little more than a placebo with a heavyweight user interface. ClamAV the parent of ClamXav protects numerous servers globally...

I have never had a positive hit in all the years I have run the program Equally OS X is gaining traction and it`s simply a matter of time before someone figures it out, ClamXav cost me nothing monetarily or time in productivity, this is a safety net that costs little more than five minutes of your time.

As for the OP issue first thing that spellings to my mind is how much free space does he have on the drive, my own Early 2008 MBP has very limited space and also tends to go bonkers below a certain threshold.

Yes clamxav is probably a good one and it is free if you really feel you need some protection. I use it and run it when I remember which is like once a mouth or sometimes less Nd so far in over three years never found anything but good to have just in case I guess lol.....

 

[Queen6]

Yes clamxav is probably a good one and it is free if you really feel you need some protection. I use it and run it when I remember which is like once a mouth or sometimes less Nd so far in over three years never found anything but good to have just in case I guess lol.....

Thing is; if we all ran the like of ClamXav, the chances of malicious code spreading and gaining traction will be very much limited; not all have a high level of computing experience, nor do they actually need to...


Trojan-Downloader:OSX/Flashback.I

Trojan-Downloader:OSX/Flashback.I is dropped by malicious Java applets that exploit the known CVE-2011-3544 vulnerability.

On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done.

If infection is successful, the malware will modify the contents of certain webpages displayed by web browsers; the specific webpages targeted and changes made are determined based on configuration information retrieved by the malware from a remote server.


Installation

On execution, the malware checks if the following path exists in the system:

/Library/Little Snitch
/Developer/Applications/Xcode.app/Contents/MacOS/Xcode
/Applications/VirusBarrier X6.app
/Applications/iAntiVirus/iAntiVirus.app
/Applications/avast!.app
/Applications/ClamXav.app
/Applications/HTTPScoop.app
/Applications/Packet Peeper.app
If any of these are found, the malware will skip the rest of its routine and proceed to delete itself.

It`s speculated that some 600K Mac`s have been infected to date, that alone is 600,000 reasons to run ClamXav. I rarely run a manual scan and limit ClamXav`s sentry to a few specific folders, with scheduled scans taking place in the small hours. Had this code contained a malicious payload these Mac`s would have been directly affected...

Personally I dont understand people`s reluctance, it`s like a badge of honour "Mac`s are virus free" and yes to a point they are; it`s just code someone soon is going to work it out, just look at the advancement in malware attacks specifically for OS X. I also agree with sensible computing habits you can be safe, equally a trusted site can be compromised and become a threat overnight.

To have a free, low headroom, accorate scanner that offers a lot of flexibility and not utilize it seems a little stubborn. The retorts of AV being a resource hog, boils down to one thing, research; ClamXav will not bog your system down, if it does you have some other inconsistencies that need addressing, or your hardware is so old it`s well and truly time to upgrade, on my Early 2008 MBP ClamXav is simply invisible, there is absolutely no degradation of performance, as for the new i7 2.4 it`s transparant guy`s...

I have literally decades of work on my systems, I have no intention of losing any data, ClamXav is but one tool in a multilayered safety net. Lets face it if and when OS X is compromised it will spread like wildfire as many fundamentally believe that OS X is invulnerable, and I am not entirely sure posts that overly build a sense of security are helpful to the basic user, even Apple recognise the threat, however the updates are too slow to be considered a preventative measure...

BTW I have no association with ClamXax, Same principle as a condom. I'd rather have one and not need it, than need it and not have one

Q-6

 

[jevel]

While the discussion about viruses and malware on the OS X platform is an interesting one, this thread is about a person needing help with a specific problem.

So OP, here's my take on your problem:

Problems are related to different software it seems. The ones mentioned were browsers like Safari and Firefox, and also Word. Is there any other applications that show these problems as well?

Does the problem start immediately after you reinstall? Do you delete the entire disk, then create a new partition and format it?

How do you add applications? Do the problems start before you add anything? Have you tried just reinstalling and updating OS X, then using Safari to see if the problems are there? How close to reinstalling does the problems start again?

Have you looked at the console and tried to find anything there? Did they exchange your RAM as well as the logic board?

-KJ

 

[GGJstudios]

Thing is; if we all ran the like of ClamXav, the chances of malicious code spreading and gaining traction will be very much limited;

... or we could simply disable Java in Safari, as has been recommended countless times in this forum. No 3rd party apps required.

The point is, you can run antivirus apps if you want to, but it's not required to keep your Mac malware-free. Practicing safe computing can protect your Mac from malware, even when antivirus apps fail to do so. The reverse is not true.

 

[Queen6]

... or we could simply disable Java in Safari, as has been recommended countless times in this forum. No 3rd party apps required.

Dumbing down the browsing experience and for some disabling an essential function is not a universal fix for all, as many web based applications require Java...

The point is, you can run antivirus apps if you want to, but it's not required to keep your Mac malware-free. Practicing safe computing can protect your Mac from malware, even when antivirus apps fail to do so. The reverse is not true.

My point is today OS X is relatively safe, however it`s simply a matter of time before it`s compromised, not all users are equal and some need help in securing their systems, frankly I don't believe that advocating that OS X is completely secure on the strength of nothing has happened yet is the best of advice.

Of course it`s a personal choice...

 

[GGJstudios]

Dumbing down the browsing experience and for some disabling an essential function is not a universal fix for all, as many web based applications require Java...

Like many in this forum, I leave it disabled. I rarely encounter a need for it, and when I do on a trusted site, one click enables it until I leave. That's a painless way to avoid malware without having to use any 3rd party app.

I don't believe that advocating that OS X is completely secure on the strength of nothing has happened yet is the best of advice.

I don't, either. No OS is completely secure, and no antivirus is infallible. That's why I recommend that users practice safe computing. That alone is sufficient to avoid all Mac OS X malware that has ever been released in the wild. If and when the time comes that antivirus is necessary to protect Macs from malware, I'll be among the first in recommending it.

 

[Queen6]

I don't, either. No OS is completely secure, and no antivirus is infallible. That's why I recommend that users practice safe computing. That alone is sufficient to avoid all Mac OS X malware that has ever been released in the wild. If and when the time comes that antivirus is necessary to protect Macs from malware, I'll be among the first in recommending it.

This is my very point virus/malware gains traction by exploiting vulnerabilities on unprotected systems. I don't believe for one second that CalmXav is the single security solution for OS X, it is however the de-facto standard for many mail servers (ClamAV), and the app is rapidly updated.

Apple has included ClamAV with OS X sever since 10.4 and continues to do so today (http://www.apple.com/macosx/server/specs.html) with OS X 10.7.3 Lion Server. ClamXav is transparent on a Intel based Mac, adds another level of protection at zero cost.

Apple also clearly list Calmav-137-1 on their 10.7.3 Open Source page (http://www.opensource.apple.com/release/mac-os-x-1073/) admittedly it is not implemented in the Lion client release, equally I would not be surprised if it was quietly implemented in a forthcoming release of OS X as was XProtect implemented in Snow Leopard.

There are many compelling reasons to run ClamXav and little if any not too, personal choices aside I fundamentally believe that suggesting that OS X is safe to all and does not need such tools is a step in the wrong direction; not all are technically minded, neither do all users who may have access follow the same rules. The vast majority simply point and click to get to where or what they want ClamXav simply serves as a barrier to protect those that are unaware and some cases unconcerned, ultimately such safeguards protect the community as a whole...


Q-6

 

[Ccrew]

Nope, I was merely referencing the fact that the poster that I quoted worked for a governmental agency, which is getting worms that are sent from chinese computers... They don't care about the average Joe/Jane that wants to play WoW on their computer.

Actually, I don't work for a governmental agency.... Which kind of negates that point.

----------

... or we could simply disable Java in Safari, as has been recommended countless times in this forum. No 3rd party apps required.

The point is, you can run antivirus apps if you want to, but it's not required to keep your Mac malware-free. Practicing safe computing can protect your Mac from malware, even when antivirus apps fail to do so. The reverse is not true.

Now to show that I'm not antiGGJ here

You have to keep in mind that anti-virus apps for the most part depend on heuristics from known virus signatures to determine whether *your* machine is infected. If you operate on the premise that no known viruses are in the wild then by that same token there should be no signatures available other than some SWAG on the part of the antivirus companies. Therefore safe computing as GGJ has suggested is indeed probably the best scenario. Painful? Conflicts with a seamless experience? Highly possible. But indeed given the current state of malware and OSX probably the best idea.

Keep in mind that flashback.k which is the latest variant, is a fully drive-by infection. Just need to not have the current java patch and have java enabled on the browser. That said, it IS a java exploit, and not an OSX one although that's where my take on the fact that we're splitting hairs on specifics at times kicks in.

 

[/user/me]

Actually, I don't work for a governmental agency.... Which kind of negates that point.

----------

Oh I'm sorry. Everything about your original post inferred that. My bad.

 

[GGJstudios]

This is my very point virus/malware gains traction by exploiting vulnerabilities on unprotected systems. I don't believe for one second that CalmXav is the single security solution for OS X, it is however the de-facto standard for many mail servers (ClamAV), and the app is rapidly updated.

I agree that if you're going to run AV software, ClamXav is probably the best choice. The only danger with running AV is that it can lull the user into a false sense of security. For example, those who only depended on AV were caught with their pants down when MacDefender first appeared on the scene, as none of the AV apps detected it as malware. However, those practicing safe computing were not affected, because they already were in the habit of not installing things without thinking.

Practicing safe computing without using antivirus software will keep your Mac safe. Running antivirus without practicing safe computing will not.

Now to show that I'm not antiGGJ here

I never for a moment thought that you were! Your posts are usually without bias or drama!

 

[Penn Jennings]

Practicing safe computing without using antivirus software will keep your Mac safe. Running antivirus without practicing safe computing will not.

People get their systems compromised, even when they do everything right. Being smart and safe lowers yours risk but your risk is never zero.

 

[GGJstudios]

People get their systems compromised, even when they do everything right. Being smart and safe lowers yours risk but your risk is never zero.

In today's malware environment, your system cannot be compromised by malware if you practice safe computing. Any risk that might remain is from malware that has not yet been identified.

 

[getz76]

In today's malware environment, your system cannot be compromised by malware if you practice safe computing. Any risk that might remain is from malware that has not yet been identified.

The first sentence contradicts the second, I believe. Safe computing will only mitigate known malware. A zero day exploit can potentially backdoor a system.

 

[GGJstudios]

The first sentence contradicts the second, I believe. Safe computing will only mitigate known malware. A zero day exploit can potentially backdoor a system.

They don't contradict. "In today's malware environment" means with all known malware. A zero day exploit would change "today's malware environment".

 

[getz76]

They don't contradict. "In today's malware environment" means with all known malware. A zero day exploit would change "today's malware environment".

I disagree. Zero day exploits are unknown to the developer, but the developer is not what matters in these cases. "Today's malware environment" must assume there are zero day exploits. You can mitigate nearly all risk, but you cannot assume your system is safe if it is connected to a network or unknown drives.

 

[Penn Jennings]

In today's malware environment, your system cannot be compromised by malware if you practice safe computing. Any risk that might remain is from malware that has not yet been identified.

GGJstudios, you post a lot. You're usually a smart guy. However, I've been a security professional for over 10 years. Some of your security released comments and advise are just plain WRONG.

This is one of many statements that is just plain WRONG.

 

[GGJstudios]

I disagree. Zero day exploits are unknown to the developer

If an exploit is unknown to the developer, then obviously it's not a threat, since the developer hasn't created the exploit.

"Today's malware environment" must assume there are zero day exploits. You can mitigate nearly all risk, but you cannot assume your system is safe it is connected to a network or unknown drives.

You're splitting hairs. "In today's malware environment" obviously can't include unknown malware. All known Mac OS X malware can be completely avoided by practicing safe computing, without the need for 3rd party antivirus software.

My earlier statement made that distinction perfectly clear.

In today's malware environment, your system cannot be compromised by malware if you practice safe computing.

That's all known malware, as opposed to unknown:

Any risk that might remain is from malware that has not yet been identified.

GGJstudios, you post a lot. You're usually a smart guy. However, I've been a security professional for over 10 years. Some of your security released comments and advise are just plain WRONG.

This is one of many statements that is just plain WRONG.

It is not wrong. Name one Mac OS X malware that cannot be successfully avoided by the user practicing safe computing. Name one security recommendation I've made that is wrong. Of course, I'm not infallible, but if you challenge me, do so with specific facts, and not just an ambiguous statement.

 

[Penn Jennings]

They don't contradict. "In today's malware environment" means with all known malware. A zero day exploit would change "today's malware environment".

This statement is also just plain WRONG. Zero day exploits are part of todays environment. In the case of flashback, people were exposed long after zero day because Apple didn't release the Java updates in a timely manner. So you would be wrong in that case too. Remember, people got infected with flashback without taking any actions and without any notifications. There were reports of MacDefender infecting users silently as well. So this is not even the first time.

We've had these security conversations for a year or two. Seriously, this is one area that you hurt as much as you help.