joefromdoniphan

Q: I need to get my iMac scanned for malware, etc. what should I use?, I need to get my iMac scanned for malware, etc. what should I use?

My bank tells me that my online banking service has been compromised. They say I need to get my iMac scanned. What do I use, where do I get (download) it. I do not need to run an anti-virus program, just get the computer scanned. I live 150 miles from any store that handles anything for Macs.

iMac, Mac OS X (10.6.8)

Posted on Aug 30, 2011 5:03 PM

Close

Q: I need to get my iMac scanned for malware, etc. what should I use?, I need to get my iMac scanned for malware, etc. what should I ... more

  • All replies
  • Helpful answers

Page 1 Next
  • by babowa,

    babowa babowa Aug 30, 2011 5:27 PM in response to joefromdoniphan
    Level 7 (32,244 points)
    iPad
    Aug 30, 2011 5:27 PM in response to joefromdoniphan

    Your bank appears to assume that you are running Windows - are you? If you're not, your bank needs to stop being so presumptuous - they need to check their own rather than blame a customer's computer. Unless you forwarded an infected attachment from a Windows user to another Windows user, there is little chance that scanning will show anything.

     

    If you are not running Windows, then there has only been one trojan and you can read about it here:

     

    http://support.apple.com/kb/HT4650

     

    If you feel you need to run something, you can download ClamXav - it is free.

  • by Allan Eckert,

    Allan Eckert Allan Eckert Aug 30, 2011 5:34 PM in response to joefromdoniphan
    Level 9 (54,020 points)
    Desktops
    Aug 30, 2011 5:34 PM in response to joefromdoniphan

    I find that calling the bank management back and saying that you are considering changing to another bank is usually a good way to get their attension.

     

    Of course when they ask you why you can explain to them that you are unhappy with their IT staff who knows absolutely nothing about how to run computers. Let them chew on that one for a while.

     

    Naming the bank across the street is always a good move.

     

    Holt the feet of the IT staff to the fire for a while and see if that changes anything.

     

    Whatever you do don't use any circumstance install any AV software on your Mac. All it will do is cause you problems.

     

    Allan

  • by joefromdoniphan,

    joefromdoniphan joefromdoniphan Aug 31, 2011 6:15 AM in response to babowa
    Level 1 (4 points)
    Notebooks
    Aug 31, 2011 6:15 AM in response to babowa

    They know I run a Mac. The attempt occured from a mobile site and I have not accessed that particular account from my MacBook Pro.

  • by babowa,

    babowa babowa Aug 31, 2011 9:22 AM in response to joefromdoniphan
    Level 7 (32,244 points)
    iPad
    Aug 31, 2011 9:22 AM in response to joefromdoniphan

    Not sure what you mean by mobile site - you still had to use a computer or iPad or iPhone (or some other device) to access the account.

     

    What I meant was that in the Windows world, it seems to be easy to blame the "other" computer because of all the malware, viruses, etc, etc and people will immediately fear it's theirs; my bank knows I use a Mac, but they are utterly incognizant about how it works - they simply assume that it works the same way as a Windows machine. Which it does not. And, I was told by another bank to get a "real" computer when I told them that I wasn't able to view my account because their website was not working with Firefox, Safari, or Chrome: "our site is best viewed with IE and we don't intend to change that".

     

    Based on my experiences, I tend not to believe any company which immediately blames my equipment without doing some troubleshooting of their own (and that includes any company, not just banks).

  • by WZZZ,

    WZZZ WZZZ Aug 31, 2011 10:07 AM in response to babowa
    Level 6 (13,112 points)
    Mac OS X
    Aug 31, 2011 10:07 AM in response to babowa
    babowa wrote: And, I was told by another bank to get a "real" computer when I told them that I wasn't able to view my account because their website was not working with Firefox, Safari, or Chrome: "our site is best viewed with IE and we don't intend to change that".

    Fool them next time with User Agent Switcher. And you can also download a huge list of User Agents here.

  • by joefromdoniphan,

    joefromdoniphan joefromdoniphan Aug 31, 2011 10:36 AM in response to babowa
    Level 1 (4 points)
    Notebooks
    Aug 31, 2011 10:36 AM in response to babowa

    Exactly their point. I did not use any mobile device BUT someone did. Anyway, Mac Support suggested "Mac Keeper" or "Norton". Mac Keeper has an available scan so I used it.

    They are now happy and I am reconnected to my accounts.

    I spent at least 4 hours on the phone and 1 1/2 hrs on the internet to fix this thing.

    Thanks for the advise. Yeah, lots of non-Mac savay IT people out there.

    Joe

  • by babowa,

    babowa babowa Aug 31, 2011 11:10 AM in response to joefromdoniphan
    Level 7 (32,244 points)
    iPad
    Aug 31, 2011 11:10 AM in response to joefromdoniphan

    So did the scan show anything? If it did, they were no doubt all Windows related and had absolutely nothing to do with your machine or what happened with your bank.

     

    And, FWIW, please do a search here in these forums for MacKeeper; after that, it would be best if you were to uninstall it (but you need to call them and/or follow their instructions). Personally, I wouldn't let that (soft)ware within a mile of one of my machines. And do yourself (and your Mac) a favor: do not install Norton's; it quite often causes enough havoc that it should be considered a virus.

  • by WZZZ,

    WZZZ WZZZ Aug 31, 2011 11:28 AM in response to joefromdoniphan
    Level 6 (13,112 points)
    Mac OS X
    Aug 31, 2011 11:28 AM in response to joefromdoniphan

    MacKeeper is worthless garbage that may harm your computer. It is close to being malware, itself. And the developer is completely unscrupulous. Uninstall it ASAP.

     

    Don't use their uninstaller. They force you to answer a question before it will proceed and it is possible it is then "phoning home" with your sensitive data to their offices both in CA and Russia. (~ means your home folder library.)

     

    These are the files to remove. But there may be others.

    • /Applications/MacKeeper.app
    • /Library/Application Support/MacKeeper
    • /Library/LaunchDaemons/com.zeobit.MacKeeper.AntiVirus
    • /Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon
    • /Library/Logs/MacKeeper.log
    • ~/Library/Caches/com.zeobit.MacKeeper
    • ~/Library/Caches/com.zeobit.MacKeeper.Helper
    • ~/Library/LaunchAgents/com.zeobit.MacKeeper.Helper
    • ~/Library/LaunchAgents/com.zeobit.MacKeeper.plugin.Backup.agent
    • ~/Library/Logs/MacKeeper.log
    • ~/Library/Preferences/com.zeobit.MacKeeper.plist
    • ~/Library/Preferences/com.zeobit.MacKeeper.Helper.plist

     

     

    Here's another list which may mostly be a duplication of the above.

     

    Applications/MacKeeper.app

     

    In the HD Library:

    - /Library/Application Support/MacKeeper

    - /Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon

    - /Library/LaunchDaemons/com.zeobit.MacKeeper.AntiVirus

     

    In your User Library:

    - /Users/yourname/Library/Preference/com.zeobit.MacKeeper.Helper.plist

    - /Users/yourname/Library/LaunchAgents/com.zeobit.MacKeeper.Helper

    - /Users/yourname/Library/Caches/com.zeobit.MacKeeper

    - /Users/yourname/Library/LaunchAgents/com.zeobit.MacKeeper.plugin.Backup.agent

    - /Users/yourname/Library/Preferences/com.zeobit.MacKeeper.plist

     

     

    When finished, get EasyFind and search for any remnants. Enter both "MacKeeper" and "Zeobit." Set EasyFind to scan all files, invisible, case insensitive, use phrase and boolean. You can use the Destroy function from the EF Menu, but some files will need to be deleted or moved to Trash using your admin password. For that, select the file and then Reveal in Finder.

     

    Also, open Keychain in Applications>Utilities and search for anything MacKeeper or Zeobit related there. It also installs a program called "Wine," which allows MacKeeper to run its Windows/PC written scamware AV scanner. Search for that and remove it.

     

    If the idiots at the bank keep insisting you use some kind of AV, get ClamXav. It won't do any harm to your computer.

     

     

    There are numerous threads here and elsewhere detailing the offenses of MacKeeper.

  • by joefromdoniphan,

    joefromdoniphan joefromdoniphan Aug 31, 2011 12:49 PM in response to babowa
    Level 1 (4 points)
    Notebooks
    Aug 31, 2011 12:49 PM in response to babowa

    The scan showed 2 "Critical" viruses, only removed 1, did not identify.

  • by joefromdoniphan,

    joefromdoniphan joefromdoniphan Aug 31, 2011 12:56 PM in response to WZZZ
    Level 1 (4 points)
    Notebooks
    Aug 31, 2011 12:56 PM in response to WZZZ

    Thanks for the detailed directions. I think I got it all cleared off.

    When I follow your likn to "EasyFind", I am presented with "Devonthink Pro Office 2.1.1", etc. Which one should I use?

    Again, many thanks to all. Issue seems to be cleared.

    Joe

  • by joefromdoniphan,

    joefromdoniphan joefromdoniphan Aug 31, 2011 1:03 PM in response to WZZZ
    Level 1 (4 points)
    Notebooks
    Aug 31, 2011 1:03 PM in response to WZZZ

    OK, I did a search on Google for "EasyFind for Mac" and came up with the program. Ran it and it found 6 more MacKeeper/zeobit" files. No "wine".

    Again, many thanks!

    Joe

  • by babowa,

    babowa babowa Aug 31, 2011 1:12 PM in response to joefromdoniphan
    Level 7 (32,244 points)
    iPad
    Aug 31, 2011 1:12 PM in response to joefromdoniphan

    Well, since there are no viruses for Mac currently, something that could affect Windows had parked itself there.

  • by MadMacs0,

    MadMacs0 MadMacs0 Aug 31, 2011 3:13 PM in response to WZZZ
    Level 5 (4,801 points)
    Aug 31, 2011 3:13 PM in response to WZZZ

    WZZZ wrote:

     

    It also installs a program called "Wine," which allows MacKeeper to run its Windows/PC written scamware AV scanner. Search for that and remove it.

    I read yesterday that the current MacKeeper now uses a Mac version of their AV scanner and therefore no longer requires wine.  That should make using it marginally less of a PITA.

  • by MadMacs0,

    MadMacs0 MadMacs0 Aug 31, 2011 3:16 PM in response to joefromdoniphan
    Level 5 (4,801 points)
    Aug 31, 2011 3:16 PM in response to joefromdoniphan

    joefromdoniphan wrote:

     

    found 6 more MacKeeper/zeobit" files.

    Just so we can update our lists, what were the names of those files and where were they located?

Page 1 Next