Jacques Phaos

Q: After suspicion of a virus I erased the content of the drive and installed OS X Again. How can I restore a back-up from my time capsule without contaminating the drive again? Isn't the back up contaminated?

Hi guys,

 

I'm new here so I'm not sure if I'm at the right spot to ask this question (if I'm not let me know! ) but my situation is as following:

 

Two months ago I started noticing that my saved passwords (safari and preferences) and surf history would disappear from time to time. First I thought it's was a bug so I slightly payed attention to it and just planned to do a total clean up soon. Besides I secured all the important files on my computer and use different passwords for important websites. Even so I stopped saving the passwords right away.

 

A month ago I received an email from google that an android device (mobile phone) had logged in to my gmail account and had synchronized with it. Since I don't have an android device I was shocked. I tried tracking where the hack came from but my IP had been duplicated. I think the security of the router at my girlfriends house wasn't locked foolproof. Luckily I hardly use my gmail account (work) and have it linked to a hotmail account which is in turn linked to another work server email account so I was able to regain acces and change the password again to something new. I directly sharpen up my security, disk control, firewall, ad block plus, stealth-mode, upgrade to el capitan, installing two step authentication from an external device for important websites and changing all the passwords. Nothing happened ever since.

 

I just did a complete wipe out after backing up my drive with Time Machine and reinstalled El Capitan but I'm wondering:

 

- If the back up is contaminated?

- If I can restore the back-up without contaminating the drive again?

-  If I can restore the back up partly, by selection?

 

There are some important files in the latest back up that I would really like to retain. Too bad I forgot to think about this possibility before.

 

If you have any advice on this matter, I would love to hear it! Please help! Thank you in advance!

 

Jean-Jacques

MacBook Pro with Retina display, OS X El Capitan (10.11.6), 2.4 Ghz, 8Gb, Late 2013

Posted on Aug 22, 2016 5:58 AM

Close

Q: After suspicion of a virus I erased the content of the drive and installed OS X Again. How can I restore a back-up from my time ca ... more

  • All replies
  • Helpful answers

  • by Jacques Phaos,

    Jacques Phaos Jacques Phaos Aug 22, 2016 7:20 AM in response to Jacques Phaos
    Level 1 (4 points)
    Mac OS X
    Aug 22, 2016 7:20 AM in response to Jacques Phaos

    Since I'm not quite sure when it started I'm not sure which back up I could use otherwise. Is anyone familiar with this issue?

     

    Off-topic: Is it possible to edit a message after posting? I can't seem to find the editing button. Made a few funny typos in my post..  

     

    I hope someone is familiar with this problem, would be great to restore my files!!!

  • by JimmyCMPIT,Solvedanswer

    JimmyCMPIT JimmyCMPIT Aug 22, 2016 8:43 AM in response to Jacques Phaos
    Level 5 (6,802 points)
    Mac OS X
    Aug 22, 2016 8:43 AM in response to Jacques Phaos

    edits are possible for a few minutes, then the body of the post is committed and no longer editable.

     

    At the time of this writing there are no virus for the mac in the wild that have been reported by any reputable securities lab, but having an email hacked requires no special or undermining software, only circumventing the security of the account from a computer, any computer anywhere in the world connected to the internet.

     

    of you restored your entire drive and there was a corruption it's possible the corruption will still exist. If you have the data a more secure update from a "peace of mind" standpoint would be

    backup, remove the backup drive

    format the internal drive

    reinstall the OS from the original disks or Internet Recovery if your mac supports it (yours does)

    About OS X Recovery - Apple Support

    reinstall any 3rd party software from the developers website or the original media

    restore documents, photos, music and saved data from your backup, but exclude the applications from the backup for now.

     

    this does not suggest your computer is contaminated, it's simply one method to contain contamination if there was one in the event you restore the drive.

     

    [edit] no single method is ever fail-safe or fool proof.

  • by Kurt Lang,Helpful

    Kurt Lang Kurt Lang Aug 22, 2016 8:10 AM in response to Jacques Phaos
    Level 8 (37,659 points)
    Aug 22, 2016 8:10 AM in response to Jacques Phaos

    You have a 15 minute window to edit a post. After that, it's stuck that way for eternity, unless a host edits or removes it.

     

    You never had a virus. There has yet to be one that affects the Mac OS directly. The closest thing to that was Flashback, which did behave exactly like a virus (infection occurs with no user interaction). All you had to do was visit a compromised web site. But it wasn't an OS X virus, it was a Java virus that used one of the numerous flaws in Java as an end-around to get on the system. If you didn't have Java installed, it didn't work. It was also patched against years ago and is deader than a doornail.

     

    Can't say for certain Google doesn't do this, but I could find no reference that Google puts out such email notices.

     

    If there ever was anything on your Mac, then yes, it will be duplicated on the TM backup as far back as whatever it was got on the system. If you know there's a clean point that can still be restored, restore it from that date. All other personal data will have to be retrieved from TM manually. That I can't help with since I don't use TM for my backups.

  • by Jacques Phaos,

    Jacques Phaos Jacques Phaos Aug 22, 2016 8:10 AM in response to JimmyCMPIT
    Level 1 (4 points)
    Mac OS X
    Aug 22, 2016 8:10 AM in response to JimmyCMPIT

    Thanks for the response and advice Jimmy!

     

    I will restore the files and leave out the applications from the backup!

     

    You're right one can never be sure. I'll keep my security level high from now on!

  • by Jacques Phaos,

    Jacques Phaos Jacques Phaos Aug 22, 2016 8:45 AM in response to Kurt Lang
    Level 1 (4 points)
    Mac OS X
    Aug 22, 2016 8:45 AM in response to Kurt Lang

    Thanks for the advice and explanation Kurt!

     

    Will verify my message first the next time before I press send .

     

    I didn't specify what kind of virus I thought I had, but if I understand it correctly it was just a Java virus? I was still using Yosemite when it occurred. Other than the passwords and surf history disappearing my system works properly.

    Guess I just got a bit paranoid and thought the two events were somehow related. I'm really glad to hear they're probably not.

     

    Is there a proper tool to remove a Java virus you recommend? Just in case it was installed on my system way back without me having a clue and decides to pop up again.

     

    About the email:

    Google does most certainly send an email (see below) when you log into your mail for the first time using a new device. Kind of similar to FB when you log in from a variant (another country for instance) location. It's part of their security policy. I also received one when I logged in from my mac for the first time. You should test it, it's a lifesaver!

     

    Schermafbeelding 2016-08-22 om 17.24.40.png

  • by Kurt Lang,

    Kurt Lang Kurt Lang Aug 22, 2016 8:57 AM in response to Jacques Phaos
    Level 8 (37,659 points)
    Aug 22, 2016 8:57 AM in response to Jacques Phaos
    I didn't specify what kind of virus I thought I had, but if I understand it correctly it was just a Java virus?

    It would be impossible since the only Java virus ever known to affect OS X is long gone dead. I was just mentioning it as the only virus to ever have been able to attack OS X. Though it did it through Java. There's nothing to find or remove.

     

    "Virus" is a term often misused to mean any "bad software". The correct generic term is malware. Which is short for malicious software. This term means any software written to intentionally damage your system, steal passwords, etc. So malware refers to any:

     

    Virus: Any app that can replicate itself via direct access.

    Worm: Smarter than a virus. It doesn't need to be able to see a connected drive or use other direct sight methods to infect another device. Worms can actively find other devices across a network on their own.

    Trojan: Dumb apps which rely on the user to get on the system. YOU have to install it in some manner.

     

    Trojans account for almost 100% of active Mac malware.

    Google does most certainly sends an email…

    Didn't say they don't. I just couldn't (quickly) find a reference that they did.

  • by Jacques Phaos,

    Jacques Phaos Jacques Phaos Aug 22, 2016 10:44 AM in response to Kurt Lang
    Level 1 (4 points)
    Mac OS X
    Aug 22, 2016 10:44 AM in response to Kurt Lang

    Thanks again Kurt! I perfectly understand your message now.

     

    Come to think of it. Almost a year ago I downloaded the "cinch" app which enables window management. When I wanted to open it through finder half a year ago the file showed a different image. It had become a pack of Kellogg's special K cornflakes so that must have been it! I guess the damage was already done when I deleted it. Isn't it strange that disk recovery didn't help?

     

    Anyway thanks for helping me narrowing down the cause! I'll be more aware of Trojan from now on.