Virus on my macbook

I went to school the other day and the computers there detected a virus on my flash drive. I came home got Norton and scanned the computer. It found about 3 instances of some form of "hacktool." At the same time my computer had been running really slowly, and laggy. After this subsequent find my computer ran like normal, but it has come back. I get the warning at school the computer starts running slow, then I do a full system scan and it finds 3 instances. I just removed all of the program access rights from the firewall, I have sharing off... Not sure what else could be causing reinfection. Thankfully it's a mac, so i'm a vector rather than a victim... but its really annoying that my computer starts running like crap.

Macbook, Mac OS X (10.5.5)

Posted on Oct 29, 2008 8:50 AM

Reply
21 replies

Oct 29, 2008 9:38 AM in response to pikeymick

from my experiences, when a computer starts to run slow or act maliciously, the viruses are active. I not have a salution to your problem because I do not have enough experience on mac. I will say that you are probably a victim to the virus. Just my assumption. The virus IS affecting your MacBook by making it run slow. If it was on windows, I would tell you to buy spyware doctor because demos don't work. However, I have not seen a legit program that works on maC. Sorry I do not have a definite answer though.

Oct 29, 2008 10:34 AM in response to pikeymick

pickey--
Welcome to Apple Discussions!

Seriously, you don't have anything to worry about with "hacktool."
If you've been using Norton on your Mac, that could very well be your entire problem right there.

Did you used to use PeeCee's?
Because even though there may be technically a virus on your Mac,
it can't open, unless you specifically give it permission by entering your Admin Password first.

Can you give us more info on your "slowness" problem?

Oct 29, 2008 10:43 AM in response to TildeBee

~Bee wrote:
pickey--
Welcome to Apple Discussions!

Seriously, you don't have anything to worry about with "hacktool."


Yes he does. Why is it getting into his computer in the first place and secondly the rootkit may be propagating via his Mac even though he is just a "carrier." It is a problem.

If you've been using Norton on your Mac, that could very well be your entire problem right there.

What?
Did you used to use PeeCee's?

He's on a school network. Anything can happen on a school network.

Message was edited by: nerowolfe

Oct 29, 2008 11:50 AM in response to nerowolfe

Well I'm 29 and going back to school. I live in my own place, but when i go to school i carry documents on a flash drive. Which has now twice been found with a virus on it by the school computers. My computer becomes slowed down, I presume, when the virus becomes active over the network as unix/linux systems are great carriers for an infection point for any computers on a network with windows computers. I need to find a way to ensure that I have removed the source of the virus, and or blocked its route for re-infection, if anyone has any ideas.

Oct 29, 2008 12:34 PM in response to pikeymick

pikeymick wrote:
Well I'm 29 and going back to school. I live in my own place, but when i go to school i carry documents on a flash drive. Which has now twice been found with a virus on it by the school computers. My computer becomes slowed down, I presume, when the virus becomes active over the network as unix/linux systems are great carriers for an infection point for any computers on a network with windows computers. I need to find a way to ensure that I have removed the source of the virus, and or blocked its route for re-infection, if anyone has any ideas.


When you connect to the school LAN, be sure to set your firewall to not allow all incoming connections. Turn off all sharing.

You should also install "LittleSnitch" to see what's going on under the hood.
Also run the Activity Monitor and see what programs are running and from where.
Some malware can morph into a different format/name etc and hide from some A/V programs.
My guess is that you have not removed it or that your firewall/security settings are too loose.

Oct 29, 2008 12:48 PM in response to pikeymick

I think it is safe to say that we need more information, if you have or can get it. What exact type of virus are you being warned about?

Are you running Windows on your Mac by any chance? You could have a Windows virus that is causing problems.

Do you have any anti-virus software on your computer? If not, you might want to consider it. I haven't been terribly impressed with any of the offerings on the market from Intego or Symantec, although Symantec is definitely better in my book. Another alternative comes from the makers of Avast! Antivirus...they have a Macintosh version of their product. I tried an early preview release and thought it looked promising at the time.

To get this cleaned up, you might need to scan your computer's disk from a known clean machine so all the problems can be removed when they are not active. This does carry some risk of transferring the virus, but it can work better than trying to battle a "live" virus when it's in your software and doesn't want to let go.

If you find that the so-called "hacktool" you have picked up is a member of a software family known as a "rootkit", well, it's time to erase your computer, reinstall your software from trusted media (that isn't infested) and restore your data files after making sure they are not infested. Rootkits are (typically) malicious programs that go to great lengths to conceal themselves by patching the operating system to hide their presence. You may never be able to completely remove one once you have it.

Oct 29, 2008 6:08 PM in response to UnexpectedBill

OK. I do have a version in windows server running in parallels, I'm in the process of uninstalling that (although I've never really used it). I'm not connected to the school LAN, ever. I live on my own, and the only contact I have with the school LAN is via flash drives plugged in the schools Windows machines. I'm running the latest Symantec Norton Anti-Virus, and the only information it gives me is Hacktool. I used to build and IT pc's, and have removed a ton of viruses, but I've never dealt with anything of that scope on OS X.

Norton only tells me, "QuarantineFile.qtn" detected then in the status screen is says Type "Hacktool." This version of norton is crap as far as disseminating information to the user.

Oct 30, 2008 8:44 AM in response to pikeymick

Hacktool--after spending time looking around on the Symantec site--appears to be a Windows-specific rootkit or virus depending upon what variant you might have.

Which version of Norton Anti-Virus do you have--are you running it with Windows or Mac OS X?

I would not rule out the possibility of a false positive. You might try restoring the file from Quarantine and seeing what its real name is. False positives do happen--I've struggled with this recently with Symantec Corporate Anti-Virus 10 for Windows, which developed a sudden bad habit of tagging a distributed computing program as a virus.

Nov 3, 2008 12:31 PM in response to UnexpectedBill

It's the new NAV, and I don't have any windows installed on the machine, so it would have to be running on OS X. I would be inclined to agree with you on the false positive, except when my computer starts running crappy I do a manual virus scan, it finds something, the computer then runs fine after it is cleaned. The file it finds it in is usually image.php. Because of the significant change in performance I had ruled out a false positive, additionally the windows computers that detect a virus on the flash drive wouldn't also be giving me a false positive. They are on a different network, different OS, different Anti-Virus. Nothing makes sense so far, solution wise.

So for the record this is the situation:
-computers at school detect virus on flash drives when transferring files
-Computers at school are not on the same network as my Mac
-Computers at school are Windows
-I am not running any variant of windows in any shape or form
-I am running the current Norton Anti Virus
-Computer becomes very laggy which prompts to run NAV which detecs a virus, after deleting file (etc) computer runs normally again
-My computer (mac) is never on any network related to the school, they don't have an open network. No wireless, not jacks, nada.
-The virus seems to be propagating/existing within php code within websites that are stored on my computer
-I have no idea how it functions to slow down my computer
-It may be gone

Nov 3, 2008 4:49 PM in response to pikeymick

Take a look at this thread:

http://www.computing.net/answers/mac/hacktool-virus/10972.html


Specifically post number 27 which reads:

All:

+To anyone who is experiencing crashing/hanging+
problems:

+This is NOT because you are infected with anything! NAV+
+is trying to inappropriately remove/"quarantine" your+
+swapfile, and that action itself is what is causing the+
+issues. You are virtually guaranteed to get a hard freeze+
+or kernel panic if the swapfile is tampered with.+

+Symantec released new virus definitions yesterday to clear+
+up this confirmed issue with the previous version of the+
+definitions. You are NOT infected; it was NAV itself that+
+was giving this false positive, and trying to remove the+
+swapfile is what was causing the issue.+

I'd agree...if Norton is trying to remove a Swapfile that had code that bore a similarity to a virus, then your computer is likely going to crash.

Anyway...read through the entire thread...

Bob

Nov 4, 2008 10:45 AM in response to Bob Gold

I installed Norton after these symptoms presented themselves. I ran it, it found something, deleted it, and then I removed Norton. Two weeks later it happened again. Same exact process. Computers at school detect virus on my _+*FLASH DRIVE*+_, computer starts lagging. I install NAV again, it finds something deletes it, computer runs like normal. This same process is continuing. The computer runs, then becomes laggy, I run NAV it finds something, removes it, computer runs normal again. I don't mean to be rude, but I'm looking for solutions that don't not point to NAV. Solutions that take all symptoms into consideration. I understand there is a precedence with OS X being invulnerable, and also with NAV causing problems, everyone knows it's a system hog. But those options don't fit this scenario. I was previously running Clam, it doesn't have real time protection, and I found it to be lacking in protection. Although I run it on every server I've managed.

Nov 4, 2008 10:49 AM in response to pikeymick

Additionally the detected virus is now always in my timemachine backup on a separate drive. If I turn wireless off the computer then runs fine. So it's definitely something that's working over the network... but I can't seem to nail down exactly what it is. I've posted previously that I reset all my firewall settings, so only a specific few programs have access.

If someone with Unix experience has any idea other than NAV, and that it can't be what it looks like, I'm all ears.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Virus on my macbook

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.