virus and trojan.wimad found on HD Help!

Question

virus and trojan.wimad found on HD Help!

I went to a website and got served up an ad saying my computer had spyware on it and suggested I download a product. I didn't. Instead, I updated Norton virus defs and scanned my machine. Low and behold Norton found 3: Summary : Repair was enabled : Infections were found : The scan completed
Rare Recording.wma
Macintosh HD/Users/Vin/Shared/
The file contains the macro or PC virus Trojan.Wimad.
10065D92.exe
Macintosh HD/private/tmp/e6-49190796-a08e9-Z6IHkn/
The file contains the macro or PC virus Downloader.Trojan.
but norton did not , or said it could not clean/fix them . Does "repair was enabled" mean everything's okay? anyone have any idea what I should do ? I havent' noticed anything wrong with computer but dont want to risk it. Should I use Onyx? any suggestions would be greatly appreciated.

PowerBook G4, Mac OS X (10.4)

Posted on Nov 11, 2008 6:59 AM

Reply

Answer 1

arnie

Level 5

4,065 points

Nov 11, 2008 12:08 PM in response to Vincent Webster

what kind of Norton (version etc?)

.exe files cannot run on PowerMacs, it's Windows files

better not to install any extra junk on the machine, since most of it is useless

http://www.securemac.com/

Reply

Answer 2

Network 23

Level 6

12,351 points

Nov 11, 2008 12:14 PM in response to Vincent Webster

There does not seem to be any threat to your Mac at all.

Clue #1: It is a .wma file, Windows Media.
Clue #2: The virus name ends in .exe
Clue #3: Norton reported it as a "PC virus"

From those clues, we can conclude that this is a virus that only runs on Windows. It cannot run on Mac OS X, except inside Windows running inside a virtual machine like Parallels or VMWare. If you're not doing that, the virus is essentially not Mac-compatible.

The only threat is if you sent this file to a Windows user, you could infect them, so you can be a carrier. But your Mac is not at risk.

I haven't used Norton in a while, but I think it had options where you could go over that file again individually and should be able to deal with it somehow if you really want to have it removed.

Reply