MacDefender trojan

I help Mark Allan, the developer of ClamXav, with tech support. He's also responsible for coding up clamav database signatures for the Mac OS X community. Currently, the database does not contain a signature for this as the AV community seems reluctant to share, so we must fend for ourselves and need your help. If you have any of the files associated with this would you please upload it to the clamav site and the VirusTotal community site.

TIA, -Al-

Lin Davis:

You did not mention authentication. How does an app get into the Applications folder and the Login Items without the user's password authority?

We've got what we need now, so expect database update shortly.

-Al-

MadMacs0 wrote:

We've got what we need now, so expect database update shortly.

-Al-

Big thanks to you and your ClamXav team, Clamd and ClamWin. 🙂

Great work Linc !! 😀

Wonder if the lady who answers the phone for a refund is named Doris?

Doris, Boris....a cat named Moris?

Is there a way slightly advanced users can block IP 69.50.214.53? 😀

Ok, found a relatively easy GUI way to block the IP.

Download NoobProof Firewall, skip the wizard.

http://www.hanynet.com/noobproof/

You'll end up with a screen with a BlackList button the left.

New window appears, on the right enter the IP you want to block, 69.50.214.53, OK

Mainscreen > Start Firewall.

Tools Menu > Install Startup Script

Warning, messing with Firewall settings can seriously undermine your computers security, cause it to not function correctly.

If you don't know, leave it alone. Look but don't touch. Read a book on the subject first.

Also this is no guarranty to block the malware, it only blocks all incoming connections from that IP address.

Add it to /etc/hosts

http://osxdaily.com/2007/03/19/block-access-to-specified-sites-by-modifying-etch osts/

For most users, no password is needed to install an application or add a Login Item. That is the root of my malware on a Mac is mostly paranoia. Just because you download and install a Trojan on a Mac doesn't mean your system is really compromised. The Trojan is like any other application. When you don't want it anymore, just delete it. It is only when you hand over your password that you need to be worried.

WZZZ wrote:

http://osxdaily.com/2007/03/19/block-access-to-specified-sites-by-modifying-etch osts/

Yes, a hosts file addition is another excellent level of protection.

I've been running a rather large one for many years.

This is my source

http://winhelp2002.mvps.org/hosts.txt

However the "127.0.0.1 local host" line must be first deleted (from this file only), and then all "127.0.0.1" instances changed to "0.0.0.0" for OS X to use it without side complications. Find and Replace in Text Edit works very well.

Once that's completed, then the dangerous part starts. Editing the actual /etc/hosts file.

Text Wrangler "Open File By Name" works rather easy: /etc/hosts

Next move, not to touch anything one see's in the file, rather add some returns to the bottom and copy/paste the contents of the modified Text Edit file.

Save and enter the Admin password and zillions of web garbage is automatically blocked.

However, that portion of the /etc/hosts file that one added needs to be updated time to time to stay on top of the nasties.

Block a line? add "#" to the front.

Block a site? "0.0.0.0 www.facebook.com"

Easy as that, good for the kids, until they find out about web proxies, but there's OpenDNS for that. 😉

Again, play careful, your on your own.

If you just boot into SafeBoot. By holding down Shift Key when restarting the machine.

Then go into Applications Folder > Choose MacDeFender.app > Move to Trash (In Safe Mode).

Then restart normally and then reset Safari.

It removes it and your fine.

WZZZ wrote:

Add it to /etc/hosts

http://osxdaily.com/2007/03/19/block-access-to-specified-sites-by-modifying-etch osts/

Actually, you can't block IP's in the /etc/hosts

What adding a "0.0.0.0 www.facebook.com" to the /etc/hosts file does is resolves the IP address of 0.0.0.0 (nothing) instead of the IP provided by your Domain Name Server (either your ISP or OpenDNS or GoogleDNS etc)

So if "www.facebook.com" IP is nothing, nothing is what your computer connects to.

It only works on Domains, not IP addresses.

The OS X Firewall can block IP addresses, but it's complicated to use for GUI fed types. 🙂

Thus I found WaterRoof and NoobProof, as other OS X GUI Firewall configs have fallen away somewhat.

For those who are interested, I have posted complete details on my experiences with this trojan here:

http://www.reedcorner.net/?p=82

I also included an excerpt from one of Linc's posts here, with his permission.

ds store wrote:

WZZZ wrote:

Add it to /etc/hosts

http://osxdaily.com/2007/03/19/block-access-to-specified-sites-by-modifying-etch osts/

Actually, you can't block IP's in the /etc/hosts

What adding a "0.0.0.0 www.facebook.com" to the /etc/hosts file does is resolves the IP address of 0.0.0.0 (nothing) instead of the IP provided by your Domain Name Server (either your ISP or OpenDNS or GoogleDNS etc)

So if "www.facebook.com" IP is nothing, nothing is what your computer connects to.

It only works on Domains, not IP addresses.

The OS X Firewall can block IP addresses, but it's complicated to use for GUI fed types. 🙂

Thus I found WaterRoof and NoobProof, as other OS X GUI Firewall configs have fallen away somewhat.

Yeah, thought of that after I posted. Too bad there isn't a usable domain name coming up for that IP.

Is that just a server that comes up with a whois for 69.50.214.53? What would the relationship be between that outfit registered in Phoenix and this malware author?

WZZZ wrote:

Is that just a server that comes up with a whois for 69.50.214.53? What would the relationship be between that outfit registered in Phoenix and this malware author?

Likely none, the host is legitiment, likely a compromised site/server.

Blocking the IP client side is probably a worthless effort at this time, they got the call.

I'm guessing this was a test run, could expect to see this thing get tweaked and hosted on many servers next time. 😟

Sure Apple is going to roll out a update here quick to stop this thing dead in it's tracks, even if it changes signature. 🙂