Want to highlight a helpful answer? Upvote!
Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >
Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >
Under Change Desktop Background,
I see this:
This started a couple days ago... any ideas?
Thanks
iMac, Mac OS X (10.6.8)
Did a quick search and this is what came up.
Your iMac might be infected with the Flashback trojan. Read here:
https://discussions.apple.com/thread/3752739?answerId=17653729022#17653729022
and here:
https://discussions.apple.com/thread/3751572?tstart=0
more here:
Some say that installing and using Sophos might remove it.
C.Hobbes wrote:
This started a couple days ago... any ideas?
You have been infected by the Flashback-G Trojan described by Intego Flashback Mac Trojan Horse Infections Increasing with New Variant. Most of what we know about it is described in that article. Although Intego says there software will remove it, that was not completely true as late as yesterday, but if you are able to remove all the files they mention it does stop the problems you observed. Since it injects code into some of your applications and probably installed a back door for future explotiation most are advising that you make sure you have a backup of all your data, reformat the drive, reinstall your Mac OS X, restore your date from backup and install fresh applications. Since there is a good chance that at least one of your passwords has been compromised, if you use the same one for multiple accounts, you should probably change them.
Courtesy of Macworld:
You can check by launching Terminal (in /Applications/Utilities/) pasting in the code below and pressing Return:
ls -a /Users/Shared/.*.so
If the response you see in Terminal includes “No such file or directory,” you’re in the clear. If you instead see a list of one or more files with a .so extension and no “no such file” declaration, you almost certainly have fallen victim to the malware.
Past versions of this Trojan were installed by a fake web site telling you that your FlashPlayer needed to be updated, but no user infected by this version recalls having done so. If you have any idea of what websites you visited just before you noticed the numbers, let us know. It would also help to know if your Java is up-to-date or if you remember approving a certificate as described in the Intego article.
When I right click on desktop...
