Safari quits - plugin related

Pebey wrote:

Intego sent me three lines to run in Terminal, which are supposed to repair the malware:

rm ~/.MacOSX/environment.plist

rm "/Users/petermork/Library/Application Support/.PowerArchiverRC.tmp"

rm /Users/Shared/.libgmalloc.dylib

Will this work, in your opinion?

It will probably remove the malware and the symptoms, but it will not repair the damage it has already done. It has probably injected all your web browsers with code designed to "sniff out usernames and passwords that you enter into many popular sites (like banking sites, Google, PayPal, and others), presumably so that the malfeasants behind the software can exploit that information in other nefarious ways." And that's just what we know it will do. You will have to replace all of your network applications from original source (mostly browsers and skype according to what Iomega told me today) and change the passwords of every popular site you have visited in the last ten days or so along with other sites where you have used the same username/password combination.

Since we don't really know all it's capable of, Linc's previous recommendation to erase the drive, reinstall the OS and applications, then restore user data from backup is still your best choice.

Hi Pebey, can you also upload it to Virus Total as well.

https://www.virustotal.com/

Thanks

Oh also,

Are the infected Machines being targeted only older systems that do not have XProtect?

If the Window that pops up is fake it most likely is hiding an installer in the background which is a behavior seen in the past from this set of criminals. Previous versions used a Decoy PDF.

http://mcaf.ee/t0xar

What we need to find out from Intego is this Certificate Window is just a Decoy, an image in a window of the APPLET, that hides an installer. (The sample I have with is reported to be Version.G is all about deception, nothing was real nor did it work on updated systems. Thanks for toggling the memory switch MadMacs0.) Thus Turning off "Open Safe Files" especially for older Macs without XProtect seems to be an excellent recommendation.

Intego had to update the information about this once so lets hope that they do again to let everyone know if inFact the certificate is a decoy like back in Sept, 2011.

Thanks

The normal interface with VirusTotal is through the submission of individual original files either uploaded to the site or submitted through e-mail to scan@virustotal.com. You then receive a report back of the scan results. The file should be exactly as downloaded or installed, without changing the name of the file or compressing it in any manner. The size limit is 32MB. It is not clear whether they have a capability to manually process the files in the manner you are trying to submit them or not. Most of the site is fully automated.

Details on mail submission is can be found at https://www.virustotal.com/documentation/email-submissions/

Pebey wrote:

Well, I'm doing what drStrangepORk asked (I think) which is to send the log posted above to VirusTotal - not the actual file, which I can't access.

Actually, you can access them if they are still on the hard drive they are just hidden. Unfortunately I need to rush off and don't have time to walk you through that. Perhaps somebody else can jump in here.

Looks like everybody else has abondoned us on this one. Do you still have those original files on your hard drive or did you run those rm commands that Iomega gave you already?

Pebey wrote:

PS Here is what I sent to Phillipe from Intego, after narrowing down the source of the infection to a specific site:

I checked the page and can find no trace of a Java applet now, but it looks like the web site has definitely been busy dispensing Trojans http://www.google.com/safebrowsing/diagnostic?site=vegweb.com.

The IP address is not one of the ones I knew of being reportedly associated with FlashBack, but it's not that hard to move servers around the globe. It does not appear to be functioning at this time, but that's not unusual either. If they are using Twitter to receive reports as was mentioned, they really only need it up when they are serving the Trojan files. There is little information available about the ownership http://whois.domaintools.com/95.215.63.38, but Spain looks to be correct. Doesn't really matter as it could be anywhere.