Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

I ran an avast antivirus scan on my iMac because it was running slowly (I thought possibly cos it had avast installed anyway!) It reported that I have an infection with what it describes as an HTML:Bankfraud-BRO(Trj)

The infection is reported as

.Spotlight-V100/Store-V2/4A387C06-4BBA-43C0-96F4-CF61C65E524C/Cache/0000/0000/00 14/1373591.txt


Can anyone tell me if this is an infection and what to do about it?

I tried to isolate it in the avast antivirus chest as a precaution but received an error code and was unable to do so

iMac, OS X Mountain Lion (10.8.5), Avast antivirus reports infection

Posted on Sep 17, 2013 2:38 PM

Reply
6 replies

Sep 17, 2013 2:56 PM in response to milesfromnorwich

I have just Googled this and all the indications are that it is malware. Frankly, I am not digging any deeper for my own security but hopefully you will receive good advice shortly.

Meanwhile here is some practical reading.


Amongst the most authoritative tips and suggestions, the following links will help.Thomas' Corner : Mac Malware Guide and ...

Mac OS X Snow Leopard and malware detection

And yet more, this time from Klaus1.

Viruses, Trojans, Malware - and other aspects of Internet Security: Apple Support Communities

Sep 17, 2013 3:26 PM in response to milesfromnorwich

With a quick search it appears to be a Windows Trojan for Phishing. The reason that Avast cannot quaranteen it is probably due to its location in the Spotlight cache which requires root access to change that directory.


The filemust have been present somewhere else in the file system for Soptlight to index it, it is surprising that Avast did not find that file.


You may be able to remove that entry from Spotlight by reindexing your disk drive, this will slow the system down while it reindexes.


However Seventy Ones suggestions are well worth persuing to confirm that nothing else is atteched to the file.


Info:-

http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Tr oj~BkFraud-A.aspx


http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=PWS %3AHTML%2FBankfraud#tab=2

Sep 17, 2013 6:20 PM in response to milesfromnorwich

It's not malware. If it's anything at all, it's the indexed text of a fraudulent email message.

"Avast" is perhaps the worst of the whole wretched lot of commercial "security" products for the Mac. It's worse than the imaginary "viruses" you were worried about when you installed it. Not only does it fail to protect you, it throws false warnings, destabilizes and slows down your computer, and sometimes or always corrupts the network settings and the permissions of files in your home folder. Removing it may not repair all the damage, and neither will Disk Utility or even reinstalling OS X.

Back up all data, then remove "Avast" according to the developer's instructions. Reboot.

If you tried to remove Avast by dragging an application to the Trash, you'll have to reinstall it and follow the instructions linked above.

If you still have problems after following those instructions, post again.

Sep 18, 2013 6:40 AM in response to milesfromnorwich

Do your own research. See whether you can find a single report anywhere that "Avast" has ever saved anyone from an OS X malware infection. Also see whether you can find any reports that it has caused false warnings, system corruption, kernel panics, application crashes, networking failures, slowdowns, and the like. Draw your own conclusions.

I ran an avast antivirus scan on my iMac because it was running slowly (I thought possibly cos it had avast installed anyway!) It reported that I have an infection with what it describes as an HTML:Bankfraud-BRO(Trj)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.