iMac what to do from safe start after virus

eamon12 wrote:

I have used ClamXav to clean up which it did and sent files to the trash where I safely deleted.

For fastest, most efficient answers to questions such as this, please visit the ClamXav Forum.

eamon12 wrote:

I have recently had my computer compromised by " uk companies house" virus attached in a zip.

I am familiar with all currently known malware that can impact OS X and none of them have a name anywhere close to that. A thorough Google search of the Internet shows it to be Windows only, so unless you are running Windows on your Mac, it is not the cause of your current problem.

have used ClamXav to clean up which it did and sent files to the trash where I safely deleted.

I see some of them were e-mails which should not have been sent to trash, so once you get your computer working again you will need to rebuild all your Mailboxes to repair corruption of one or more mailbox indexes.

I have also found that when I was looking through the deleted files in trash it contained a file which was on a work PC only - this was connected via google drive to the mac. Would the virus have crossed the network? Would the virus have affected the seagate storage?

All this is possible, but there is almost no PC malware that can impact OS X, so again, unless you run Windows on your Mac they are not an issue for you.

I have 'grabbed' a screen shot of the trash files before it was deleted, it had files like win.trojan.dowloader, HTML.phishing.bank, heuristic.phishing.email, win.trojan.citadel, trojan.generic.bredolab-2 .

The two with "win" in the name are definitely Windows only.

There are 1289 signatures containing "HTML.Phishing.Bank-" followed by a number so I can't tell you much about it. Just that it was either an HTML formatted e-mail or from your browser cache that was positively identified as containing a "phishing" attempt to harvest privacy information from you.

The Heuristic one was an e-mail from a financial institution that contains something suspicious. Again I would need to know the exact spelling of the infection name (including capitalization) to give you any details, but it was not a positive identification and would need to be read in order to determine whether it was something important to you that simply contained something formatted suspiciously or was an actual phishing attempt.

I'll get back to you on that last one as it will take some digging, but again it's certainly not a threat to OS X.

eamon12 wrote:

I did look up the virus which says it is only PC, and says it is the cryotolocker - but I also know it has crashed the mac, so it must do something.

There is no cryptolocker for Mac, only a fake one that is a simple javascript that makes you think your hard drive is encrypted and locked. It's easily defeated. If you got the PC version and tried to open it, nothing at all would happen. The crash was probably just a coinsidence, but we would need to see the crash report to have any idea what could have caused it.

The only pc software I have is microsoft office suite.

I'm guessing you have Microsoft Office for the Mac, which is not PC software. In order to run Windows software you would have to have Windows installed, either in Bootcamp or some sort of Virtual environment. I'm pretty sure that isn't the case.

Whtat do you recommend I do from the 'safe mode' to get full access back./ many thanks agin.

Make sure you have a complete backup of all your important user data.

Download and install the last OS X Combo update you are using, either 10.4.9 or 10.5.8.

eamon12 wrote:

I have tried uploading pic with no luck

You need to upload the file by clicking on the camera icon in the toolbar.

here is the filenames

I think you must have typed those names rather than copy and paste since Apple Mail files are .emlx not .emix, so that takes care of sixteen of the files.

tax report.xls.exe is a Windows application disquised as an Excel spread sheet. I'm guessing that the two tax report.zip files are compressed versions of the same file.

No ideas on what appliamces online, TRPB_1_525630276 and Gift_Certificate_231.... are. After all, file names are easily changed, so it doesn't make much difference what they are currently named. The most important thing to know is the exact infection name, then where it is located and lastly the file name. Next time this happens, use the following procedure before taking any action on files you need more info on:

To get detailed infomation on what ClamXav has found, click in the top pane of the ClamXav window showing the Infection / File Name / Status to make sure it's in front and press the command and A keys, then command and c (or choose "Select-All", "Copy" from the "Edit" menu) to copy the information to your clipboard, then come back here and type command and V or choose "Paste" to show us what was found where.

There are a couple of ways to get the same information from the scan log, but they are more difficult and probably not worth the effort at this point.

eamon12 wrote:

trojan.generic.bredolab-2

There are 1019 "bredolab" signatures (most labeled win) and three Trojan.Generic.Bredolab. Can't tell exactly when they were added to the database, but best guess is some time in 2011, so not new.

An example of what has been submitted to VirusTotal can be seen here and note that most other A-V scanners identify it as Windows.

A long list of 4639 samples that were submitted to VirScan.org are here. Note that most have an .exe file extension which make them a Windows executable.

I think it's more than safe to say this is not Mac malware of any kind.

eamon12 wrote:

I have tried repairing permissions on safe mode but this did not work!!!

Should work. What did you observe? Doesn't sound like a permissions problem in any case, but boot from the installation disk and try it from there. While you are there run repair disk.

Here's a summary of what you need to do: Copy a line of text from this web page into the window of another application. Wait for the script to run. It usually takes a couple of minutes. Then paste the results, which will have been copied automatically, back into a reply on this page. The sequence is: copy, paste, wait, paste again. Details follow.

4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply.

6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in your browser, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s:\n\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -q XML\|exec && echo $f; done; }; Pc () { o=`grep -v '^ *#' "$2"`; Pm "$1"; }; Pm () { [[ "$o" ]] && o=`sed '/^ *$/d; s/^ */ /' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id | grep -qw '80(admin)'; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed '8!d;s/^ *//'; o=`SP Hardware | awk '/Mem/{print $2}'`; o=$((o<4?o:0)); Ps "Memory (GB)"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; o=`SP USB | sed -n '1d; /:$/{s/ *:$//;x;s/\n//p;}; /V.*[(]/{s/^[^(]*/ /;H;}; /Apple/{s/.//g;h;}'`; Pm "USB"; o=`pmset -g therm | sed 's/^.*CP/CP/'`; egrep -q 'No th|pms' <<< "$o" && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; grep -q '= [^GO]' <<< "$o" || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; d=(/ ""); D=(System User); for i in 0 1; do o=`cd ${d[$i]}L*/L*/Dia* && ls | awk -F_ '!/ag$/{$NF=a[split($NF,a,".")]; print}' | tail`; Pm "${D[$i]} diagnostics"; done; o=`syslog -F bsd -k Sender kernel -k Message CReq 'GPU |hfs: Ru|I/O e|n Cause: -|NVDA\(|pagin|SATA W|ssert|timed? ?o' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); o=${s[2]}%; Ps "CPU usage by process \"$s\" with UID ${s[1]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); s[2]=${s[2]%[+-]}; o=$((s[2]>=25000?s[2]:0)); Ps "Mach ports used by process \"$s\" with UID ${s[1]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|post[fg]|x)/{print $3}'`; Pm "Extrinsic system jobs"; o=`launchctl list | sed 1d | awk '!/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | grep -v com\.apple\.CSConfig | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/Star*; do M; done`; Pm "Startup items"; o=`find -L /S*/L*/E* {/,}L*/{A*d,Compon,Ex,In,Keyb,Mail,P*P,Qu*T,Scripti,Servi,Spo}* -type d -name Contents -prune | while read d; do ID=$($PB\ :CFBundleIdentifier "$d/Info.plist") || ID="No bundle ID"; egrep -qv "^com\.apple\.[^x]|Accusys|ArcMSR|ATTO|HDPro|HighPoint|driver\.stex|hp-fax|\.hpio|JMicron|microsoft\.MDI|print|SoftRAID" <<< $ID && printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; o=`find -L /u*/{,*/}lib -type f | while read f; do file -b "$f" | grep -qw shared && ! codesign -v "$f" && echo $f; done`; Pm "Unsigned shared libraries"; o=`launchctl getenv DYLD_INSERT_LIBRARIES`; Pm "Inserted libraries"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; Ps "DNS"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; Pc "hosts" <(grep -v 'host *$' /etc/hosts); Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed 's/\..*$//;s/-[1-9]$//'; o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \) | wc -l`; Ps "Restricted user files"; cd; o=`SP Fonts | egrep "Valid: N|Duplicate: Y" | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-

exec sh

If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know your password, or if you prefer not to enter it, just press return three times at the password prompt.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that takes administrator privileges.

The test may take up to a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line "[Process completed]" to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report your results. No harm will be done.

8. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If it happens, please post the test results on Pastebin, then post a link here to the page you created.

Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

________________________________

The graphics processor has failed and must be replaced.

Make a "Genius" appointment at an Apple Store, or go to another authorized service provider.

Back up all data on the internal drive(s) before you hand over your computer to anyone. There are ways to back up a computer that isn't fully functional — ask if you need guidance.

If privacy is a concern, erase the data partition(s) with the option to write zeros* (do this only if you have at least two complete, independent backups, and you know how to restore to an empty drive from any of them.) Don’t erase the recovery partition, if present.

Keeping your confidential data secure during hardware repair

Apple also recommends that you deauthorize a device in the iTunes Store before having it serviced.

*An SSD doesn't need to be zeroed.