Help removing iworm trojan

Question

Level 1

0 points

Help removing iworm trojan

I just recently discovered I have the iworm trojan on my computer and I'm struggling to remove it. I was able to delete majority of the files except the Javaw file (Unix Executable File (32-bit)) because the trash says its currently still in use. My earliest time machine backup is from after the malware was installed. Is there any way for me to remove the trojan without completely wiping my hard drive and starting over? If I move my documents and folders onto an external hard drive, will they carry iworm with them when I reinstall them back on my computer?

Any insight would be appreciated! Thanks!

MacBook Pro (13-inch Mid 2012), OS X Yosemite (10.10)

Posted on Dec 16, 2014 8:50 PM

Reply

Answer 1

Kappy

Level 10

361,741 points

Dec 16, 2014 8:56 PM in response to becksontap

Helpful Links Regarding Malware Problems

If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, AdwareMedic, or Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support.

Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.

Reply

Answer 2

becksontap Author

Level 1

0 points

Dec 16, 2014 9:09 PM in response to Kappy

Thanks for the quick response, but I have tried all of these options previously, and I know the problem is the iworm trojan that was discovered in early October. Here is the file that I cannot delete because it says it is still running:

Reply

Answer 3

MadMacs0

Level 5

5,221 points

Dec 16, 2014 9:44 PM in response to becksontap

If it's in your Trash Can then simply reboot, it won't be running any more and you can empty the Trash.

Reply

Answer 4

Dec 16, 2014 9:55 PM in response to becksontap

http://www.thesafemac.com/iworm-method-of-infection-found/

Reply

Answer 5

becksontap Author

Level 1

0 points

Dec 17, 2014 9:10 AM in response to MadMacs0

Thank you! This worked! When I search all the specific folders in Finder that are said to have the iworm, it says "this file cannot be found"! Thanks for all of your help 🙂

Reply

Answer 6

thomas_r.

Level 7

31,989 points

Dec 17, 2014 3:52 PM in response to becksontap

Because iWorm included a back door, it is unknown what modifications may have been made to your computer between the time you were infected and now. For this reason, I don't recommend anything less than erasing the hard drive and reinstalling everything from scratch. See:

How to reinstall Mac OS X from scratch

Alternately, you could erase the hard drive and restore everything from a backup made prior to infection.

Also, note that the only known source for iWorm was the download of illegal software from Pirate Bay. If you have been engaging in this kind of activity, nothing will save you from future infections by something else.

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Reply