Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

5 points

iMac (OSX 10.10.2) infected with Win.Trojan.Graftorr-1897 and Heuristics.Physhing.Email.SpoofedDomain

I have recently received a few spams so I decided, just in case, to scan my iMac with a free AppStore ClamXav tool. The result was disappointing. Apparently I have a few (8 !) corrupted files:

What should I do now ? - Leave the files where they are as they might - perhaps - be some old files from my previous Win computer. My OS X (10.10.2) and Safari (8.0.4) are up todate.

Your advice will be appreciated.

iMac (27-inch Mid 2010), OS X Yosemite (10.10.2), Final Cut Pro

Posted on Mar 18, 2015 11:59 AM

19 replies

kriscena Author

Level 1

5 points

Mar 19, 2015 6:28 AM in response to MadMacs0

"The first four can safely be deleted by using a right-click/<Control>-click on the file or infection name and choosing "Delete File".

The first "four" ? (from the list at then beginning of this thread). Or just first "three" ? - Kindly please clarify.

After reading advice fromf all Contributors my working conclusion is to leave the 8 offending files where they are without any intervention. Perhaps with the exception of the first "four" or "three" :-)

"I hasten to point out that the same scan engine used in ClamXav is included in every copy of the OS X Server that Apple sells."

In return Apple had to offer a shelf in the AppStore for ClamXav ? :-)

It was most educational to read your opinions and I am sure other readers gained a lot from your experience.

Thanks and regards -

Kris

kriscena Author

Level 1

5 points

Mar 19, 2015 7:36 AM in response to thomas_r.

"In your case, these are probably all e-mail messages or attachments. (I'd bet the three "click here.html" files identified as Graftor are probably attachments to the three e-mail messages identified as Graftor.) MadMacs0 has posted excellent instructions for how to find and remove these from within Mail."

Would you recommend that I delete them (3 "click here" and 3 "Graftor") ?

Warm regards - Kris