Infected Mac Air coming in today.

[Seth1968]

I've never worked on Mac before, but this is an unusual circumstance that I'm interested in. I'll probably be Googlin' most stuff, but if any one has any tips or suggestions, toss them my way:)

I just did a quick search and found Mac Rogemover, as well as some suggestions for an antivirus. I'm also concerned about the DNS and proxy.

BTW- It's used by a thirteen year old kid that's getting porn popups in Safari and Chrome.

[vengie]

When was the software last updated?

My macbook pro has been running flawlessly for years. Including porn websites, online movie and tv streaming, etc.

[mr2mike]

I thought ads were based on search history? :poosie:

Use a chrome add-on: ad remover. Reduces the pop ups.

Personally, with my older iMac, I setup an admin account and a regular account. I use the regular account 99%. When I need to update stuff, you log into your admin account and do the work. But I'd like to think it keeps the loading of bad malware at a lesser risk.

[Seth1968]

I don't have it yet.

I suspect he got the infection(s) from a fake Java or Flash update. it's one of those, I don't know what happened, I just turned on my computer and it was there:)

The only reason I'm doing it, is because it's a referral from a good friend, and I'm interested in checking out the disinfection procedure.

[Seth1968]

Originally posted by mr2mike


Use a chrome add-on: ad remover. Reduces the pop ups.

I was hoping AdwCleaner and Junkware Removal Tool had Mac versions, but that doesn't seem to be the case.

[revelations]

Run Sophos for Mac, or ESET perhaps (just dont install the real-time scanning as it will affect the integrity of OSX).

And updates - the only infected OSX system I've ever seen are the obsolete ones (no more updates) and the ones who dont update their latest systems.

[eblend]

Originally posted by vengie
When was the software last updated?

My macbook pro has been running flawlessly for years. Including porn websites, online movie and tv streaming, etc.

That's probably because you go to reputable sites, a kid will look all over the internet for their donkey porn or whatever they are into.

[Seth1968]

I'll first remove any malware from the programs, remove browser extensions, then run Eset. The more research I do on it, the more I find it's just like a Window's disinfection procedure.

I'm debating adding a real time antivirus, but if I do, it will be Sophos. Reason being, I don't want it to slow down the Mac, and antivirus programs are rather useless against most infections. I suspect it's that way, as they've become too afraid of lawsuits by blocking or removing what the customer basically gave permission for to be installed.

[blairtruck]

i must be reading this wrong. ive been told for years from mac fanboys that macs are better then pcs cause this doesn't happen to them.

[revelations]

^ He has ONE, OSX machine coming in after how many years in business??

[Seth1968]

Originally posted by revelations
^ He has ONE, OSX machine coming in after how many years in business??

First one in almost 20 years.

About 5% of my calls are for Apple computers, but not for infections on the system.

There is of course the popularity argument, in that since so few people use Macs, malware writers don't bother with them too much.

I wonder though, how many of infected Mac users just take it to a Mac store, instead of a generic computer repair shop? If that's the case that 5% could be significantly higher.

But no matter what type of system one uses, malware is mainly avoided by knowledge.

[Mitsu3000gt]

Originally posted by Seth1968

I wonder though, how many of infected Mac users just take it to a Mac store, instead of a generic computer repair shop? If that's the case that 5% could be significantly higher.
.

I know several MAC users who have got viruses, and that's what they did. I doubt many of them go to PC repair shops for stuff like that, but I could be wrong.

It's so easy to avoid Viruses, it's basically a non-issue these days for anyone with a shred of computer knowledge. Then there are those who click "OK" to every pop up blindly haha:)

[Seth1968]

Originally posted by blairtruck
i must be reading this wrong. ive been told for years from mac fanboys that macs are better then pcs cause this doesn't happen to them.

Apple had to remove / modify a statement on their site that said something like, "Apple computers don't get viruses".

About 5% of the population uses Macs, and low and behold, about 5% of calls are for Macs.

A Mac isn't some sort of magical computer that can't get infected. It's just that most malware coders ignore Macs, as it would mean doubling their coding time, but only increasing "profit" by a very small amount.

I suspect that Mac infections are mainly due to coders proving that they could infect an Apple system just as easily as a Window's system.

[01RedDX]

.

[Seth1968]

That's what I'm thinking as well. However, I'll still run Eset, as I'm curious to see if it picks up anything else (other than benign remnants).

A little more on the extensions though. I'm finding that more and more, malicious extensions won't allow you to disable or remove them. That's where AdwCleaner comes in, as it nukes them right at boot.

[Seth1968]

I got the Mac and there were so many browser re-directs that it was unusable for web surfing.

Nothing out of the ordinary in the application list.

Neither Chrome or Safari had any malicious extensions, search engines, or plugins. I then ran a Mac program called Adware Medic, and all the browser re-directs are gone.

Going to run Eset for kicks...

EDIT- DNS and the proxy were fine as well.

[Seth1968]

Eset claimed 36 objects detected. The few I glanced at were remnants, but I didn't nearly go through the whole log as it also showed hundreds of locked files mixed in the list.

All good now though:)

[firebane]

LOL this is a prime example of a user with too many rights or knowing the root/admin password. A general user should not be able to provide access to the filesystem such as this happening.

[Seth1968]

I've tried the standard user idea, and it didn't work well for residential customers. I would constantly get, "I'm trying to do (whatever), but the computer say's I'm not the Administrator.

So, I haven't done that in a long time. Rather I just explain to them how to avoid infections.

[Robin Goodfellow]

Originally posted by Seth1968

BTW- It's used by a thirteen year old kid that's getting porn popups in Safari and Chrome.

13 yr boy is getting porn popups, and you want to "fix" it?

WTF is wrong with you?

[Seth1968]

You don't need to have watched porn, to get porn popups or porn redirects.

In addition, despite what you may think, it's very common for a 13 year old boy to check out "naked chicks". 20 years ago, it was gold to find a Penthouse magazine. Now, they've got the internet.

Get over it.

[Robin Goodfellow]

Originally posted by Seth1968
You don't need to have watched porn, to get porn popups or porn redirects.

In addition, despite what you may think, it's very common for a 13 year old boy to check out "naked chicks". 20 years ago, it was gold to find a Penthouse magazine. Now, they've got the internet.

Get over it.

Seth1968, I suggest that if you're planning on coming between a preteen boy and his pictures of naked girls, things could get messy.

[Seth1968]

Originally posted by Robin Goodfellow


Seth1968, I suggest that if you're planning on coming between a preteen boy and his pictures of naked girls, things could get messy.

I don't know how you even came to that conclusion, other than assumption.

Yes, it's his computer, but his mother called and asked me to fix the pop up issue. She mentioned something about porn, but she doesn't speak English very well, so she may have been asking if it could be a result of porn.

As it turned out, there was no porn popups, and neither the cookies or history showed any porn. It was just a lot of browser re-directs to rogue software products.

Again however, there are many ways to get porn on a computer without ever intentionally going to a porn site.