Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have been receiving warnings from my internet provider for a month now. This is part of the latest e-mail sent to me.

"CenturyLink Security Services has received notification about malicious traffic originating from this account. This means that this computer or another computer on your network is trying to infect, attack, or gain unauthorized access to other computers on the Internet.

This malicious traffic has been determined to be an instance of the "Mebroot" or "Torpig" virus.

Computers infected with bots are considered compromised hosts. They may be used to send spam (also called Unsolicited Bulk Email, or UBE), scan other computers for vulnerabilities, take advantage of security holes, and/or be used as part of Distributed Denial of Service (DDoS) attacks. These programs also allow computers used by attackers or spammers to hide their identity and location. These bots are often spread by viruses or worms."

I have changed the password 6 times. I even went to my mac store only to have them tell me that what CenturyLink says is impossible. This morning I ran a first aid "verify permissions" and found the following on my "Fugi... and HD options

Warning: SUID file "usr/sbin/vpnd" has been modified and will not be repaired.

ACL found but not expected on "Applications/Utilities".

I am at my wit's end on this matter. Is there anything I can do to fix the problem?

share|improve this question
    
How are you connected to the Internet? Please include details of your router/modem configuration. If you are using an AirPort, you can identify all connected clients. If there's someone on there that shouldn't be, you'll be able to see them. Additionally, those malware components cannot infect Macs. So contact your ISP directly and tell them you are running OS X, not Windows. They should be able to look into the matter further. The ACL errors can safely be ignored. –  cksum Oct 9 '11 at 20:49
    
In addition to cksum's questions, are you wireless or wired to your router? I agree with looking at the DHCP list of all connected clients. –  bg2011 Oct 9 '11 at 20:52
1  
Any computer on your network could be causing this. Are there any Windows computers on your network? Also, be sure to change your WiFi password. –  Nathan Greenstein Dec 11 '11 at 21:30

1 Answer 1

The malware may be transmissible by macs, it's uncertain. Regardless, you might, in addition to checking DHCP:

  • Ensure that your search domains in Directory Utility are not set to "Automatic", which will leave you open to rogue DHCP servers on your network.

  • Consider arpsniff or ArpSpyX or some modern equivalent. Those rogues would gain access possibly via ARP poisoning ( google that)

  • Little Snitch or some other application firewall would be useful here as well.

  • Turn off Xgrid, in fact, turn off sharing unless you are using it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.