infection in ~Library/Application Support/Mobilesync/Backup/xxxxx

Question

ClamX is finding phishing infection in the Backup folder on my MacBook Pro with 10.7.

~Library/Application Support/Mobilesync/Backup/xxxxxxxx

Does this mean that either my iPhone or Mac is infected?

I realize I can delete these files, but is that enough?

What's the risk and what's the resolution?

Answer 1

It does not mean that your Mac or iPhone is infected and you should not delete the file.

From Wikipedia:

Phishing is the act of attempting to acquire information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing emails may contain links to websites that are infected with malware. Phishing is typically carried out by e-mail spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one.

So ClamAV has found a spoofed email stored somewhere in your iPhone Backup. Unless you clicked on the the links in the email, that's no problem.

However, if you delete the file, you will break the backup of your iPhone.

The best solution is to either:

1. tell ClamAV not to scan the folder; or
2. tell iTunes to encrypt your iPhone backups so that ClamAV won't be able to scan them.

Answer 2

My Sophos Anti-Virus v8.0.13C, engine 3.42.10 just warned me about the exact same location (and an additional subfolder) on my MacBook Pro 10.8.3.

I am also running ClamXav (v. latest) which did not(yet?) detect it. Both apps run automated, and this is the first threat I am aware of. My iPhone backups were already set to encrypted.

com.sophos.intercheck: 2013-04-27 17:05:24 -0700 Threat: 'Berserker-A' detected in  /Users/USERNAME/Library/Application Support/MobileSync/Backup/26f9c2d0793adf2cc3580dbb0ea9fa6656fa48ce/Snapshot/462db712aa8d833ff164035c1244726c477891bd com.sophos.intercheck:                              Access to the file denied com.sophos.intercheck:  com.sophos.intercheck: 2013-04-27 17:06:08 -0700 Threat: 'Berserker-A' detected in  /Users/USERNAME/Library/Application Support/MobileSync/Backup/26f9c2d0793adf2cc3580dbb0ea9fa6656fa48ce/462db712aa8d833ff164035c1244726c477891bd com.sophos.intercheck:                              Access to the file denied

Sophos app said "see website for manual removal" then said nothing of the sort on the site. The app removal instructions on the site apparently do not correspond to MY Sophos, which I thought was the latest.

I manually entered the folder and could NOT find the "Snapshot" subfolder from the first warning. I deleted the folder mentioned, before I saw info here. I wasn't concerned about the backup, as I can easily make a new one now.