Hot answers tagged

24

You can follow these instructions from F-Secure to uninstall/remove the malware: Run the following command in Terminal: defaults read /Applications/Safari.app/Contents/Info LSEnvironment Take note of the value, DYLD_INSERT_LIBRARIES Proceed to step 8 if you got the following error message: "The domain/default pair of ...


19

Web browsing The largest potential danger comes from the "Internet". My mac is online most of it's operating time and web browsers are among the most used applications on my Mac. Therefore, the most important rules are: surf the web carefully don't just download any software you find Browser choice The browser choices, configurations and extensions ...


17

This message is the case when either: Your device is enrolled under MDM and after deployment it will display something like image below.(https://www.apple.com/iphone/business/it/management.html) Your passcode is too obvious and needs to be changed Microsoft Exchange can force a passcode on your iPhone. Obvious codes start with the following numbers: ...


17

The best thing you can do is creating a new admin user and inspecting the assaulted main user/the system. Boot to Recovery Mode (hold cmdR while booting). Unlock and mount the main encrypted volume either with Disk Utility or Terminal: #list all CoreStorage items diskutil cs list #unlock the locked Logical Volume (replace lvUUID by the UUID found above. ...


10

Your first point ("Kept up with OS X system patches") is probably the most important. If you trace the history of exploits on OS X, most have come from: Java Flash PDFs Safari Giving privileges to unknown apps or clicking on unknown links I'm not a security expert, but it seems like limiting your exposure to those things will decrease your exposure ...


9

Flashback Checker This is for your relatives and friends that want to avoid using the Terminal. Download this free app from Github. As referenced in this Macworld article, the single-function app will quickly check your machine for the infection. The app doesn't remove the malware, which will be left up to the user by manually following the instructions ...


9

Go to Settings app > General > Profiles Delete any configuration profile that you don't want to keep, then delete any that control passcode. If Profiles is not near the end of the list (below VPN and above Reset >) then you may have no profiles and can continue to the next step. Next, go to Settings app -> Passcode enter your passcode, turn passcode ...


8

That is more or less it. I also like to run potentially unsafe stuff in a VM of some kind (I use Parallels, but for this the free VirtualBox works well enough); Parallels 7 can automatically install a virtual Mac image from the Lion recovery image, which is very convenient for this kind of sandboxing. (Yes, running Lion in a VM is now legal.)


7

Sadly, malicious code can be so small and obfuscated in an infinite number of ways so you can't simply make a rule to test a package to tell if it's good or bad. Statistically, people have established some guidelines like trying to know the source (typing in the web address directly and not trusting a link, not downloading it from an alternate site, ...


7

I'm fairly certain the green light is hard-wired to the camera, there's no way to activate the camera without activating the light, precisely for privacy reasons. If you're really concerned about it, you can always just use a piece of electrical tape to cover the camera (or fold a piece of cardboard over the top of the lid for a non-sticky solution). ...


7

You haven't got malware on your iPad. To extract zip files, you need a third-party app and this app's data will be contained within the sandbox of that app.


6

It's extremely unlikely to be malware as the Hazel program is a reputable utility that automates file actions by extending spotlight and file change detection systems of OS X. It does exist as a System Preference panel, so you could easily miss it's footprint on disk if it were not for the menu bar icon. You can get updated versions and uninstall info from ...


6

You can disable the XProtect updates in System Preferences => Security => General, and there uncheck the box "Automatically update safe downloads list." Now you can change the version info in /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist


6

From Wikipedia: The Trojan [FlashBack] targets a Java vulnerability on Mac OS X. The system is infected after the user is redirected to a compromised bogus site, where JavaScript code causes an applet containing an exploit to load. An executable file is saved on the local machine, which is used to download and run malicious code from a remote ...


6

Presently there aren't any known Viruses for iOS. The security exploit that you mentioned, the PDF exploit and the TIFF image exploit before it, were patched shortly after the exploit was made public. Is it impossible for a virus to sneak through? Absolutely not, though if you're running the most recent iOS release the chances you'll get a virus or have ...


5

It appears the site is distributing malware. If you opened the page on your computer you should first install a good antivirus/antimalware program, try Sophos which is good and free. If it was on your iPad (as your tag suggests) there's probably a bit less cause for alarm as there is currently no known virus which can infect an iPad. Next it's probably a ...


5

The simple way is to boot to recovery mode and use disk utility to first erase the "Macintosh HD" partition, then start the installer. No need to zero the drive since you won't be recovering any deleted files at this point. A verified correct installer of Lion will then get downloaded from the Internet. Here is a guide for you... OSX Recovery OS X ...


5

There are a couple easy ways to identify the trojan in it's current form (aside from downloading directly from Adobe or using AV software): The trojan is an installer package that opens with Installer.app, the real installer is an application (it doesn't use Installer.app). When run, the trojan installer looks like the screenshot of the trojan installer ...


5

Your search for the origin of this sound may progress on 2 paths: which application produces it and which sound is it. Which application? Here is an easy way to control if this sound is coming from a standard screen capture. Type the following command twice: ls -lu /usr/bin/screencapture First, whenever you want. Next time, just after you heard the ...


5

That is because the Dock process isn’t getting enough resources and/or is crashing. TheDock process is not just responsible for your Dock, but also Mission Control, Launchpad, Dashboard and the Desktop background. If this happens most frequently during periods of heavy use, then it is not getting enough resources or its resources are being swapped to disk. ...


5

AppSC is malware. Download, install and run the free app Malwarebytes Anti-Malware for Mac. It will detect it and you will be asked to remove it (and some other potentially installed malware). If you can't download/install the anti-malware app because everything is sluggish, you have to move or remove the responsible plist file(s) in ...


4

After some deep investigations we come to the preliminary conclusion that the culprit wasn't any malware but an unhappy coincidence involving org.macosforge.xquartz.startx.plist, .bashrc and an xrd --merge ~/.Xdefaults command. Since all those files were deleted, we don't have hard evidence though. Said .bashrc is derived from a (Linux-)precursor. It was ...


4

You can check for malware and also make sure that you don't have some known adware installed: https://support.apple.com/kb/HT203987 The second link is quite long, so feel free to point out one line or a paragraph that don't make sense if you need a hand digesting it and then implementing the fixes. I've also checked into http://www.thesafemac.com/arg/ ...


4

Admin Alert is related to Dell KACE, an "appliance-based approach to systems management", and the admin alert icon appearing in the dock is apparently a bug.


4

I left Charles (web proxy debugger) running and waited for the re-direct again. I found the site that is originating the request to sponsor.adverstitial.com, it is ad.cpmaxads.com. A request to that site goes out, then it brings back a lot of shady looking javascript/HTML mix with this in the middle: {var ...


4

It fixes the vulnerability that Flashback used to install itself; this Gizmodo article gives some more info to check: 1. Run the following command in Terminal: defaults read /Applications/Safari.app/Contents/Info LSEnvironment 2. Take note of the value, DYLD_INSERT_LIBRARIES 3. Proceed to step 8 if you got the following error message: "The domain/default ...


4

It looks like /usr/libexec/oah/translate is Rosetta, an Apple program to allow programs developed for PowerPC architecture to run on the newest Intel Mac. So I don't think it's a malware, just Mac OS using Rosetta to run Entourage.


4

If your device is not jailbroken the odds of malware on iOS are basically 0, at least for what you're describing. There is currently no way anything could be installed without going through the App Store. Even then, a malicious app could only access its own files in its own sandbox. So, no installed app on iOS could modify anything outside of it. This is ...


4

I get these messages when I connect to the China Unicom network. I think the "Cancel/Accept" dialog is hardcoded into iOS for the purpose of accepting the carrier's terms of use. These messages come from the sim card, and I think only the carrier can send them. It's sleazy for the carrier to use this functionality for advertising.


4

Kaspersky's removal tool ...checks if your Mac is affected and removes the trojan if necessary. You can download it on http://support.kaspersky.com/downloads/utils/flashfake_removal_tool.zip Check online using your UUID You can check if you Mac is affected using your UUID (Universally unique identifier) on http://flashbackcheck.com/ Go to: ...



Only top voted, non community-wiki answers of a minimum length are eligible