1

I'm helping out a friend who thinks they may have malware on their machine. I don't know what kind or to what extent, so I don't want to boot into the system. My question is:

  • Is there a good boot time anti-malware like Avira Rescue Kit (which won't seem to boot on a Mac)?
  • Or, should I boot into the recovery partition, and run Malwarebytes?

Thanks

  • 1
    Does your friend have a backup? Wiping and reinstalling is often the fastest and best fix. Also, disconnecting from the network neuters most malware enough to connect a drive and make a new backup / capture any user changes since the last backup. – bmike Oct 18 '15 at 16:48
  • No, they don't have a recent backup. Obviously I don't want to make a new backup now because it could be infected. – quackrabbit Oct 18 '15 at 17:01
  • The nice thing is even if the backup is "infected" - it's often trivial to only copy over documents. OS X doesn't tend to get spreading ills - and once you disable the one bad actor, you're usually done with cleanup. – bmike Oct 18 '15 at 17:47
  • Right but, I don't have a backup. I don't even know what the bad actor is of if it exists. Any other machine I would just boot from a linux disk and run malware bytes/avira. Is this not a viable solution for macs? – quackrabbit Oct 18 '15 at 18:08
  • Sure - boot to recovery and install a clean OS onto an external USB drive and then run what you wish. The tips and tricks you learned securing other OS may not apply so well on OS X, but you accomplish that if you wish. – bmike Oct 18 '15 at 18:37
1

Malwarebytes is at best terribly ineffective from my experience. Why do you suspect a rootkit? I don't think you're wrong, possibly very perceptive but just wondering why.

The problem with rootkits is they will hide all evidence of their existence especially from a rickety Malwarebytes scan. Mac malware creators must be sophisticated enough to jump some of the small hurdles Apple attempts to create so keep that in mind in terms of the persistence factor at play.

What makes you think that the malware won't go hide in your NVRAM, xartstorage (secure enclave, graphics card, SMC, create a RAMDisk, etc. to make you think that it's gone and that Recovery Mode really is an almighty kill switch and isn't just a pacifier that effectively negates all legitimate and acceptable levels suspicion.

macOS (previously styled OS X) is inherently insecure. "It just works" is not the befitting of a truly secure operating system. In which case "I expletive hate it," would probably be more likely. Focus groups probably would have found that didn't go have quite the same cachet.

To assess the potential of this type of malware:

  • Open terminal and type cat /dev/ and paste the results if you wish.
  • When you reinstall the OS in Recovery, look for an process called "unknown" the the install logs (Command L and then be sure to select the option in the top left corner to show all progress and errors).
  • You could also enable kernel debugging and read the kextlog shown as your OS boots. In full disclosure this does require a high level of modest effort so it's perfectly acceptable and possibly most productive to dismiss the possibility of a root-kit in advance.
  • Obtain a copy of the entire disk with all volumes and mount it read only to a Windows VM then try various malware scans.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .