3

My father was lamenting how random ads will pop-up even with adblock and while browsing trusted websites and how Firefox was always on at startup on his OSX computer (with all software updates correctly on) since the day he installed it.

I naturally checked System Preferences > Users Accounts > Login items and on the Firefox dock icon Firefox > Open at login. Nothing was there...

So I moved to ~/Library/LaunchAgents where to my surprise I've found many files pointing to obvious viruses. For example, one files was named com.apple.roinnris.plist and was pointing to an executable which, in a Terminal window, behaved like this:

Last login: Mon Jun 26 18:36:28 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Library/roinnris ; exit;
1.3.4: Initializing... roinnris
http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=hp&type=YHS_TGE_5a01fc&_=tt1
http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=nt&type=YHS_TGE_5a01fc&_=tt1
http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=ds&type=TGE_5a01fc
snowbitt
_Bt3mBZUrWFiQtw-o265327tVlFLedwV5m3RbDQqoTNF34tnUYs4T2-Z-0Vh_ot2iQz9QcQstVbDfh_GhqMjQkak68EeUespftvJPjZ5LY1FbyK8tuMM
nth

convertFile - /Users/gianni/Library/backup.zip to /Users/gianni/Library/backup.tmp
Ping-"http://t.trkitok.com/track/surl?mid=C26849F2-0F50-5495-9FBB-9269DCE9EDA1&ht=???ڐ?????΄???????ބ??Dž?????????ؗ??????Č?ٗ?ӌ????????Η??????????????????ϗ?ڌ???ϗ?????????˚??Ɍ???ޛ????ڐ?????΄???????ބ??Dž?????????ؗ??????Č?ٗ?ӌ????????Η??????????????????ϗ?ތ???ϗ?????????˚??Ɍ???ޛ????ڐ?????΄???????ބ??Dž?????????ؗ??????Č?ٗ?ӌ????????Η??????????????????ϗ?ٌ???ϗ?????˚??ɠ???????ޠ??ޙ??????????݇Ř???????????????Ǚ????????왞????ٞ??????????ޘ??Г??????????????????????????????????????????????? ?&nt=&su="

Here's another one:

Last login: Mon Jun 26 18:28:48 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Library/sfhucvkzeooa/sfhucvkzeooa ; exit;
2017-06-26 18:33:10.535 sfhucvkzeooa[10383:98510] http://i.firstinstallmac.club/c/cc?id=
/bin/sh: line 50: /Library/pfutil: Permission denied

And another one (which was originally in Library but I moved to the desktop):

Last login: Mon Jun 26 18:33:10 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Desktop/VirusReportStackExchange/jaLeQGoJ/jaLeQGoJ.app/Contents/MacOS/jaLeQGoJ ; exit;
2017-06-26 18:34:37.327 jaLeQGoJ[12743:122843] Found it

And another one, with error messages in the user main language (italian):

Last login: Mon Jun 26 18:34:36 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Library/subtlist/subtlist ; exit;
2017-06-26 18:35:08.919 subtlist[13656:131528] gianni
2017-06-26 18:35:08.920 subtlist[13656:131528] V\(;-<<7,/$48:=6D\TN(&*:1:=."=$UV0)8!'%.+:<=-">$UV", 694,+?.M    D"1!$<*<!,8#6+'=*&<$D"?28?&<!!$9$
2017-06-26 18:35:08.921 subtlist[13656:131528] V\(;-<<7,/$48:=6D\TN(&*:1:=."=$UV0)8!'%.+:<=-">$UV", 694,+?.M    D"1!$<*<!,8#6+'=*&<$UD"?28?&<%6%?&07.M
                                                                     N('**-,0*'5&&!'6_
      N0>*<!,*,<7'.M
                    N('**-,!.8)6= .6_
N('**-,'"&<*'2&;$_"52 ?4;07.MN('**-,'*,&07.MN('**-, >)&07.M
                 V"52 ?4<+!<96_N0'8*',-*5512( $
2017-06-26 18:35:08.921 subtlist[13656:131528] (#-.<=,7$&80=.
2017-06-26 18:35:08.921 subtlist[13656:131528] (>*(10=6"/$
2017-06-26 18:35:08.921 subtlist[13656:131528] (#*9-76!($7?:46
2017-06-26 18:35:08.921 subtlist[13656:131528] (&8.+&&!'6
2017-06-26 18:35:08.921 subtlist[13656:131528] (19$.*6!4816!'%*4<.
2017-06-26 18:35:08.921 subtlist[13656:131528] (&8.+&24.%-$
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&6%.%-&:76
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&02''&,!?6
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&!68;67 66
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&& .9&,!?6
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&1:/6
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&'2,40=.
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-& &)40=.
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&':&.*-2>;6
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&6!9$+$
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&52'';8086
2017-06-26 18:35:08.922 subtlist[13656:131528] (&*4,+?.
2017-06-26 18:35:08.922 subtlist[13656:131528] \?   

\&&/
017-06-26 18:35:08.922 subtlist[13656:131528] \?    

\&&/
2017-06-26 18:35:08.922 subtlist[13656:131528] \?   

\&&/

2017-06-26 18:35:08.922 subtlist[13656:131528] \?   

\&&/

2017-06-26 18:35:08.922 subtlist[13656:131528] \?   

\&&/

2017-06-26 18:35:08.922 subtlist[13656:131528] \?   

\&&/
017-06-26 18:35:08.922 subtlist[13656:131528] \?    

\&&/



2017-06-26 18:35:08.924 subtlist[13656:131528] Invalid chrome version
2017-06-26 18:35:08.929 subtlist[13656:131528] 5a01fca9-d552-45e9-a47c-f34d2a14e626
2017-06-26 18:35:08.958 subtlist[13656:131528] C26849F2-0F50-5495-9FBB-9269DCE9EDA1
2017-06-26 18:35:08.958 subtlist[13656:131528] upd
2017-06-26 18:35:08.958 subtlist[13656:131528] 'http://www.google.com'
2017-06-26 18:35:08.958 subtlist[13656:131528] 99999999
2017-06-26 18:35:08.958 subtlist[13656:131528] http://loadingpages.me/jo/is?id=C26849F2-0F50-5495-9FBB-9269DCE9EDA1&d=5a01fca9-d552-45e9-a47c-f34d2a14e626&cl=upd
227:230: syntax error: Si attendeva fine linea ma è stato trovato proprietà. (-2741)
227:230: syntax error: Si attendeva fine linea ma è stato trovato proprietà. (-2741)

I then moved to the main Library (not the user one) at /Library/LaunchAgents and /Library/LaunchDaemon where there were more of these plist files pointing to sketchy executables, one of which was clearely turning Firefox on and trying to compress and steal a folder from it's ApplicationSupport space.

I nuked the contents of all these folders and instructed not to ever use the computer for banking until a full wipe will be done.

All of these files were at least 1 month old.

My questions are:

Are these viruses already known to Apple? If yes, where can I read more and why weren't they automatically removed with Security Updates? If not, who has more informations? Where am I supposed to notify Apple of the existance of these?

  • Which of the many questions is the first you want to attack? This reads more like a consulting engagement. Great work on the detail - that will help once we get clarity on which of the many topics to start with. Once you have an answer to the first, we can think about follow up questions. – bmike Jun 26 '17 at 17:33
  • Please add the system version! Also: malicious files are not meant to be executed in some suicidal manner! You may do this in a protected VM... Instead post the content of the launch daemon/agents' plist and upload the executable to virustotal or something similar. – klanomath Jun 26 '17 at 17:39
  • My question is just one really: which is Apple's policy in regards to this? If the answer is none, then I have multiple questions, which can be roughly summarized in "what the actual f--k?" and too many points to be attacked as a single problem. – Saturnix Jun 26 '17 at 17:44
  • Version is Sierra to the last update. Those files were already being executed and this computer is about to get nuked anyway. – Saturnix Jun 26 '17 at 17:48
1

Apple contact options are listed on https://www.apple.com/contact/. Security updates are providing patches to known security issues, they usually do not remove viruses/malware from an already infected systems.

With the suspicious files already gone there is no way to analyze what happened to your father's computer, so you may as well move ahead and reinstall everything from scratch. It's probably safest to use Internet Recovery to reduce the risk of restore from an infected Recovery Partition.

  • I still have most of the executables though. Forwarding them to Apple right now... hopefully I'll find the time to deassemble and analyze them. – Saturnix Jun 26 '17 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .