Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am running NOD32 on a Mac running Leopard 10.5.8. When I visited a website, NOD32 automatically detected it as a virus. For some reason I was taken to bing.com and I got a "page not found" error. Was this attack blocked or what? Upon further investigation, I looked into the history NOD32 had collected and multiple attacks were blocked -- some of them were even Trojans.

I ran a scan of just the Firefox folder and no virus was found using NOD32.

2/26/12 9:28:29 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/A/11/405BFd01 HTML/ScrInject.B.Gen virus deleted mycomputername Event occurred during an attempt to access the file by the application: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker. 2/26/12 9:25:41 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/A/11/405BFd01 HTML/ScrInject.B.Gen virus deleted - quarantined mycomputername Event occurred on a new file created by the application: /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox. 2/26/12 9:25:25 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/1/DD/0E3D8d01 HTML/ScrInject.B.Gen virus deleted mycomputername Event occurred during an attempt to access the file by the application: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker. 2/26/12 9:25:24 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/1/DD/0E3D8d01 HTML/ScrInject.B.Gen virus deleted - quarantined mycomputername Event occurred on a new file created by the application: /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox. 2/26/12 9:25:10 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/E/91/48C25d01 HTML/ScrInject.B.Gen virus unable to clean mycomputername Event occurred during an attempt to access the file by the application: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker. 2/26/12 9:25:09 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/E/91/48C25d01 HTML/ScrInject.B.Gen virus unable to clean mycomputername Event occurred on a new file created by the application: /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox.

share|improve this question
    
In ANY case you'd better disable your java plugin in all your browsers, it can only do harm. –  Shadok Feb 27 '12 at 16:46
    
This is too localised, referring to a specific incident - which doesn't really work well on Stack Exchange. –  Rory Alsop Feb 27 '12 at 16:57
add comment

closed as too localized by Rory Alsop Feb 27 '12 at 16:54

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 2 down vote accepted

There is no evidence here that the machine was compromised.

This is your web browser accessing some pages that had exploits on, and consequently saving them to the standard browser cache. The AV caught and prevented the file storage, generating the alerts in the process.

The thing is, these alerts, and indeed the AV behaviour in general, are pretty useless:

  1. If your browser and any web-visible plugins are up-to-date and not susceptible to the exploits in question, you weren't in any danger in the first place.

  2. If your browser or plugins were susceptible to the exploits, you got compromised regardless of the AV blocking storage to the cache.

(Chances are that even if you were vulnerable in principle, the exploits probably only had payloads targeting Windows. There are cross-platform sploits, usually based on platform-independent plugin weaknesses, but they're not yet that common.)

So, yeah, I wouldn't re-install based only on the evidence above. But no-one can guarantee that you weren't compromised by something else that the AV didn't detect. AV is of diminishing reliability today and is wrong as often as it's right.

share|improve this answer
    
Well if the attack was meant for a windows and i am on a mac. I believe they are no known viruses for the Mac. So i think i am safe. My new scan for the entire computer is still running. I haven't noticed anything fishy going on either. So thanks. –  Sam Khan Feb 27 '12 at 12:14
    
Also, i realized that the firefox version i was running was version 7 while 10.2 is current. So i upgraded to that. Not sure how i missed it. –  Sam Khan Feb 27 '12 at 12:25
3  
There certainly is malware for the Mac. It's less common and AV is generally poor at detecting it. As usual the best advice is to keep both the browser and any plugins you actively use up to date (and remove any you don't—many machines are loaded down with Java, Acrobat and media player plugins that will never be used), rather than relying on the last-ditch effort that is anti-virus. –  bobince Feb 27 '12 at 12:53
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.