I got an email earlier today from my internet service provider telling me there's some sort of malware on one of the ips in my home, and it had asked me to download some antivirus software. The antivirus software listed links directly to Norton, McAfee, and AVG's websites.

I'm not sure if this email is fake, since I have never received virus warnings from my ISP before. But it says it has something to do with xcodeghost. I'm not sure what this is, but from looking online it has something to do with iOS/Mac deivces, yet the email is specifically asking me to look into a Windows machine.

I"m totally confused and have no idea what to do. Here's the snippet from my email:

Dear me,

AT&T has received information indicating that one or more devices using your Internet connection may be infected with malicious software. Internet traffic consistent with a malware infection (“xcodeghost”) was observed on Oct 12, 2015 at 5:00 AM EDT from the IP address xx.xx.xx.xx . Our records indicate that this IP address was assigned to you at this time.

Infected computers are often used as part of a zombie computer network (“botnet”). Botnets are networks of computers which have been infected with malware and placed under the control of a hacker or group of hackers. They are often used for attacks on websites, spamming, fraud, and distribution of additional malware.

Because malware is designed to run in secret, an infected computer may display no obvious symptoms.

To address this matter we ask that you take the following actions. If your computer(s) are managed by an Information Technology (IT) group at your place of work, please pass this information on to them. If you use a wireless network, an infected computer may be using your Internet connection without your knowledge. Ensure that your wireless router is password-protected and using WPA or WPA2 encryption (use WEP only if WPA is not available). Check the connections to the router and ensure that you recognize all connected devices. Ensure your firewall settings and anti-virus software are up-to-date, and install any necessary service packs or patches. Scan all systems for viruses and other malware. Additional tools and information:

Tools for removing rootkits, bots, and other crimeware: Norton Power Eraser: https://security.symantec.com/nbrt/npe.aspx (Windows) McAfee Rootkit Remover: http://www.mcafee.com/us/downloads/free-tools/rootkitremover.aspx (Windows) Tools for general virus and malware removal: Microsoft Safety & Security Center: http://www.microsoft.com/security/ (Windows) Malwarebytes Anti-Malware: http://malwarebytes.org/ (Windows, Android) Spybot +AV: http://www.safer-networking.org/ (Windows) OS X Gatekeeper: http://support.apple.com/kb/HT5290 (OS X) AT&T Malware and Network Security analysts gather weekly to give you the information that you need to know about the latest security news and trends. Visit AT&T ThreatTraq at http://techchannel.att.com/showpage.cfm?ThreatTraq

Type: xcodeghost Source port: 53105 Destination port: 80

I have numerous amounts of windows and ios devices at home so I have no idea where to start.

  • My little Sunday-school-teacher and public music teacher sister was approached by the police about her supposed side business of selling stolen computers. They interviewed her last, and were laughing at the whole thing because everybody they talked to about her had laughed at them. The police provided her with tech support to remove whatever was relaying through her computer. Maybe the ISP can help you with a remedy? – SDsolar May 18 '17 at 8:33

If you have the ability to intercept traffic with wireshark I would look for any devices communicating via ports 53105/80. This will help you narrow down the infected devices.

Once you have the devices that are infected you can run netstat on those devices (or similar 'apps' on iOS) to find out what app has that particular open connection.

Finally remove all traces of said application.


As @broadway points out the ports are likely the negotiated ports of the session and may change. However still with wireshark it seems you have another method to find the initial infected device.

According to sans xcodeghost will make a HTTP POST request with some pretty standard fields. You can filter down your wireshark capture to only HTTP POSTS and then search for common fields such as language or country. This will likely give you a manageable amount of data to manually search that will lead you to the infected device.

If you use this method you will also conviently enough find in that same POST request the following data:

  • Application name
  • Application version
  • OS version
  • Language
  • Country
  • Developer info
  • Application installation type
  • Device name
  • Device type
| improve this answer | |
  • unfortunately, the source port is probably going to be different each time the infected app contacts its command and control server, so that won't necessarily narrow things down too much. It would have been extremely helpful if at&t provided the ip address it was contacting instead of only the source and destination port. – broadway Oct 15 '15 at 8:10
  • The post data is encrypted before being posted (des ecb mode). However, the OP can probably look for traffic to init.crash-analytics[.]com, init.icloud-diagnostics[.]com, or init.icloud-analysis[.]com – broadway Oct 15 '15 at 18:10

It'll be one of your ios devices. I'd review the list of applications in the paloalto research report on xcode ghost and see if any of them line up with applications you have installed on one of your ios devices, and uninstall the infected app.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.