Has my Mac been compromised? [closed]

Question

I am running NOD32 on a Mac running Leopard 10.5.8. When I visited a website, NOD32 automatically detected it as a virus. For some reason I was taken to bing.com and I got a "page not found" error. Was this attack blocked or what? Upon further investigation, I looked into the history NOD32 had collected and multiple attacks were blocked -- some of them were even Trojans.

I ran a scan of just the Firefox folder and no virus was found using NOD32.

2/26/12 9:28:29 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/A/11/405BFd01 HTML/ScrInject.B.Gen virus deleted mycomputername Event occurred during an attempt to access the file by the application: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker. 2/26/12 9:25:41 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/A/11/405BFd01 HTML/ScrInject.B.Gen virus deleted - quarantined mycomputername Event occurred on a new file created by the application: /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox. 2/26/12 9:25:25 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/1/DD/0E3D8d01 HTML/ScrInject.B.Gen virus deleted mycomputername Event occurred during an attempt to access the file by the application: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker. 2/26/12 9:25:24 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/1/DD/0E3D8d01 HTML/ScrInject.B.Gen virus deleted - quarantined mycomputername Event occurred on a new file created by the application: /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox. 2/26/12 9:25:10 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/E/91/48C25d01 HTML/ScrInject.B.Gen virus unable to clean mycomputername Event occurred during an attempt to access the file by the application: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker. 2/26/12 9:25:09 PM Kernel access control file /Users/mycomputername/Library/Caches/Firefox/Profiles/80kcg6jj.default/Cache/E/91/48C25d01 HTML/ScrInject.B.Gen virus unable to clean mycomputername Event occurred on a new file created by the application: /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox.

Answer 1

There is no evidence here that the machine was compromised.

This is your web browser accessing some pages that had exploits on, and consequently saving them to the standard browser cache. The AV caught and prevented the file storage, generating the alerts in the process.

The thing is, these alerts, and indeed the AV behaviour in general, are pretty useless:

1. If your browser and any web-visible plugins are up-to-date and not susceptible to the exploits in question, you weren't in any danger in the first place.

2. If your browser or plugins were susceptible to the exploits, you got compromised regardless of the AV blocking storage to the cache.

(Chances are that even if you were vulnerable in principle, the exploits probably only had payloads targeting Windows. There are cross-platform sploits, usually based on platform-independent plugin weaknesses, but they're not yet that common.)

So, yeah, I wouldn't re-install based only on the evidence above. But no-one can guarantee that you weren't compromised by something else that the AV didn't detect. AV is of diminishing reliability today and is wrong as often as it's right.