So, a funny thing just happened.
I have my (personal) mac connected to the wired enterprise network and have for several months. Today, a couple of guys from IT came busting through the door saying that they were seeing a malware threat from a computer hardwired to the network that matched my computer's device name. Fair enough, let's take a look, I said.
Here's where I'm confused...
- The MAC addresses (their reported threat and my computer) didn't match.
- The malware they were seeing is
win.trojan netwiredrc variant keepalive1
- I ran malware-bytes for mac and it didn't turn up anything
- I run AVG antivirus constantly to try to prevent things such as this
My questions are:
- Does this trojan even affect Macs?
- At the time they said they saw the report, I was running a Citrix instance to an application that is also hosted by my organization (the same IT group). Could this virtual machine have the above trojan? If so, would this explain why the MAC addresses didn't match but it still showed up as my computer name?
- Is this a false positive? If so, how do I convince the IT department of that so they'll allow me to connect to the wired network again?
Thanks in advance.
UPDATE (9/11/18): Over a year has passed and this issue happened again with the same result. AVG scan with no issues, malware bytes scan with no issues. The same trojan identified.
Can someone tell me the nuts and bolts of how these trojans are identified on a network scanner? In other words, are is it looking for particular packets of information being passed through or patterns of activity.