0

I have a question regarding PHP Trojans on a Mac. I have downloaded a website's home directory which has been hacked to my local Mac. On this Mac I am running Kaspersky Internet Security which ran a check on the downloaded folder and it indicated that there were 3 PHP trojans (Trojan.PHP.Agent.pg) in this folder.

My understanding is, that the PHP Trojan can only be harmful to a system, if it can be executed. Therefore:

  1. Can my MacBook interpret the PHP code and actually get harmed?
  2. If not, is Kaspersky just warning me due to pattern matching? Would it therefore also warn me for Windows Maleware - or is it just one common database and they do not differentiate which operating system one is using?
1

The files are only dangerous if they are executed by a PHP engine. Until then, they are just a bunch of letters in a text document. Your MacBook didn't come with one preinstalled, so unless you (or something) installed one there should be none. Still, there is always a risk of some accident, so I wouldn't keep malware lying around, just in case.

So why does the antivirus program warn you? Because the files are dangerous! What if a user uploads them to a PHP server, feeling safe in the knowledge that the antivirus gave them a clean bill of health? Same thing with Windows malware on a Mac - what if someone transfers it to a Windows machine?

The antivirus has no idea of your intentions or what will be done with the files in the future. So it takes no risks and warns you of all malicious files it detects, even if they are not an immediate threat. Technically, a handgranade is only dangerous if you remove the spring... still, I would be nervous around one.

1

PHP being a scripted language needs to be interpreted and run by the script interpreter.

Its like downloading a malicious VBScript or bash script, until you execute it, by passing the script to the interpreter, it remains benign.

Can you provide more details as to what the AV detects? It usually gives a value like Trojan.WXYZ which then links to a website where more information is included.

Caveats: This is assuming there isn't another exploit at work, for example the windows exploit where a malicious .lnk file would be executed simply by viewing it in explorer.

  • The AV detects: Trojan.PHP.Agent.pg however I don't get any more information of it. – Tom Apr 4 '18 at 23:55
  • Tried googling that but couldn't find a description of what it is, only a reference that its a code used by Kaspersky, which Im assuming is the AV you use. As Anders also states, its only dangerous if executed, and you arent running a php server on your laptop so you should be good. If you want you can upload the files and I can tell you for sure, but at this point I'm fairly certain youre at no real risk. – beecey Apr 7 '18 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.