0

The main thing i am interested in is the 3rd point below.

In short I am worried about having a virus and what will suffice to remove it.

I am on Mac and am running the latest version of Catalina. I do a lot of stuff on the command line using iTerm2 as an emulator and fish as the shell. As a package manager i use homebrew.

The problem: my shell stopped recognizing commands like ls, brew, locate, ... added slashes to the end of directory names and changed my prompt to @HUAWEI (wtf). All this happened without any direct interaction on my side. I found nothing like this online.

What i did prior to the problem occurring: I updated and upgraded homebrew (more than one day before), I installed the cisco anyconnect client (one day before) and I downloaded a pdf from an untrustworthy page (about 7 hours before).

Here is what i wonder about: 1) Does this sound like a virus to you? 2) If it were/is a virus - is it usually enough to reinstall macos from recovery or reformat the drive and then reinstalling? 3) What about the iCloud backup. After i reinstalled would i not just redownload any infected files from the cloud.

How should i deal with this in general? I.e. when are viruses in backups a problem?

I am well aware that this is very context specific.

Improve this question
1
  • A likely candidate is the Cisco AnyConnect software. It is possible it has connected you to the office. You could try typing "exit" at the command prompt to see if you get your own machine. You might also check your .bash_profile (or its equivalent with "fish") to see if there are changes that may account for the situation.
    – newyork10023
    Commented Mar 6, 2020 at 19:22

1 Answer 1

Reset to default
1

To my knowledge, iCloud does not keep a history of your files. In order to prevent malware from contaminating your backup, I would recommend a snapshot based backup solution which is pulled from a remote computer securely off of your computer.

For example, Time Machine is a local snapshot solution. If your computer were infected, it would be possible for the malware to corrupt the Time Machine backup. It does keep history of files, which is a nice property. Using rsync initiated from a remote system, you can have a secure, remotely initiated backup. The advantage here is malware would not have access to the backup server to be able to alter your backups. If you combine the two properties, for example using rsnapshot ( https://rsnapshot.org ), you prevent local corruption and have a history of your files.

There are other solutions along these lines.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .