2

I'm a security newbie so please excuse the solely high level symptomatic description of my problem.

My friend doesn't know how he got it, but he has some form of malware on his mac which, when he opens a URL, spontaneously opens an additional URL in a new tab. This occurs across all browsers so I'm guessing the malware is native. Anyone got pro tips for getting rid of it?


I was thinking of listing all running processes with ps aux, sequentially killing suspicious-looking ones while opening URLs, until the spontaneous URLs stop, and then use the path to remove the executable. But I'm inexperienced at discriminating suspicious ones, there are 153 running processes, and I guess removing the executable might not be sufficient if the malware is sophisticated enough.

  • 1
    Just deal with it as any other compromised server and reinstall from scratch. – user42178 Feb 15 '15 at 13:43
2

The obvious answer is to run anti-virus and anti-malware software, then check out some suspect directories. Then, if you cannot resolve the issue on your own, get in touch with Apple support. Please note they may recommend that you wipe your hard drive. Ignore that advice, persistently, and they will eventually escalate you to a level of tech support (telephone-based) that may screen-share with you and help you walk the directory structure looking for suspect files.

Self-help steps to try before getting to support:

Fix permissions using Disk Utility: permissions errors can lead to vulnerabilities. Also, finding out what has had it's permissions changed may give you some idea of what's being attacked. It is not really that likely to solve any problems... but you also need to make sure that any scanners you run can actually access the directories they need to scan... so not a bad first step.

Look at extensions/add-ons in your browsers and disable anything that looks funny. I know all browsers are affected, but... you may have crappy extensions put into all of them somehow.

ClamAV is a good piece of anti-virus software, that is free. Download it directly from their site, instead of using the AppStore -- for some reason the AppStore version doesn't let you schedule scans/updates.

AdwareMedic is a nice piece of anti-malware software that Apple support recommended to me, when I called them.

Adware Removal Tool (Bitdefender), caught some things that were missed by Adware Medic. It is also light and non-invasive.

Other software: there is a LOT of other software out there. And, as is the case with PC's, no single suite is comprehensive. You will probably want a second piece of anti-virus software... I just can't recommend a good one. I don't like most of the programs out there. Many of them are bloated. Many of them interfere with your system. Many do not uninstall completely.

Walking the directory structure to look for stuff... yes you won't necessarily know what things are named. But they're often named obviously-malicious things. If you use finder to look through your directories instead of the command line, you may want to try entering this into the command line first to make sure you can see dotfiles.

defaults write com.apple.finder AppleShowAllFiles YES

Just a couple of places to peek at for malware:

/Library/

/Library/Application Support/

/Library/Internet Plug-Ins/

~Library/

~/Library/Application Support/

~/Library/Internet Plug-Ins/

If you still can't find the issue, try rebooting your computer in recovery mode (command R on startup), and trying Safari there (Get Help Online). If that sandboxed version of safari is messed up you may have issues with your modem.

You can also try creating a different user account. A different account experiencing the same troubles... probably means you've got system files messed up, instead of ones installed in your ~ directories.

Good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.