Anothe piece of "malware" on my Mac - now what? - ehMac.ca
Facebook
Twitter
YouTube
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read


Reply
 
LinkBack Thread Tools Display Modes
Old Feb 1st, 2006, 12:09 PM   #1
krs
Honourable Citizen
 
krs's Avatar
 
Join Date: Mar 2005
Location: Ontario and Quebec
Posts: 8,071
Anothe piece of "malware" on my Mac - now what?

A while back I ended up with a "virus" in my Mac mail that caused funny things to happen - like the screen flashing etc.
With repeated scans I managed to isolate it to a specific email, trashed the email and the problem was solved,
Post is here
How can I remove virus "worm.bagle.gen-zippwd"

Now I have another piece of malware called an "expoit"..whatever that is. It causes the text to go all wiggly to make it unreadable.
ClamXav identifies it as Exploit.IFrame.Gen

Trouble is, it's on a different Mac using Outlook Express as the email client and the messages are all one huge single file, so it's not easy to identify which message it's in.
Any hints from anyone how to remove this "Exploit"?
krs is offline   Reply With Quote
Sponsored Links
Advertisement
 
Old Feb 1st, 2006, 01:25 PM   #2
Assured Advertiser
Honourable Citizen
 
CanadaRAM's Avatar
 
Join Date: Jul 2005
Location: Victoria BC
Posts: 3,789
How have you made the link between a Windows exploit from 2003 and the text problem you are having?
CanadaRAM is offline   Reply With Quote
Old Feb 1st, 2006, 02:53 PM   #3
krs
Honourable Citizen
 
krs's Avatar
 
Join Date: Mar 2005
Location: Ontario and Quebec
Posts: 8,071
Quote:
Originally Posted by CanadaRAM
How have you made the link between a Windows exploit from 2003 and the text problem you are having?
Wild guess...no, no, educated guess.

I ran the virus scanner about two weeks ago. Everything was fine then.
After I got the squiggly text in emails, I ran the virus scanner again this morning and this one infected file shows up.
Last time, the email message with the "worm.bagle.gen-zippwd" was relatively easy to identify because in Apple mail you can scan individual messages.
Once I had the message identified, I simply trashed it and the problems went away and stayed away.

This time, when I scanned outlook express, the file the 'exploit' is in is identified, but it's the outlook message file which has all of the mail in it, 700+meg.

So right now my plan is to import all the outlook mail into Apple mail...which I just finished doing (worked well this time, failed when I was still on OS 10.2), back up both the outlook mail and apple mail to a CD or DVD and then run the virus scanner on Apple mail to see if I can identify the specific email causing the problem.

What is an 'exploit' anyway and why would it affect the Mac?
krs is offline   Reply With Quote
Old Feb 1st, 2006, 03:25 PM   #4
Full Citizen
 
Jacklar's Avatar
 
Join Date: Jul 2005
Location: Ottawa
Posts: 399
If you don't know what an exploit is then you have not made an educated guess
__________________
======================================
"Without order nothing can exist - without chaos nothing can evolve."
----------------
Xbox Live Gamertag: Jacklar
----------------
**Mac Stuff**
8gb Touch/ 160gb Classic
15' 2.4 MBP - 4gb/320gb 7200rpm
BB Bold - Soon to be iPhone with the update.

======================================
Jacklar is offline   Reply With Quote
Old Feb 1st, 2006, 04:00 PM   #5
Honourable Citizen
 
CubaMark's Avatar
 
Join Date: Feb 2001
Location: Zacatecas, México
Posts: 10,174
Send a message via AIM to CubaMark
And just to reiterate the point, You do not have a virus or an exploit. There are none. Whatever your problem is, it's related to something else.

On the matter of your original computer, the one with the flashing screen, did you check the "Universal Access --> Hearing --> Flash the Screen when an Alert Sounds" ?

Outlook Express - does that run natively in OS X, or is the Mac you're currenlty working with use OS 9? Classic?

M
__________________
It's not an embargo. It's a blockade. www.cubavsbloqueo.cu
The Cuban Revolution as Socialist Human Development Brill Books (Amazon Paperback)
CubaMark is offline   Reply With Quote
Old Feb 1st, 2006, 04:00 PM   #6
Full Citizen
 
TrevX's Avatar
 
Join Date: May 2005
Location: Sydney, Nova Scotia
Posts: 968
Send a message via AIM to TrevX Send a message via MSN to TrevX
Quote:
Originally Posted by krs
Wild guess...no, no, educated guess.

I ran the virus scanner about two weeks ago. Everything was fine then.
After I got the squiggly text in emails, I ran the virus scanner again this morning and this one infected file shows up.
Can you post a screen shot of what this squiggly text looks like? Is it readable, or just a bunch of garbage text?
Quote:
Originally Posted by krs
Last time, the email message with the "worm.bagle.gen-zippwd" was relatively easy to identify because in Apple mail you can scan individual messages.
Once I had the message identified, I simply trashed it and the problems went away and stayed away.
For the record, worm.bagle.gen-zippwd is a Windows virus. You had it on your Mac, but all it was was an attachment. It can not infect your Mac.

Quote:
Originally Posted by krs
This time, when I scanned outlook express, the file the 'exploit' is in is identified, but it's the outlook message file which has all of the mail in it, 700+meg.

So right now my plan is to import all the outlook mail into Apple mail...which I just finished doing (worked well this time, failed when I was still on OS 10.2), back up both the outlook mail and apple mail to a CD or DVD and then run the virus scanner on Apple mail to see if I can identify the specific email causing the problem.

What is an 'exploit' anyway and why would it affect the Mac?
Does the virus scanner actually tell you what the "exploit" is it found? Again, if it caught it is most likely a Windows virus as there are no viruses for Mac OS X, nor malware like you'd see on a typical Windows PC.

Trev
__________________
-Macbook Pro 2GHz Core Duo 15.4", 2GB, 100GB, Superdrive, Airport, BT, 256MB ATI x1600
-iPhone 8GB
TrevX is offline   Reply With Quote
Old Feb 1st, 2006, 04:16 PM   #7
krs
Honourable Citizen
 
krs's Avatar
 
Join Date: Mar 2005
Location: Ontario and Quebec
Posts: 8,071
Quote:
Originally Posted by CubaMark
And just to reiterate the point, You do not have a virus or an exploit. There are none. Whatever your problem is, it's related to something else.

On the matter of your original computer, the one with the flashing screen, did you check the "Universal Access --> Hearing --> Flash the Screen when an Alert Sounds" ?

Outlook Express - does that run natively in OS X, or is the Mac you're currenlty working with use OS 9? Classic?

M
CubaMark -

All I know is that the virus scanner came up 'no files found' two weeks ago.
After I got the squiggly text, I ran it again and now it says one infected file found with the description I gave in my first post.
ClamXav is picking something up that wasn't there two weeks ago.
Grant you, maybe the squiggly text and this 'exploit' is unrelated - I guess I'll find out as soon as I identify the culprit email and trash it.

As to the original 'flashing screen' problem. Yes, I did check Universal Access. Someone had suggested that in the previous post. But there was nothing set.
Don't you find it strange that after I deleted the email that ClamXav identified previously and the problem went away?

For Outlook Express I'm using classic with OS 10.4.3
krs is offline   Reply With Quote
Old Feb 1st, 2006, 04:22 PM   #8
krs
Honourable Citizen
 
krs's Avatar
 
Join Date: Mar 2005
Location: Ontario and Quebec
Posts: 8,071
Quote:
Originally Posted by TrevX
For the record, worm.bagle.gen-zippwd is a Windows virus. You had it on your Mac, but all it was was an attachment. It can not infect your Mac.
All I know is that the problem went away after I deleted the email that was identified as having the virus. That was on Apple mail with OS 10.3.9

Quote:
Does the virus scanner actually tell you what the "exploit" is it found? Again, if it caught it is most likely a Windows virus as there are no viruses for Mac OS X, nor malware like you'd see on a typical Windows PC.
Trev - I mentioned that in my first post. I have no doubt it's a Windows virus, but it does seem to affect the Mac.

ClamXav identifies it as Exploit.IFrame.Gen
krs is offline   Reply With Quote
Old Feb 1st, 2006, 04:25 PM   #9
Honourable Citizen
 
HowEver's Avatar
 
Join Date: Jan 2005
Location: GTEh
Posts: 15,026
Before Tiger, I had Norton AV installed. It would find viruses (virii) in email attachments, even though they absolutely could not harm the Mac that contained them.

With Tiger, Norton AV went into the trash, and not easily at that. There is no reason to have it installed. Kiss your virus application goodbye.
__________________
...
For sale:
iSight in great condition: buy now.


HowEver is offline   Reply With Quote
Old Feb 1st, 2006, 05:01 PM   #10
Full Citizen
 
TrevX's Avatar
 
Join Date: May 2005
Location: Sydney, Nova Scotia
Posts: 968
Send a message via AIM to TrevX Send a message via MSN to TrevX
Quote:
Originally Posted by krs
Trev - I mentioned that in my first post. I have no doubt it's a Windows virus, but it does seem to affect the Mac.

ClamXav identifies it as Exploit.IFrame.Gen
Sorry, missed that.

As for Explot.IFrame.Gen, check here: http://www.f-secure.com/v-descs/iframe.shtml.

Windows Only.

Trev
__________________
-Macbook Pro 2GHz Core Duo 15.4", 2GB, 100GB, Superdrive, Airport, BT, 256MB ATI x1600
-iPhone 8GB
TrevX is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Thoughts on the Intel Apple pdksh Anything Mac 26 May 7th, 2008 04:05 PM
A Plethora of Mac mini websites gmark2000 Anything Mac 3 Jul 4th, 2006 01:12 PM
Mod Log Chealion Info Centre 7 May 25th, 2006 01:18 PM
LaCie Unveils Drive for Mac Mini Ottawaman Anything Mac 10 Jul 12th, 2005 07:14 PM
Mac, Mac, Mac, Mac! mactrombone Anything Mac 15 Mar 29th, 2005 11:26 AM


All times are GMT -4. The time now is 04:20 AM.



Copyright © 1999 - 2012, ehMac.ca All rights reserved. ehMac is not affiliated with Apple Inc. Mac, iPod, iTunes, iPhone, Apple TV are trademarks of Apple Inc. Content Relevant URLs by vBSEO 3.6.0 RC 2

Tribe.ca: Urban living in Toronto!