Full Story from Cnet Here

Quote:

---

half the computers infected with malware designed to steal personal information are in the U.S.

---

Quote:

---

As CNET blogger Topher Kessler explains, simply visiting a malicious Web site containing Flashback on an OS X system with Java installed will result in one of two installation routes. The malware will request an administrator password, and if one is supplied, it will install its package of code into the Applications folder. If a password is not offered, the malware will install to the user accounts where it can run in a more global manner.

---

Instructions for Detection and removal here

--------------------
www.dragonlogos.co.uk

Thanks. Most useful.

CC

--------------------
Put the fun back into dysfunctional.
Mr Punch's Studio

At least you can remove that one. The new one I discuss here:

http://www.soundonsound.com/forum/showflat.php?Cat=&Number=980058& page=0&view=collapsed&sb=5&o=365&fpart=1#980058

Has no resolution other than full reinstall.

I did see that one, it really looks like some groups is targeting MACs - difficult to say what measures to take other than keep up-to=date with news stories etc - If its only tracking passwords and stuff its very small data, also it seems to be more MACs in the USA

--------------------
www.dragonlogos.co.uk

I know it's bad form, and I apologise in advance... but as a PC user can I just say: ha ha ha ha ha ha ha !

Sorry /coat

hugh

--------------------
Technical Editor, Sound On Sound

Yes, Id say it was bad form, except ...

Some time back as a Mac (as well as PC) user I advocated installing anti-virus software on Macs and got roundly and loudly told off by those that believe that Macs are charmed and cannot ever be infected by anything. So, I'm going to join you: ha ha ha ha ha!

CC

PS it's interesting that this malware uninstalls itself if it detects the presence of anti-virus software.

--------------------
Put the fun back into dysfunctional.
Mr Punch's Studio

it's not a virus, it's a trojan, anti virus software wouldn't do anything.

It uninstalls if you have little snitch - which is not anti virus software, but an internet monitor.

Edited by fletcher (05/04/12 10:27 AM)

Quote:

---

On execution, the malware checks if the following path exists in the system:

/Library/Little Snitch
/Developer/Applications/Xcode.app/Contents/MacOS/Xcode
/Applications/VirusBarrier X6.app
/Applications/iAntiVirus/iAntiVirus.app
/Applications/avast!.app
/Applications/ClamXav.app
/Applications/HTTPScoop.app
/Applications/Packet Peeper.app

If any of these are found, the malware will skip the rest of its routine and proceed to delete itself.

---

[sarcasm] It's a strange thing about anti-virus software but it seems to check for trojans too. You'd think with a name like anti-virus software they wouldn't bother. [/sarcasm]

Anti-virus would remove a trojen during a scan. A decent one might even reconigze the trojans code and stop it being installed in the first place. Apples been advising antivirus being installed for years so that should say something about the situation.

--------------------
ScanProAudio & 3XS Audio Systems
ScanProAudio Blog

fair enough CC I missed that.

It's just that on the apple discussion boards they say that the virus program wouldn't work here, and that it's not a recommended way to clean the system of this malware and you can't be sure it would be removed.

this is an older trojan anyway with a clean up method available, see the other thread for the newer trojan which has no fix it seems except re-install.

Maybe we will need to follow your advice about anti-virus software in the future, however the main thing seems to be to turn off Java in the preferences - of course not much good if it's already in. Lion comes with Java off as default, I just wish apple had warned us a bit louder to turn it off in the older systems as well.

By the way I'm still clean - no anti virus yet either

Edited by fletcher (05/04/12 11:37 AM)

Quote fletcher:

---

it's not a virus, it's a trojan, anti virus software wouldn't do anything.

---

Any decent anti-virus software (on a Mac or a PC) will detect and deal with trojans when they arrive, and certainly when a system scan is perfomed.

hugh


--------------------
Technical Editor, Sound On Sound

Quote Hugh Robjohns:

---

I know it's bad form, and I apologise in advance... but as a PC user can I just say: ha ha ha ha ha ha ha !

---

But Hugh, only numpties would install it....

Which would make all PC users ....

--------------------
Veni, Vidi, Aesculi
(I came, I saw, I conkered)

Just a reminder that Sophos provide free and good quality anti-virus (and anti-trojan ) software for Macs here.

CC

Edit: Here is a discussion on the Sophos forums on setting up SAV for use on a Mac used for audio recording.

--------------------
Put the fun back into dysfunctional.
Mr Punch's Studio

Edited by ConcertinaChap (05/04/12 02:30 PM)

Quote Hugh Robjohns:

---

I know it's bad form, and I apologise in advance... but as a PC user can I just say: ha ha ha ha ha ha ha !

Sorry /coat

hugh

---

Christ, do you ever give it a rest Hugh? For an admin, and established member of the SoS team, you sure can be a prat.

--------------------
Paul

Gone out and forgotten your sense of humour again?

hugh

--------------------
Technical Editor, Sound On Sound

Quote ~Paul:

---

Quote Hugh Robjohns:

---

I know it's bad form, and I apologise in advance... but as a PC user can I just say: ha ha ha ha ha ha ha !

Sorry /coat

hugh

---

Christ, do you ever give it a rest Hugh? For an admin, and established member of the SoS team, you sure can be a prat.

---

Hugh does not need me or anyone else to stand up for him, but his post WAS funny.
And when the inevitable Mac vs PC wars break out again, there'll be much worse than this!

--------------------
Cubase, guitars.

Hugh was only joking I'm sure

I have decided not to install any anti virus software, even though my son's computer had the trojan. I have decided to just turn off Java and tell my son to be more careful with Adobe updates - you can always install upgrades by running Adobe itself if your not sure of the prompt. I think he most likely became a victim this way (Facebook etc. not really concentrating and installed the fake Adobe Flash upgrade) with the original variant. This was the smart one which erased itself if littlesnitch or (ahem) antivirus software was detected. This is the one which can be removed using Terminal as described, seems to work. As he didn't have any software to detect it I think he had it for awhile, but one of the symptoms he had noticed recently (last week or so) was Safari crashing strangely. Which is what is reported to happen, increasing instability leading to crashes. He's on Snow and I only mention this in case anyone else has seen Safari crash recently, you might be infected.

The new version is it seems both more sneeky and less sophisticated. It gets in via Java and can install without your knowing even if you don't stupidly type your password. However without Java and Flash neither variant could have got in! It installs whether or not you have little snitch (why I say less sophisticated) and that is how it was spotted, little snitch snitched on it.

The other thread has a link to the apple discussion where it was first picked up. If you go to the beginning it is quite interesting to see the apple community slowly wake up to the problem. I'm sure though there wouldn't even be a discussion on a PC site about a windows malware threat, no news there, how many thousand malware threats have been seen on PC's in the same time frame? It says a lot that one trojan for macs has caused so much discussion.

Still I guess if macs continue to grow in popularity there will inevitably be a time when we lose our peace of mind and have to install anti-virus. Not yet though, but watch this space!

Quote fletcher:

---

Hugh was only joking I'm sure

---

Quite so... and there were two blatent indicators in the post to make that quite clear. perhaps the ~prat trojan has got into Paul's computer...

hugh

--------------------
Technical Editor, Sound On Sound

Quote Hugh Robjohns:

---

Gone out and forgoten your sense of humour again?

hugh

---

Fortunately Hugh, there are still some of us left that set the bar for humour higher than floor level.
If it wasn't for the fact you make an appearance in Apple threads quite so frequently to drop your rancid brain farts, then yes we could shrug it off as a bit of humour. If that is, it hadn't already worn thin months ago.
I just don't see why or how you go from being more than respectable in every post around here, until it gets to an Apple post, where you'll suddenly morph into a bigoted prat.

Sorry

--------------------
Paul

Quote ~Paul:

---

there are still some of us left that set the bar for humour higher than floor level.

---

In which case you must find my personal humour threshold to be positively subterranean.

Quote:

---

you go from being more than respectable in every post around here, until it gets to an Apple post, where you'll suddenly morph into a bigoted prat.

---

"When in Rome..."

See?

More seriously, it's inevitable that as Apple's market share grows that their OS will be targeted more. Windows was/is a popular target because it was/remains the dominant OS. iOS and Android also look like prime targets now.

Quote ~Paul:

---

bigoted prat. Sorry

---

T'internet has made "sorry" such a barbed remark the next version of this BB will probably asterisk it out.

I wonder what computers people have that are internet facing, how important they are, and how well protected.

My DAW hasn't seen a network connection since it was installed 4 years ago. It ain't broke and I've no intention of letting it get 'fixed'.

My netbook (which I use for work) goes online just occasionally via a firewalled router (wireless is switched off) to check for updates otherwise it too is blind to the 'net.

My general purpose one (that I'm typing this on) still goes via a firewalled router but otherwise goes just about everywhere. However, I use an e-mail client that's configured to only display plain text, run nothing, and ask before saving anything. My browser is Firefox, and I have NoScript, AddBlock and Ghostery configured pretty aggressively. For all of that if somehow it was to crash and burn I wouldn't regard it as a major disaster.

--------------------
It wasn't me!
(Well, actually, it probably was)

Quote ~Paul:

---

If it wasn't for the fact you make an appearance in Apple threads quite so frequently....

---

I don't know if you've changed the medication recently, but your hallucinations are definitely getting worse, along with your manners. The mac forum is demonstrably one where I contribute least. As for the rest, personal abuse of the kind you have levelled so needlessly at me will not be tolerated. If my sense of humour has offended you I apologise without hesitation, of course.

Hugh

--------------------
Technical Editor, Sound On Sound

Quote ~Paul:

---

Quote Hugh Robjohns:

---

Gone out and forgoten your sense of humour again?

hugh

---

Fortunately Hugh, there are still some of us left that set the bar for humour higher than floor level.
If it wasn't for the fact you make an appearance in Apple threads quite so frequently to drop your rancid brain farts, then yes we could shrug it off as a bit of humour. If that is, it hadn't already worn thin months ago.
I just don't see why or how you go from being more than respectable in every post around here, until it gets to an Apple post, where you'll suddenly morph into a bigoted prat.

Sorry

---

You forgot /coat so that we'd all know you were joking.

Seriously, despite whichever platform we use, I don't think people infected will find it in the least funny; and I'm not sure it serves Hugh well to be laughing - even in jest - at the misfortune of others.

Regardless of intent (and I'm sure it was a little joke, and not just schadenfreude), this is the internet. You know - the internet? If there is to be a standard, then the admins should uphold it. It's bad form for a forum which purports to help its users if they are perceived to be laughing at them instead.

--------------------
Second in a one horse race...

Quote fletcher:

---

I have decided not to install any anti virus software, even though my son's computer had the trojan.

---

Well, best of luck. You might be alright, long term. Personally I reckon the time to sort your protection out is before you get burned, not after - I speak from painful experience here. But you're grown up, you can make your own decisions.

Think I'll quit this discussion here. On top of everything else it has got quite unnecessarily acrimonious, but then it always does, doesn't it? Sad.

CC

--------------------
Put the fun back into dysfunctional.
Mr Punch's Studio

Quote:

---

I don't think people infected will find it in the least funny; and I'm not sure it serves Hugh well to be laughing - even in jest - at the misfortune of others.

---

I take your point, dmac, and I do sympathise with those who have suffered this problem. I presume with only 20-odd posts to your name you are relatively new to these forums so perhaps you are unaware of the years of friendly (and sometimes gloating) comments on these forums about the mac freedom of virus and Trojan attacks. I was making a lighthearted dig amongst friends of like mind, and clearly flagged it as such. Appropriate advice on dealing with the problem had already been given.

Hugh

--------------------
Technical Editor, Sound On Sound

Questionable behaviour by mods has hurt this forum before, but, hey, perhaps it doesn't matter. Perhaps, on the internet, nothing matters.

... well I'm with Hugh - we've all been a little too smug for a little too long.

I pulled AV on my non-work macs, set a root password and log in as a standard user. I'm still happy with that decision. But obviously I'm now going to be a little more careful still...

Anyway, AFAIR OS X ships with some anti-malware routines and gets updated - on the quiet - with something like the Windows Malicious Software Remover. No comfort if you're a Virus/Trojan early adopter of course

Steve

--------------------
arK music

I have to say, I thought Hugh's comment was hilarious. In fact, I had to call NHS Direct as I thought for a second my sides had split.

Quote Hugh Robjohns:

---

I take your point, dmac, and I do sympathise with those who have suffered this problem. I presume with only 20-odd posts to your name you are relatively new to these forums so perhaps you are unaware of the years of friendly (and sometimes gloating) comments on these forums about the mac freedom of virus and Trojan attacks. I was making a lighthearted dig amongst friends of like mind, and clearly flagged it as such. Appropriate advice on dealing with the problem had already been given.

Hugh

---

Hi Hugh

Thanks for taking time to reply.

I admit that I'm pretty much a passive member of these forums, but if you look at my avatar details, it seems I've been here longer than you. Please don't think that I mean that in any confrontational way - I'm merely demonstrating that, though I don't post often, I am here, and have been for some years.

In my experience - through the magazine contributions, forum postings, and personally when you taught on my 'A' and led my 'Q' courses some twenty years ago - you are someone always willing to help: to educate, to inform and to entertain. That is a great thing to be, and I applaud you for it; so my point is that I think it hurts how you are perceived if you are seen to be laughing at those who have come here for help.

I think that the point that you think I don't "get it" because I might be new here is spurious a best, and all the more alarming because aren't those new people the ones who need most help? The ones who may be future subscribers to the site and to the magazine? What will a new user's perception be if they find that the admins taunt the existing users? They are not aware of the long-term relationship you describe and, reading it back, it doesn't seem entirely clear to me that you were joking, /coat notwithstanding.

Among the community of helpful people contributing to this site, there are many users whose posts infuriate and annoy me because they are irrelevant, contradictory, ire-charged, uninformed or just plain trolling. I do not comment on those posts because they are site users and, as I've said previously, this is the internet. This kind of stuff is part and parcel of that and you have to dig through a lot of dirt to get to diamonds. I believe it is the administrator's job to deem what is appropriate, and if I don't like it, I can click away to another post or page. I do think the admins have a responsibility to maintain a professional stance above that of the casual user. Anything else is just Lord of the Flies.

Best regards

Donald

--------------------
Second in a one horse race...

Donald, our perspectives on this appear to be at odds, much like our senses of humours, perhaps. I don't see anything wrong in a clearly flagged joke, but if it has caused offence to anyone I gladly apologise. It hadn't dawned on me that some mac users might be so sensitive.

Hugh

--------------------
Technical Editor, Sound On Sound

Hi Hugh

Though I do use a Mac, my main platforms are SADiE and Pyramix. I hope I'm not a platform snob. Sorry if I came across as a Mac person without a sense of humour. I'm going to shut up and go away now.

Best regards

Donald

--------------------
Second in a one horse race...

It is amazing how angry people got, and so quickly. PC users are frequently mocked in these forums, as are "cautious" mac users (like myself). I get a lot of grief for suggesting that Mac users employ some type of malware protection, and I get responses similar to what I'd expect if I handed them a warm jar of sputum. I use Mac, PC, Atari and Linux (Fedora and Gentoo), and I'm not emotionally invested in any of them.

How about some practical advice on how to keep Macs safe. So far I have discovered that to disable Java is a good move and I have seen a recommend for Sophos. I would really appreciate any advice.

I can't see the point in bickering or gloating or scoring points, I just want to avoid the problems as far as I can.

--------------------
Strictly an amateur with some nice toys,

One strange thing, I lost my flash player somehow. However I couldn't download it again without switching Java back on. Once installed I could then switch it off again.

I find it a bit strange that this malware pretends to be an Adobe upgrade or sneeks in via Java, and that the Adobe site downloader needs Java to run? Is that just a coincidence or is it related I wonder.

I think Hugh deserves a VC for being so brave.

Of course it was a joke, but jokes work best when the recipients take them seriously, so if we react negatively - whose fault is it?

I know I've been guilty of holier than though comments, at least to friends, if not on this forum, so humor like that serves to correct our 'reality distortion fields', to coin a SJ symptom.

Bob

--------------------
www.bickerton.co.nz

Quote Bob Bickerton:

---

'reality distortion fields'

Bob

---

Never underestimate these guys. It's like NASA.
I agree, Hugh is very brave and whatever they are paying him it's not enough.

--------------------
17ft here! Too deep for non divers.

Edited by Hamund (06/04/12 02:13 AM)

For goodness sake go and take an aspirin. Or a valium. Better still go and get a life. The man was clearly joking. Clearly that is to everyone except low functioning sanctimonious pond life.

--------------------
The only excuse we have for making music in the first place is to make it differently..vis-a-vis our own difference (Glenn Gould)

Quote Bob Bickerton:

---

I think Hugh deserves a VC for being so brave.

Of course it was a joke, but jokes work best when the recipients take them seriously, so if we react negatively - whose fault is it?

---

It's really a question of perception Bob. I use a Mac and found Hugh's joke to be extremely funny, as indeed all his jokes are. However, I work in a studio complex with 6 other Mac-using composers. We occasionally all log-on during communal coffee breaks to read this excellent forum.

I have to say, one guy (Gunter) who has been having alot of trouble with his machine lately read Hugh's joke and was visibly hurt. To such an extent that he wandered outside for a fag and had to be consoled by his girlfriend for half an hour. I just don't think he got the joke and I think he thought it came across as a bit spiteful. He has got over it now though I am pleased to say. But lest it not be forgotten that we musicians are sensitive things and also persons from foreign shores may read these posts and be totally bamboozled at the subtlety of some of the humour.

I would suggest that in the future the mods stay well clear of any attempts at comedy just in case their words are misinterpreted. We know how easily that can happen on here.

It's all about perception; remember, one man's Salad Nicoise is another man's rabbit food.