Techsurvivors

Welcome to Techsurvivors => Tech => Topic started by: Xairbusdriver on October 02, 2014, 08:05:54 PM

Title: New Threat to Your Mac: iWorm
Post by: Xairbusdriver on October 02, 2014, 08:05:54 PM

<9to5mac>
<MacIssues>
<Dr.Web>
<TheSafeMac>

First, I think everyone should already have used an app or the Folder Actions function to get a warning whenever anything is added to your LaunchDaemons or LaunchAgents directories. If you get a notification of this happening and you have not just authorized an new software install, be very concerned. Find out why something was added. Immediately.

Secondly, look in /Library/Application Support for a folder named "JavaW". So far, no known app creates a folder by that named. However, be aware that the hackers that created this malware may also create a script to rename that folder or create a different one as news gets out.

if you don't have a folder by that name, you're OK, for now.
If you do have that folder, the possibility is strong that you have been infected. You have some choices to make:
1. Wipe your startup drive and reinstall the OS.
2. Restore from your System from a backup known to be free of the infection.
3. Wait for a Security Update from Apple.
4. Wait for an automatic Xprotect update from Apple.

Additional steps to take, if you can stand the disruptions:

Install Little Snitch or check out Intego NetBarrier. These apps will watch for outgoing Internet messages.
Set up those folder watching by creating an Automator action using the "Folder Action" to alert you when anything is added to the LaunchDaemons or LaunchAgents folder.