Found old viruses on a computer running macOS Sierra: what to do now?
My father was lamenting how random ads will pop-up even with adblock and while browsing trusted websites and how Firefox was always on at startup on his OSX computer (with all software updates correctly on) since the day he installed it.
I naturally checked System Preferences > Users Accounts > Login items and on the Firefox dock icon Firefox > Open at login. Nothing was there...
So I moved to ~/Library/LaunchAgents where to my surprise I've found many files pointing to obvious viruses. For example, one files was named com.apple.roinnris.plist and was pointing to an executable which, in a Terminal window, behaved like this:
Last login: Mon Jun 26 18:36:28 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Library/roinnris ; exit;
1.3.4: Initializing... roinnris
http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=hp&type=YHS_TGE_5a01fc&_=tt1
http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=nt&type=YHS_TGE_5a01fc&_=tt1
http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=ds&type=TGE_5a01fc
snowbitt
_Bt3mBZUrWFiQtw-o265327tVlFLedwV5m3RbDQqoTNF34tnUYs4T2-Z-0Vh_ot2iQz9QcQstVbDfh_GhqMjQkak68EeUespftvJPjZ5LY1FbyK8tuMM
nth
convertFile - /Users/gianni/Library/backup.zip to /Users/gianni/Library/backup.tmp
Ping-"http://t.trkitok.com/track/surl?mid=C26849F2-0F50-5495-9FBB-9269DCE9EDA1&ht=???ڐ?????΄???????ބ??Dž?????????ؗ??????Č?ٗ?ӌ????????Η??????????????????ϗ?ڌ???ϗ?????????˚??Ɍ???ޛ????ڐ?????΄???????ބ??Dž?????????ؗ??????Č?ٗ?ӌ????????Η??????????????????ϗ?ތ???ϗ?????????˚??Ɍ???ޛ????ڐ?????΄???????ބ??Dž?????????ؗ??????Č?ٗ?ӌ????????Η??????????????????ϗ?ٌ???ϗ?????˚??ɠ???????ޠ??ޙ??????????݇Ř???????????????Ǚ????????왞????ٞ??????????ޘ??Г??????????????????????????????????????????????? ?&nt=&su="
Here's another one:
Last login: Mon Jun 26 18:28:48 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Library/sfhucvkzeooa/sfhucvkzeooa ; exit;
2017-06-26 18:33:10.535 sfhucvkzeooa[10383:98510] http://i.firstinstallmac.club/c/cc?id=
/bin/sh: line 50: /Library/pfutil: Permission denied
And another one (which was originally in Library but I moved to the desktop):
Last login: Mon Jun 26 18:33:10 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Desktop/VirusReportStackExchange/jaLeQGoJ/jaLeQGoJ.app/Contents/MacOS/jaLeQGoJ ; exit;
2017-06-26 18:34:37.327 jaLeQGoJ[12743:122843] Found it
And another one, with error messages in the user main language (italian):
Last login: Mon Jun 26 18:34:36 on ttys000
Pro-di-Gianni:~ gianni$ /Users/gianni/Library/subtlist/subtlist ; exit;
2017-06-26 18:35:08.919 subtlist[13656:131528] gianni
2017-06-26 18:35:08.920 subtlist[13656:131528] V\(;-<<7,/$48:=6D\TN(&*:1:=."=$UV0)8!'%.+:<=-">$UV", 694,+?.M D"1!$<*<!,8#6+'=*&<$D"?28?&<!!$9$
2017-06-26 18:35:08.921 subtlist[13656:131528] V\(;-<<7,/$48:=6D\TN(&*:1:=."=$UV0)8!'%.+:<=-">$UV", 694,+?.M D"1!$<*<!,8#6+'=*&<$UD"?28?&<%6%?&07.M
N('**-,0*'5&&!'6_
N0>*<!,*,<7'.M
N('**-,!.8)6= .6_
N('**-,'"&<*'2&;$_"52 ?4;07.MN('**-,'*,&07.MN('**-, >)&07.M
V"52 ?4<+!<96_N0'8*',-*5512( $
2017-06-26 18:35:08.921 subtlist[13656:131528] (#-.<=,7$&80=.
2017-06-26 18:35:08.921 subtlist[13656:131528] (>*(10=6"/$
2017-06-26 18:35:08.921 subtlist[13656:131528] (#*9-76!($7?:46
2017-06-26 18:35:08.921 subtlist[13656:131528] (&8.+&&!'6
2017-06-26 18:35:08.921 subtlist[13656:131528] (19$.*6!4816!'%*4<.
2017-06-26 18:35:08.921 subtlist[13656:131528] (&8.+&24.%-$
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&6%.%-&:76
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&02''&,!?6
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&!68;67 66
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&& .9&,!?6
2017-06-26 18:35:08.921 subtlist[13656:131528] (?*8-&1:/6
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&'2,40=.
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-& &)40=.
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&':&.*-2>;6
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&6!9$+$
2017-06-26 18:35:08.922 subtlist[13656:131528] (?*8-&52'';8086
2017-06-26 18:35:08.922 subtlist[13656:131528] (&*4,+?.
2017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
2017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
2017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
2017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
2017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
017-06-26 18:35:08.922 subtlist[13656:131528] \?
\&&/
2017-06-26 18:35:08.924 subtlist[13656:131528] Invalid chrome version
2017-06-26 18:35:08.929 subtlist[13656:131528] 5a01fca9-d552-45e9-a47c-f34d2a14e626
2017-06-26 18:35:08.958 subtlist[13656:131528] C26849F2-0F50-5495-9FBB-9269DCE9EDA1
2017-06-26 18:35:08.958 subtlist[13656:131528] upd
2017-06-26 18:35:08.958 subtlist[13656:131528] 'http://www.google.com'
2017-06-26 18:35:08.958 subtlist[13656:131528] 99999999
2017-06-26 18:35:08.958 subtlist[13656:131528] http://loadingpages.me/jo/is?id=C26849F2-0F50-5495-9FBB-9269DCE9EDA1&d=5a01fca9-d552-45e9-a47c-f34d2a14e626&cl=upd
227:230: syntax error: Si attendeva fine linea ma è stato trovato proprietà. (-2741)
227:230: syntax error: Si attendeva fine linea ma è stato trovato proprietà. (-2741)
I then moved to the main Library (not the user one) at /Library/LaunchAgents and /Library/LaunchDaemon where there were more of these plist files pointing to sketchy executables, one of which was clearely turning Firefox on and trying to compress and steal a folder from it's ApplicationSupport space.
I nuked the contents of all these folders and instructed not to ever use the computer for banking until a full wipe will be done.
All of these files were at least 1 month old.
My questions are:
Are these viruses already known to Apple? If yes, where can I read more and why weren't they automatically removed with Security Updates? If not, who has more informations? Where am I supposed to notify Apple of the existance of these?
Solution 1:
Apple contact options are listed on https://www.apple.com/contact/. Security updates are providing patches to known security issues, they usually do not remove viruses/malware from an already infected systems.
With the suspicious files already gone there is no way to analyze what happened to your father's computer, so you may as well move ahead and reinstall everything from scratch. It's probably safest to use Internet Recovery to reduce the risk of restore from an infected Recovery Partition.