Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Listed Threats require manual removal, not listed on site

 Earlier today, the MacPro has been getting into a total system freeze, spinning ball syndrome.

Start a video, and halfway it stops.

Try to access anything regardless the Dock, Finder,etc is locked up action, then force it down.

Insert OS disc to scan drives, and it says they are OK.

During a couple freeze actions, a pop-up that vanishes before it can be viewed fully says something about smart drive sensor?

I can't find this mentioned in console report.

This lead me to think a rare virus got me, and why I'm here.

Sophos Anti-Virus

Product version: 7.2.4C

Threat detection engine version: 3.16.1

Threat data version: 4.62

Release date: 07 February 2011

Detects 2299515 threats

Copyright Copyright 2008-2010 Sophos Group. All rights reserved.

Scan name: "Scan Local Drives"

Scan items:

Configuration:

Scan inside archives and compressed files: Yes

Automatically clean up threats: No

Action on infected files: Report only

Scan started at 2011-02-23 10:00:08 -0600

New volume detected at /Volumes/phil

New volume detected at /    (Somewhat odd HD 1 is not listed)

New volume detected at /Volumes/HD#2  ( these are 1TB drives ) I use this drive for all documents/photo's.

New volume detected at /Volumes/HD#3  (  empty drive )

New volume detected at /Volumes/HD#4  ( movies only )

2011-02-23 10:32:02 -0600 Corrupt file: /Volumes/HD#2/ELECTRONICS/GPS/My Nuvi/Midwest_USA_Topo.tgz.part

2011-02-23 10:56:19 -0600 Threat: 'Mal/Iframe-F' detected in /Volumes/HD#2/MOTORCYCLE/EVENTS/MINNESOTA events/Mackenzie - An American Bar With A Scotch Flavor.html

Deleted this Source file same day.

2011-02-23 11:37:03 -0600 Corrupt file: /Applications/FlightGear.app/Contents/Resources/data/Aircraft/c172p/Models/Immat/Thumbs.db

RE-SCANNED / did not find an issue

Played the application, and there was a hang issue on start panel, but it played Ok.

*** The following are documents roughly 25k and are part of an application downloaded Nov 30 10.

Apparently all from the same application.

I can't nail down what application it is.

I even went as far as searching the date in SpotLight, but could not find the possible source.

Enter any term of threat or file comes up empty in Spotlight.

My logical thinking simply wants to delete the cache file that contains these threats.

Any downside of doing this? 

If threats are truly connected to some single application, I really don't care if it gets destroyed in the process.

Thanks for the help.

I remanufacture aircraft manually, but I dislike digging too deep into memory systems.

2011-02-23 13:27:07 -0600 Threat: 'Troj/JavaBz-C' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/g6k1.class

2011-02-23 13:27:07 -0600 Threat: 'Troj/JavaDl-AZ' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/y6u7.class

2011-02-23 13:27:07 -0600 Threat: 'Troj/JavaDl-AZ' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/g5z6.class

2011-02-23 13:27:07 -0600 Threat: 'Mal/JavaImr-D' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/main.class

2011-02-23 13:27:07 -0600 Threat: 'Troj/JavaDl-AZ' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/q3p0.class

2011-02-23 13:27:07 -0600 Threat: 'Troj/JavaDl-AZ' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/h6l4.class

2011-02-23 13:27:07 -0600 Threat: 'Troj/JavaDl-AZ' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/b5n3.class

threatexpert.com

2011-02-23 13:27:07 -0600 Threat: 'Mal/JavaKS-G' detected in /Users/phil/Library/Caches/Java/cache/6.0/54/168b2d76-62e2cfd1/Tuggoaerffb.class

*** Sample of exploring the threats at the following.

No action taken.

threatexpert.com

Date

Risk

Origin

Findings

12/27/2010 12:13:18 PM

n/a

Trojan.Java.Mesdeh, Exploit.Java.CVE, Exploit.Java.CVE-2008-5353, Mal/JavaKS-C..

11/2/2010 10:56:07 AM

n/a

Exploit.Java.CVE-2010-0094.c, Exploit.Java.CVE-2010-0094, Mal/JavaKC-A..

10/30/2010 4:49:54 PM

n/a

Trojan-Downloader.Java.Agent.hw, Generic Downloader, JAVA.ClassLoad..

Scan completed at 2011-02-23 13:42:48 -0600.

2315838 items scanned, 9 threats detected, 2 issues

:1002163


This thread was automatically locked due to age.
  • Well, after experimenting with the posted process of manually ridding the threats, I seemed to have pulled it off.

    Console report from a moment ago.

    Scan name: "cache 6.0-54 "
    Scan items:
    Path: /Users/phil/Library/Caches/Java/cache/6.0 enabled: yes
    Configuration:
    Scan inside archives and compressed files: Yes
    Automatically clean up threats: No
    Action on infected files: Delete
    Scan started at 2011-02-23 22:32:18 -0600
    Scan completed at 2011-02-23 22:32:22 -0600.
    2152 items scanned, 0 threats detected, 0 issues


    Scan name: "cache 6.0-54 "Scan items: Path: /Users/phil/Library/Caches/Java/cache/6.0 enabled: yes

    Configuration: Scan inside archives and compressed files: Yes

     Automatically clean up threats: No

     Action on infected files: Delete
    Scan started at 2011-02-23 22:32:18 -0600

    Scan completed at 2011-02-23 22:32:22 -0600. 2152 items scanned, 0 threats detected, 0 issues

    For some of us, a play by play visual option of how to perform actions might make the process a little less scary, or frustrating.

    Still wish it was possible to figure out what application was using these files, so we don't stumble into making the same mistake later.

    Thanks for the opportunity to correct these threats.

    :1002165