Virus from fake adobe download...Help Please

[K8ty]

Hi, I was stupid enough on friday to use the adobe update that came on to my screen. Im pretty sure now that it was a fake and a virus, Trojan, malware or something.... The only problem i have at the moment is that i cant acess google web pages and some others with google in the address. I have reset safari, emptyed cache, removed all cookies and web site data and change my dns servers. I have also downloaded virus barier which came up clean. Im not sure what else to do?
Any help would be greatly appricated

 

[Kaveman]

If you've used your Admin password, or running as an admin user, then you'll need to do a reformat and clean install of your hard drive, there is no way of knowing what else has been installed through the backdoor this opens.

Don't forget to Backup your User space and migrate it back in.

 

[K8ty]

Thanks Kaveman. what is my user spac and how do i go about refomating and clean install of my hard drive? Sorry for not knowing much

 

[Kaveman]

To see if you've been running with Admin Privileges:

 Menu > System Preferences... > Accounts (Users & Groups) there is list and one of those is your user Account, under the name it will say admin or standard, it should be standard but if the person who set up your Mac didn't make you a standard account to use then you may be still admin. As you can see that's not a good thing™

Your User Space is all the files in your Home, thats the House Icon. It has your Documents, Music, Pictures... When you do a backup that is the area you need to backup. If you are using Time Machine then this is already backed up.

 

[K8ty]

Yes im admin, could the bad stuff from the virus be in myuser space? also in my accounts under me as admin is a guest and it says sharing but it is gray and i cant click on it. could thid be my wirless or is that some one else getting in to my computer?

 

[Kaveman]

The Guest account is for you to allow guests/friends use your computer, when they log out everything they have done is completely erased, and of course they have no ability to change anything on the computer at all.

It is unusual for the few known trojans to install anything other than easy to remove Login Items in your Home area.They want Admin privileges to run key loggers and send your information back to their waiting servers. That is why its such a good idea to run as a standard account and only use your Admin User Name and Password with fully trusted Applications.

but its a bit late now, you'll need to start again, with a clean install of OS X, as you have no way of knowing what you have allowed to be installed.

Note: There are NO known Mac Virus, there is a huge difference between a Virus and a Trojan.

Are you fully backup? If so the next thing to do is get your DVDs that came with your Mac.

 

[K8ty]

no im not backed up was just looking at a time machine today, is this the best device to back up on ive seen mixed reviews. but good reviews on the LaCie 2TB Porsche Design P’9231 Desktop Hard Drive. whats you opinion? will get one as soon as possible hopefully order to night.

 

[Kaveman]

They serve different purposes. I use both, I have a Time Capsule and 3 of my Mac are always backing up to it. Knowing that all my work is backed up automatically every hour is wonderful.

But I also have an external drive where I also backup my iPhoto/Aperture Library, my important Documents, and my iTunes media. Anything I'd hate to loose, ever, ever...

Oh and I use MobileMe for various other off site backups.

In your position right now I'd get an external Hardrive, and make sure it's FireWire 800, don't waste your time on slow USB, you need to be backed up and fast.

Note: Do not enter your Passwords or online Store details into any Banking Site or Stores. If you have a Trojan your personal data is at risk. I'd take your computer off the net completely until this is resolved. If you have a Trojan, then you may end up with identity theft, this is incredibly serious.

 

[K8ty]

Hi Kaveman,
Thankyou for all your help the other day, i ordered a fire wire 800 external hard drive and will get her on thursday. Havent used my computer since you last post got a bit scared. Cant wait till it is all fixed and i can use it again.
Just wanted to say that i really appricate your help..
K8

 

[Kaveman]

I'm sorry, I don't wish to distress you, but it is important to understand that Trojans are dangerous. Having your Mac set-up to limit the damage accidentally inviting them in can cause is very important. So once you're backed up and cleaned up, we'll get you into a standard account and you'll feel a lot better!