JEFFMEME
V2EX  ›  macOS

中招了,请问这些目录文件可以删除么

  •  
  •   JEFFMEME · Nov 6, 2014 · 8623 views
    This topic created in 4387 days ago, the information mentioned may be changed or developed.
    中招了,请问这些目录文件可以删除么,大家是如何处理的

    python WireLurkerDetectorOSX.py
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [!] Found malicious file: /Library/LaunchDaemons/com.apple.machook_damon.plist
    [!] Found malicious file: /usr/bin/WatchProc
    [!] Found malicious file: /usr/bin/itunesupdate
    [!] Found malicious file: /Library/LaunchDaemons/com.apple.watchproc.plist
    [!] Found malicious file: /Library/LaunchDaemons/com.apple.itunesupdate.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.appstore.plughelper.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.MailServiceAgentHelper.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.systemkeychain-helper.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.periodic-dd-mm-yy.plist
    [!] Found malicious file: /usr/bin/com.apple.MailServiceAgentHelper
    [!] Found malicious file: /usr/bin/com.apple.appstore.PluginHelper
    [!] Found malicious file: /usr/bin/periodicdate
    [!] Found malicious file: /usr/bin/systemkeychain-helper
    [!] Found malicious file: /usr/bin/stty5.11.pl
    [+] Scanning for known suspicious files ...
    [!] Found suspicious file: /etc/manpath.d/
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [!] WARNING: Your OS X system is highly suspicious of being infected by the WireLurker.
    [!] You may need to delete all malicious or suspicious files and/or applications above.
    18 replies  •  2014-11-09 10:03:53 +08:00
    JEFFMEME
    JEFFMEME
    OP
    Nov 6, 2014
    1
    http://www.v2ex.com/t/144122?p=2 这里提供的工具检测到的
    devon
    devon
    Nov 6, 2014
    2
    ➜ WireLurkerDetector git:(master) python WireLurkerDetectorOSX.py
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [-] Nothing is found.
    [+] Scanning for known suspicious files ...
    [-] Nothing is found.
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [+] Your OS X system isn't infected by the WireLurker. Thank you!
    Fatcoder
    Fatcoder
    Nov 6, 2014
    3
    可以删除了,全部, 我刚才跟你情况差不多
    JEFFMEME
    JEFFMEME
    OP
    Nov 6, 2014
    4
    @Fatcoder 嗯 有几十个。。和系统文件超级像。。被我改了名确认后删了就好了。。
    tonyleen
    tonyleen
    Nov 6, 2014
    5
    看来以后还是要少去maiyadi下载了.
    sherblue
    sherblue
    Nov 6, 2014
    6
    没中招,^ ^
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [-] Nothing is found.
    [+] Scanning for known suspicious files ...
    [-] Nothing is found.
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [+] Your OS X system isn't infected by the WireLurker. Thank you!
    lesswest
    lesswest
    Nov 6, 2014
    7
    python WireLurkerDetectorOSX.py
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [-] Nothing is found.
    [+] Scanning for known suspicious files ...
    [-] Nothing is found.
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [+] Your OS X system isn't infected by the WireLurker. Thank you!
    lesswest
    lesswest
    Nov 6, 2014
    8
    com.apple.systemkeychain-helper.plist 这个能看到你的密码吗?
    wzxjohn
    wzxjohn
    Nov 6, 2014
    9
    修改了别人写的一个脚本,添加了一些原来没删掉的文件,
    curl -sL https://qaq.moe/killer.sh | bash
    直接执行这个脚本可以删除并备份所有所有找到了的可疑文件。
    Dreista
    Dreista
    Nov 6, 2014
    10
    @wzxjohn 哈哈哈,QAQ.moe
    wzxjohn
    wzxjohn
    Nov 6, 2014 via iPhone
    11
    @Dreista 当时挑了好久注册的~我注册时包括什么weibo.moe qwq.moe之类的都没注册呢?
    Dreista
    Dreista
    Nov 6, 2014
    12
    wzxjohn
    wzxjohn
    Nov 6, 2014
    13
    @Dreista 也不错啊~
    jox
    jox
    Nov 6, 2014
    14
    。。。。。。。。。。。。。。。都是想都不想就把管理员权限交给别人么?
    aisin
    aisin
    Nov 6, 2014
    15
    vem
    vem
    Nov 7, 2014
    16
    manpath.d 也可以都删掉?
    vem
    vem
    Nov 7, 2014
    17
    找到的文件都删掉了 重启之后 貌似没什么问题
    JEFFMEME
    JEFFMEME
    OP
    Nov 9, 2014
    18
    @vem manpath.d这个是假的, 系统自己的是 manpaths.d
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Privacy   ·   Solana   ·   1049 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 43ms · UTC 22:56 · PVG 06:56 · LAX 14:56 · JFK 17:56
    ♥ Do have faith in what you're doing.