Update on Mac Malware

Yesterday I posted about malware that infected my wife's Mac computer. As soon as I published the article, I checked to see if my wife had taken her laptop to work. She hadn't and so I brought it down to my office and ran one more test. I ran yesterday's "find" command prefaced with "sudo" so it looked like this:

sudo find / -name AccessibleEngineSearch -print

The "sudo" command tells the operating system to run as the super-user with permissions. You will need to enter a password before the command runs. Sudo enabled the command to look into more directories than when I ran it the previous day. I found one more instance of the "AccessibleEngineSearch" malware in the startup directory. That means whenever the computer started up, it would try to load the malware. I removed the file and rebooted the laptop. I no longer receive the message telling me that AccessibleEngineSearch can hurt the computer.

My wife came home for lunch as she works less than a mile away and I shared with her that I completely removed the malware from her computer. She also shared that she went through her Applications directory and deleted a number of programs that she didn't recognize. That is another important task when you discover malware on your computer. I didn't feel comfortable doing that as I didn't know if my wife installed a useful utility. I'm glad she took care of it.

As I mentioned, Mac's don't get a lot of malware. When they do, the operating system can keep a lot of damage from happening. It is also fairly easy to remove the offending programs. One still needs to be careful though as bad things can happen on a Mac.

Malware on a Mac

Yesterday my wife came home from a very busy day as her office switches from locally hosted software to web based. She is the one spearheading the project and yesterday they went live on the new system. Naturally there are some first-day pains as the staff try to figure out how to do things using the new and unfamiliar software. To make matters worse, my wife's Mac picked up some malware.

I happened to be in an online meeting when my wife came home and so when the meeting ended, I left my office to ask my wife how her day went. She seemed extremely frazzled and started talking quickly about how the new software has everyone anxious and to top things off, her computer had a virus. My wife is not very technical and so I asked how she knew her computer has a virus. She opened her laptop and showed me a message about "AccessibleEngineSearch will damage your computer."

The message told me that the Mac operating system smartly caught the problem. Unfortunately it rendered the computer unusable. When I clicked on the message to dismiss it, I had about 3 seconds before the message reappeared. It is a good thing I have another computer in the house to help me fix the problem. I quickly did an Internet search and came across several websites explaining how to remove the offending program.

AccessibleEngineSearch is a browser hijacker that throws up unwanted advertisements in your browser. The trick to eliminating it is hunting down all of the files that have infected the computer and removing them. I started with the documented ones:

• ~/Library/Application Support/com.AccessibleEngineSearch/AccessibleEngineSearch
• ~/Library/Application Support/com.AccessibleEngineSearchDaemon/AccessibleEngineSearch
• ~/Library/LaunchAgents/com.AccessibleEngineSearch.plist
• ~/Library/LaunchDaemons/com.AccessibleEngineSearchDaemon.plist

I then emptied the trash and rebooted the computer. Things improved but I still kept getting the message and so I did a bit more searching. This time I pulled out my Unix skills and opened the command prompt. I then ran the following "find" command to look for all instances of AccessibleEngineSearch on the computer:

find / -name AccessibleEngineSearch -print

 If you are not familiar with the "find" command found in all flavors of Unix and Linux, the first argument tells the command where to start looking. I specified the / or root directory so that it would search the entire file system. The next argument is where you specify the name of the file you are looking for. Finally there is the -print on the end that specifies to print the results on the screen.

Naturally I got a lot of "permission denied" errors because I ran it as a user and not the superuser. It still gave me 2 directories that I found and deleted. Once again, I rebooted the machine and the errors disappeared.

Reading through various websites on this issue, I saw the recommendation to install Malwarebytes. I installed the free version and ran a scan of the computer. It found 30 other files infected with some sort of malware. I quarantined the files in question hoping that the computer is clean. Then I rebooted the computer once more.

Unfortunately there is a message about AccessibileEngineSearch when I start the computer and log in. Once I dismiss the message, it doesn't reappear and so I imagine there is one more file hanging around in the system loading area. It probably is in one of those directories I didn't have permission to read when I ran my find command above. I can rerun the command prefaced with "sudo" and eliminate the problem for good.

One of my favorite things about the Mac is that it doesn't get many computer viruses or malware. Unfortunately that has made me a little lazy about protecting them. As shown by the scan on my wife's computer, they do exist and are need to be addressed. You can say I've learned my lesson.

A Virus on my Mac Computer

My daughter just headed to Alaska for the summer to be a kayak guide. My wife and I would like to go up and visit so we started planning a trip. Unfortunately rental cars are really expensive in Alaska and so I started shopping around to some of the more inexpensive agencies. I got an e-mail from Dollar Rental Car and so I decided to check them out. Unfortunately when I tried to go to the site, it said my computer had a virus and wouldn't let me in.

Whenever I see a virus warning in my browser, I don't pay it much mind as it is very difficult for a website to scan your computer that quickly and determine you have a virus. More than likely there is a setting in your browser that it doesn't like and throws up a message indicating you could have a virus. It is better to be safe so I did a bit of checking.

The first thing I did was go to Dollar's website on another computer. I did not receive the offending message and so I knew it was not their website giving a blanket message. Next I tried another browser on my Mac. I have Safari, Chrome, and Firefox. Normally I use Firefox and so I tried Chrome. That worked fine and my guess is that I have a setting in Firefox that Dollar doesn't like.

Next I looked into finding some antivirus software for the Mac. This is where things get tricky. Doing a search can often lead you to false solutions that actually install malware or a virus on your computer. I went to a reputable source to see what the best antivirus software is. There are a number to choose from and some are better than others. I ran through several reviews and found a free one that I trust. The downside of free is that you are always being prompted to upgrade to the paid version. I'm willing to live with that for now. The free versions also don't have all of the features in the paid ones and so if you need something more than bare-bones functionality, you may need to shell out a bit of money.

I suppose it is better to be overly cautious and report potential problems instead of ignoring real ones. It has discouraged me from renting a car from Dollar because I cannot trust their website. Fortunately they are no cheaper than some of the larger brand rental car companies. Ultimately I will probably end up using Turo anyways as they have the best deals for rental cars in Alaska.

Ransomware and Backups

I few days ago I was watching TV and saw an ad for a local computer store in Utah. The owner of the store talked about a new kind of computer virus called Ransomware. As I use only Mac or Linux and not Windows, I really don't worry about computer viruses. While a protected operating system doesn't guaranty you won't get a virus, it makes writing viruses really difficult and so most hackers don't even bother. Besides Windows has the majority of the market and so if you are going to extort money from unsuspecting computer users, that is where you will make the most.

Today I discovered that most of the antivirus software vendors have been able to lock out the majority of ransomware. That doesn't stop would-be extortionists from trying though. There is another class of ransomware that lacks any real ability to harm your computer. Basically you go to a web page that claims you have done something criminal like downloaded music illegally, or worse. You are then told you have several hours to pay a "forgiveness" fine. When you try to leave the web page, you are unable to do so. When you try to close your browser, you can't. For the unsuspecting user, this can be very frustrating. The trick is to kill your browser from the operating system. PC Magazine has an article outlining the steps if you need help.

The best thing you can do to keep yourself safe from any computer virus is to back up your hard disk frequently. I like to keep my computers backed up locally. That means I use a portable hard drive, Burnable DVD's, or some other form of backup media and keep the data myself. There are a number of online backup companies that also work well. It doesn't matter what you do, just make sure you back up the important stuff. Then when some website tells you to send them money or you will never see your stupid cat videos again, you can rest assured knowing you've got a nice copy of your important data.