Virus on Mac
We've got a customer who has a 2012 iMac running Lion 10.7.5, they are also running Virus Barrier X6 which is flagging up that the Mac has a 'P,3,script' threat
This keeps flagging up on various files, not being a Mac user myself i really could do with some assistance with this.
Thanks in advance.
This keeps flagging up on various files, not being a Mac user myself i really could do with some assistance with this.
Thanks in advance.
ASKER
Ok here's a snip from the virus log
Status Threat
Date 21/09/2013 13:20:53
Comment Malware ' P,3,script' detected in file 'DeviceMatchingInfo.plist …'
Path /System/Library/Image Capture/Devices/MassStorag
User gayyee (501)
Status Information
Date 21/09/2013 13:20:55
Comment File 'DeviceMatchingInfo.plist …' was added to the quarantine zone
Path /System/Library/Image Capture/Devices/MassStorag
User gayyee (501)
Status Threat
Date 21/09/2013 13:20:56
Comment Malware ' P,3,script' detected in file 'DeviceMatchingInfo.plist …'
Path /System/Library/Image Capture/Devices/Type8Camer
User gayyee (501)
Status Information
Date 21/09/2013 13:21:02
Comment File 'DeviceMatchingInfo.plist …' was added to the quarantine zone
Path /System/Library/Image Capture/Devices/Type8Camer
User gayyee (501)
Status Threat
Date 21/09/2013 13:20:53
Comment Malware ' P,3,script' detected in file 'DeviceMatchingInfo.plist …'
Path /System/Library/Image Capture/Devices/MassStorag
User gayyee (501)
Status Information
Date 21/09/2013 13:20:55
Comment File 'DeviceMatchingInfo.plist …' was added to the quarantine zone
Path /System/Library/Image Capture/Devices/MassStorag
User gayyee (501)
Status Threat
Date 21/09/2013 13:20:56
Comment Malware ' P,3,script' detected in file 'DeviceMatchingInfo.plist …'
Path /System/Library/Image Capture/Devices/Type8Camer
User gayyee (501)
Status Information
Date 21/09/2013 13:21:02
Comment File 'DeviceMatchingInfo.plist …' was added to the quarantine zone
Path /System/Library/Image Capture/Devices/Type8Camer
User gayyee (501)
I have no direct experience with VirusBarrier, but those files match USB devices to cameras. It looks like you can add that folder to the Trusted Items list and also remove the quarantine marker from Finder items in the program's options.
http://www.intego.com/manuals/en/rg/vbx6-reviewers-guide.html
Run a permissions repair also on the drive, and get ESET or BitDefender. It's the only AVs I've used on Macs that work properly.
http://www.intego.com/manuals/en/rg/vbx6-reviewers-guide.html
Run a permissions repair also on the drive, and get ESET or BitDefender. It's the only AVs I've used on Macs that work properly.
As TMekeel said, these are almost certainly false positives.
.plist files are Apple preference files, not executables. If you want, you can simply delete them. The OS will create them afresh as needed. You might lose some user settings for camera import in the process, but the user can re-create them.
.plist files are Apple preference files, not executables. If you want, you can simply delete them. The OS will create them afresh as needed. You might lose some user settings for camera import in the process, but the user can re-create them.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Well the plot thickens a little, i had to repair the permissions, i then verified the disk and this has shown that the disk has corruption. I'm just running a repair now.
Maybe as simple as corrupted camera driver files having the appearance of a piece of malware... keep us posted please!
ASKER
Well i repaired the permissions and then ran a repair on the disk, this made no difference, however i found that there is a free update to Virus Barrier 2013, installed this and rebooted and now all is well.
...and it's not even Friday yet! Happy days :)
The new scanning engine in VB 2013 will have an updated db and heuristic rules.
The new scanning engine in VB 2013 will have an updated db and heuristic rules.
What files or what sort of files are being flagged?
Can you post the scan log file?