V2EX = way to explore
V2EX 是一个关于分享和探索的地方
Sign Up Now
For Existing Member  Sign In
JEFFMEME
V2EX  ›  macOS

中招了,请问这些目录文件可以删除么

  •  
  •   JEFFMEME · Nov 6, 2014 · 8091 views
    This topic created in 4199 days ago, the information mentioned may be changed or developed.
    中招了,请问这些目录文件可以删除么,大家是如何处理的

    python WireLurkerDetectorOSX.py
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [!] Found malicious file: /Library/LaunchDaemons/com.apple.machook_damon.plist
    [!] Found malicious file: /usr/bin/WatchProc
    [!] Found malicious file: /usr/bin/itunesupdate
    [!] Found malicious file: /Library/LaunchDaemons/com.apple.watchproc.plist
    [!] Found malicious file: /Library/LaunchDaemons/com.apple.itunesupdate.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.appstore.plughelper.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.MailServiceAgentHelper.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.systemkeychain-helper.plist
    [!] Found malicious file: /System/Library/LaunchDaemons/com.apple.periodic-dd-mm-yy.plist
    [!] Found malicious file: /usr/bin/com.apple.MailServiceAgentHelper
    [!] Found malicious file: /usr/bin/com.apple.appstore.PluginHelper
    [!] Found malicious file: /usr/bin/periodicdate
    [!] Found malicious file: /usr/bin/systemkeychain-helper
    [!] Found malicious file: /usr/bin/stty5.11.pl
    [+] Scanning for known suspicious files ...
    [!] Found suspicious file: /etc/manpath.d/
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [!] WARNING: Your OS X system is highly suspicious of being infected by the WireLurker.
    [!] You may need to delete all malicious or suspicious files and/or applications above.
    18 replies    2014-11-09 10:03:53 +08:00
    JEFFMEME
        1
    JEFFMEME  
    OP
       Nov 6, 2014
    http://www.sunp.eu.org/t/144122?p=2 这里提供的工具检测到的
    devon
        2
    devon  
       Nov 6, 2014
    ➜ WireLurkerDetector git:(master) python WireLurkerDetectorOSX.py
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [-] Nothing is found.
    [+] Scanning for known suspicious files ...
    [-] Nothing is found.
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [+] Your OS X system isn't infected by the WireLurker. Thank you!
    Fatcoder
        3
    Fatcoder  
       Nov 6, 2014
    可以删除了,全部, 我刚才跟你情况差不多
    JEFFMEME
        4
    JEFFMEME  
    OP
       Nov 6, 2014
    @Fatcoder 嗯 有几十个。。和系统文件超级像。。被我改了名确认后删了就好了。。
    tonyleen
        5
    tonyleen  
       Nov 6, 2014
    看来以后还是要少去maiyadi下载了.
    sherblue
        6
    sherblue  
       Nov 6, 2014
    没中招,^ ^
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [-] Nothing is found.
    [+] Scanning for known suspicious files ...
    [-] Nothing is found.
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [+] Your OS X system isn't infected by the WireLurker. Thank you!
    lesswest
        7
    lesswest  
       Nov 6, 2014
    python WireLurkerDetectorOSX.py
    WireLurker Detector (version 1.0.0)
    Copyright (c) 2014, Palo Alto Networks, Inc.

    [+] Scanning for known malicious files ...
    [-] Nothing is found.
    [+] Scanning for known suspicious files ...
    [-] Nothing is found.
    [+] Scanning for infected applications ... (may take minutes)
    [-] Nothing is found.
    [+] Your OS X system isn't infected by the WireLurker. Thank you!
    lesswest
        8
    lesswest  
       Nov 6, 2014
    com.apple.systemkeychain-helper.plist 这个能看到你的密码吗?
    wzxjohn
        9
    wzxjohn  
       Nov 6, 2014
    修改了别人写的一个脚本,添加了一些原来没删掉的文件,
    curl -sL https://qaq.moe/killer.sh | bash
    直接执行这个脚本可以删除并备份所有所有找到了的可疑文件。
    Dreista
        10
    Dreista  
       Nov 6, 2014
    @wzxjohn 哈哈哈,QAQ.moe
    wzxjohn
        11
    wzxjohn  
       Nov 6, 2014 via iPhone
    @Dreista 当时挑了好久注册的~我注册时包括什么weibo.moe qwq.moe之类的都没注册呢?
    Dreista
        12
    Dreista  
       Nov 6, 2014
    wzxjohn
        13
    wzxjohn  
       Nov 6, 2014
    @Dreista 也不错啊~
    jox
        14
    jox  
       Nov 6, 2014
    。。。。。。。。。。。。。。。都是想都不想就把管理员权限交给别人么?
    aisin
        15
    aisin  
       Nov 6, 2014
    vem
        16
    vem  
       Nov 7, 2014
    manpath.d 也可以都删掉?
    vem
        17
    vem  
       Nov 7, 2014
    找到的文件都删掉了 重启之后 貌似没什么问题
    JEFFMEME
        18
    JEFFMEME  
    OP
       Nov 9, 2014
    @vem manpath.d这个是假的, 系统自己的是 manpaths.d
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   3274 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 87ms · UTC 12:26 · PVG 20:26 · LAX 05:26 · JFK 08:26
    ♥ Do have faith in what you're doing.