3 ms·
Just an anecdatum: I got infected by this yesterday when I installed Transmission to download a Debian install CD. When I read about this at MacRumors I checked
by jws 11y ago
Just an anecdatum: I got infected by this yesterday when I installed Transmission to download a Debian install CD. When I read about this at MacRumors I checked and had the kernel_service process running and the two hidden files hiding in Library.
I've unplugged and archived the TimeMachine backup disk and done the prescribed cleanup actions to remove he malware. I guess time will tell if it had any other tricks up its sleeve.
- leonroy 11y agoDo a search for any files in /Users and connected volumes which are suffixed with .encrypted. Apparently that's the interim filename suffix used by the malware.
- jws 11y agoThanks, I appear to be clear of .encrypted files. The good of this mess is that I realized I only had one Time Machine backup going on that machine. I had turned off the remote backup a month ago while shoving backups around on the remote server to make more room and hadn't restored it. One backup is too few. The weakness exposed is that if the remote were mounted, this malware would have nailed it too. I'll have to look at having the remote make filesystem snapshots on its end so malware can't corrupt my older backups.