Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.sys.mac.system > #117706 > unrolled thread

Where Does Advanced Mac Cleaner Come From?

Started bycsampson@inetworld.net (Charles H. Sampson)
First post2018-08-17 12:46 -0700
Last post2018-08-19 19:27 -0700
Articles 20 on this page of 42 — 11 participants

Back to article view | Back to comp.sys.mac.system


Contents

  Where Does Advanced Mac Cleaner Come From? csampson@inetworld.net (Charles H. Sampson) - 2018-08-17 12:46 -0700
    Re: Where Does Advanced Mac Cleaner Come From? Alan Browne <bitbucket@blackhole.com> - 2018-08-17 15:59 -0400
    Re: Where Does Advanced Mac Cleaner Come From? Your Name <YourName@YourISP.com> - 2018-08-18 11:08 +1200
    Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-17 23:50 +0000
      Re: Where Does Advanced Mac Cleaner Come From? "John Varela" <newlamps@verizon.net> - 2018-08-18 01:42 +0000
        Re: Where Does Advanced Mac Cleaner Come From? Your Name <YourName@YourISP.com> - 2018-08-18 15:35 +1200
          Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-18 18:01 +0000
        Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-18 17:58 +0000
          Re: Where Does Advanced Mac Cleaner Come From? Alan Browne <bitbucket@blackhole.com> - 2018-08-19 14:52 -0400
            Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-20 00:16 +0000
            Re: Where Does Advanced Mac Cleaner Come From? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2018-08-22 23:25 +0000
    Re: Where Does Advanced Mac Cleaner Come From? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2018-08-18 03:09 +0000
      Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-18 18:01 +0000
        Re: Where Does Advanced Mac Cleaner Come From? csampson@inetworld.net (Charles H. Sampson) - 2018-08-19 00:18 -0700
          Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-19 17:00 +0000
        Re: Where Does Advanced Mac Cleaner Come From? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2018-08-19 12:34 +0000
          Re: Where Does Advanced Mac Cleaner Come From? "John Varela" <newlamps@verizon.net> - 2018-08-19 22:57 +0000
            Re: Where Does Advanced Mac Cleaner Come From? nospam <nospam@nospam.invalid> - 2018-08-19 19:03 -0400
            Re: Where Does Advanced Mac Cleaner Come From? J Burns <burns@nospam.com> - 2018-08-20 05:05 -0400
            Re: Where Does Advanced Mac Cleaner Come From? "John Varela" <newlamps@verizon.net> - 2018-08-21 01:46 +0000
          Re: Where Does Advanced Mac Cleaner Come From? J Burns <burns@nospam.com> - 2018-08-19 22:13 -0400
            Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-20 16:03 +0000
              Re: Where Does Advanced Mac Cleaner Come From? J Burns <burns@nospam.com> - 2018-08-20 16:31 -0400
                Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-20 22:42 +0000
                  Re: Where Does Advanced Mac Cleaner Come From? csampson@inetworld.net (Charles H. Sampson) - 2018-08-27 10:31 -0700
                    Re: Where Does Advanced Mac Cleaner Come From? nospam <nospam@nospam.invalid> - 2018-08-27 13:49 -0400
                    Re: Where Does Advanced Mac Cleaner Come From? Paul Sture <nospam@sture.ch> - 2018-08-27 20:39 +0200
                    Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-27 20:13 +0000
            Re: Where Does Advanced Mac Cleaner Come From? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2018-08-22 23:22 +0000
              Re: Where Does Advanced Mac Cleaner Come From? gtr <xxx@yyy.zzz> - 2018-08-29 16:45 -0700
                Re: Where Does Advanced Mac Cleaner Come From? Your Name <YourName@YourISP.com> - 2018-08-30 15:45 +1200
                Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-30 17:26 +0000
                  Re: Where Does Advanced Mac Cleaner Come From? gtr <xxx@yyy.zzz> - 2018-08-30 17:59 -0700
          Re: Where Does Advanced Mac Cleaner Come From? csampson@inetworld.net (Charles H. Sampson) - 2018-08-27 10:28 -0700
            Re: Where Does Advanced Mac Cleaner Come From? Elden <usenet@moondog.org> - 2018-09-01 12:59 -0500
            Re: Where Does Advanced Mac Cleaner Come From? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2018-09-03 03:48 +0000
        Re: Where Does Advanced Mac Cleaner Come From? csampson@inetworld.net (Charles H. Sampson) - 2018-08-19 23:57 -0700
          Re: Where Does Advanced Mac Cleaner Come From? Your Name <YourName@YourISP.com> - 2018-08-20 19:19 +1200
          Re: Where Does Advanced Mac Cleaner Come From? nospam <nospam@nospam.invalid> - 2018-08-20 09:17 -0400
          Re: Where Does Advanced Mac Cleaner Come From? Jolly Roger <jollyroger@pobox.com> - 2018-08-20 15:58 +0000
            Re: Where Does Advanced Mac Cleaner Come From? csampson@inetworld.net (Charles H. Sampson) - 2018-08-27 10:22 -0700
    Re: Where Does Advanced Mac Cleaner Come From? gtr <xxx@yyy.zzz> - 2018-08-19 19:27 -0700

Page 1 of 3  [1] 2 3  Next page →


#117706 — Where Does Advanced Mac Cleaner Come From?

Fromcsampson@inetworld.net (Charles H. Sampson)
Date2018-08-17 12:46 -0700
SubjectWhere Does Advanced Mac Cleaner Come From?
Message-ID<1ntogjr.qfo5c1c07bakN%csampson@inetworld.net>
My iMac was recently infected by Advanced Mac Cleaner. My feeble
attempts at just deleting it didn't work but I was eventually able to
get rid of it (apparently) using information I found on line.

Does anyone know how I might have picked it up? I'm pretty good about
not messing around with sites that are unfamiliar. It might have been
done by one of the other users of this computer, in which case I will
speak to him sternly.

Charlie
-- 
Nobody in this country got rich on his own.  You built a factory--good.
But you moved your goods on roads we all paid for.  You hired workers we
all paid to educate. So keep a big hunk of the money from your factory.
But take a hunk and pay it forward.  Elizabeth Warren (paraphrased)

[toc] | [next] | [standalone]


#117707

FromAlan Browne <bitbucket@blackhole.com>
Date2018-08-17 15:59 -0400
Message-ID<W8mdnWwR7rqLtOrGnZ2dnUU7-UOdnZ2d@giganews.com>
In reply to#117706
On 2018-08-17 15:46, Charles H. Sampson wrote:
> Does anyone know how I might have picked it up? I'm pretty good about
> not messing around with sites that are unfamiliar. It might have been
> done by one of the other users of this computer, in which case I will
> speak to him sternly.

Some third party s/w you (or they) installed may have "added it" as a 
courtesy for you... pay attention during installation of packages for 
the "install this shit too?" message (not that there always is one...)


-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]


#117711

FromYour Name <YourName@YourISP.com>
Date2018-08-18 11:08 +1200
Message-ID<pl7khs$2t0t$1@adenine.netfront.net>
In reply to#117706
On 2018-08-17 19:46:55 +0000, Charles H. Sampson said:

> My iMac was recently infected by Advanced Mac Cleaner. My feeble
> attempts at just deleting it didn't work but I was eventually able to
> get rid of it (apparently) using information I found on line.
> 
> Does anyone know how I might have picked it up? I'm pretty good about
> not messing around with sites that are unfamiliar. It might have been
> done by one of the other users of this computer, in which case I will
> speak to him sternly.
> 
> Charlie

Some file sharing websites have dodgey "Download" buttons that in 
reality download and install garbage. You have to carefully check what 
you are clicking is the real download link.

It might have been part of a bundle of apps you downloaded or 
installed. Some of the cheap deals websites sell such garbage.

To actually have the garbage installed though still requires someone to 
enter the computer's Admin password.

[toc] | [prev] | [next] | [standalone]


#117712

FromJolly Roger <jollyroger@pobox.com>
Date2018-08-17 23:50 +0000
Message-ID<ftp5agF80qnU1@mid.individual.net>
In reply to#117706
On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>
> My iMac was recently infected by Advanced Mac Cleaner. My feeble
> attempts at just deleting it didn't work but I was eventually able to
> get rid of it (apparently) using information I found on line.

Next time, just download and install the free version of Malwarebytes
from here, scan your system to remove baddies, then uninstall
Malwarebytes from the Malwarebytes Help menu when you are done:

<https://www.malwarebytes.com/mac-download/>

> Does anyone know how I might have picked it up? I'm pretty good about
> not messing around with sites that are unfamiliar. 

Do you download software from middle-man repositories like MacUpdate,
CNET Downloads, VersionTracker? They are well known to modify installers
injecting adware and so on to them without any developer permission or
notice to the person downloading them - an extremely nasty practice.

> It might have been done by one of the other users of this computer, in
> which case I will speak to him sternly.

Ask them the same question. Also make sure that they know that they
should *never* take any action (other than closing the window) when an
unsolicited pop-up message or website displays a message telling them
that they need to download any software.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#117713

From"John Varela" <newlamps@verizon.net>
Date2018-08-18 01:42 +0000
Message-ID<51W5y0sPNk52-pn2-2xvdc6UhT4iP@localhost>
In reply to#117712
On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
wrote:

> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
> >
> > My iMac was recently infected by Advanced Mac Cleaner. My feeble
> > attempts at just deleting it didn't work but I was eventually able to
> > get rid of it (apparently) using information I found on line.
> 
> Next time, just download and install the free version of Malwarebytes
> from here, scan your system to remove baddies, then uninstall
> Malwarebytes from the Malwarebytes Help menu when you are done:

Why delete Malwarebytes after uning it?

-- 
John Varela

[toc] | [prev] | [next] | [standalone]


#117715

FromYour Name <YourName@YourISP.com>
Date2018-08-18 15:35 +1200
Message-ID<pl845b$rmu$1@gioia.aioe.org>
In reply to#117713
On 2018-08-18 01:42:45 +0000, John Varela said:
> On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
> wrote:
>> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>>> 
>>> My iMac was recently infected by Advanced Mac Cleaner. My feeble
>>> attempts at just deleting it didn't work but I was eventually able to
>>> get rid of it (apparently) using information I found on line.
>> 
>> Next time, just download and install the free version of Malwarebytes
>> from here, scan your system to remove baddies, then uninstall
>> Malwarebytes from the Malwarebytes Help menu when you are done:
> 
> Why delete Malwarebytes after uning it?

Malwarebytes probably won't even find anything wrong since Mac Cleaner 
isn't malware as such ... it's just crapware.

[toc] | [prev] | [next] | [standalone]


#117722

FromJolly Roger <jollyroger@pobox.com>
Date2018-08-18 18:01 +0000
Message-ID<ftr572FltkpU2@mid.individual.net>
In reply to#117715
On 2018-08-18, Your Name <YourName@YourISP.com> wrote:
> On 2018-08-18 01:42:45 +0000, John Varela said:
>> On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
>> wrote:
>>> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>>>> 
>>>> My iMac was recently infected by Advanced Mac Cleaner. My feeble
>>>> attempts at just deleting it didn't work but I was eventually able to
>>>> get rid of it (apparently) using information I found on line.
>>> 
>>> Next time, just download and install the free version of Malwarebytes
>>> from here, scan your system to remove baddies, then uninstall
>>> Malwarebytes from the Malwarebytes Help menu when you are done:
>> 
>> Why delete Malwarebytes after uning it?
>
> Malwarebytes probably won't even find anything wrong since Mac Cleaner 
> isn't malware as such ... it's just crapware.

Wrong on both counts:

<https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/>

<https://forums.malwarebytes.com/topic/219340-remove-advanced-mac-cleaner/>

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#117721

FromJolly Roger <jollyroger@pobox.com>
Date2018-08-18 17:58 +0000
Message-ID<ftr51oFltkpU1@mid.individual.net>
In reply to#117713
On 2018-08-18, John Varela <newlamps@verizon.net> wrote:
> On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
> wrote:
>
>> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>> >
>> > My iMac was recently infected by Advanced Mac Cleaner. My feeble
>> > attempts at just deleting it didn't work but I was eventually able to
>> > get rid of it (apparently) using information I found on line.
>> 
>> Next time, just download and install the free version of Malwarebytes
>> from here, scan your system to remove baddies, then uninstall
>> Malwarebytes from the Malwarebytes Help menu when you are done:
>
> Why delete Malwarebytes after uning it?

Because Mac anti-malware utilities are notorious for introducing their
own instability, performance, and security vulnerabilities to Macs. A
few - out of many - examples:

In 2005, Norton AntiVirus for Mac errantly identified the virtual memory
swap files created and used by macOS as malware and quarantined them,
preventing macOS from using them. Needless to say, that did not end well
for the unfortunate Mac users who were affected.

Also in 2005, a critical flaw was found in Norton AntiVirus where during
decompression of RAR files it was vulnerable to multiple heap overflows
allowing attackers complete control of the system being protected. The
vulnerability could be exploited remotely without user interaction in
default configurations through common protocols such as SMTP. 

Version 9.0 of Norton Antivirus created a huge file appropriately named
"spacesuckingfile.xxxxxx" after it completed a virus scan, which was
supposed to be a temporary file that it created when scanning archives
on the computer to help determine the amount of free space available on
the disk before it began decompressing and scanning archives on the
computer. Unfortunately, in some situations, Norton AntiVirus would fail
to delete this file once scanning the archives was complete.

In 2009, the AutoProtect component of Symantec's Norton AntiVirus under
Mac OS introduced an issue with apparent corruption of Mac OS X temp
files that resulted in spiking processor usage and complete system
unresponsiveness.

Also in 2009, Sophos AntiVirus software generated false positives for
the "OSX/Inqtana.B worm", invoking users to delete critical application
and system files and causing serious issues. Inqtana.B was a variant of
OSX/Inqtana.A -- a Java based proof of concept bluetooth worm that
affects older versions of Mac OS X 10.4. The vulnerability did not
affect Mac OS X 10.4.5 or Mac OS X 10.4.6, and had not been found in the
wild. Despite that, Sophos' software was identifying supposedly
"infected" files -- sometimes numbering in the thousands -- on Mac OS X
10.4.5 systems. And this isn't limited to Avast, either!

In 2015, Avast AntiVirus was caught using a man-in-the-middle attack to
intercept encrypted https traffic which put banking, online shopping,
and other critical private information at risk of being divulged by
third parties. So by installing Avast, people's credit card details,
private prescriptions, banking details, and any other private
information they exchanged with any website was all open to being
inspected by them (and anyone who compromised their buggy application).

In 2017, Google security researchers discovered a critical vulnerability
in ESET's Endpoint Antivirus 6 that exposed Macs to remote hacking. An
update made to ESET’s antivirus package in October 2016 contained an
outdated XML parsing library from 2007. The result was that vulnerable
versions of ESET Endpoint Antivirus 6 didn't perform perform proper
server authentication, allowing for remote unauthenticated attackers to
perform arbitrary code execution as root on vulnerable clients. Once
they have the ability to push root-level code execution, hackers can
wreak a significant amount of havoc.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#117751

FromAlan Browne <bitbucket@blackhole.com>
Date2018-08-19 14:52 -0400
Message-ID<qtudnaH1JaXsIeTGnZ2dnUU7-a3NnZ2d@giganews.com>
In reply to#117721
On 2018-08-18 13:58, Jolly Roger wrote:
> On 2018-08-18, John Varela <newlamps@verizon.net> wrote:
>> On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
>> wrote:
>>
>>> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>>>>
>>>> My iMac was recently infected by Advanced Mac Cleaner. My feeble
>>>> attempts at just deleting it didn't work but I was eventually able to
>>>> get rid of it (apparently) using information I found on line.
>>>
>>> Next time, just download and install the free version of Malwarebytes
>>> from here, scan your system to remove baddies, then uninstall
>>> Malwarebytes from the Malwarebytes Help menu when you are done:
>>
>> Why delete Malwarebytes after uning it?
> 
> Because Mac anti-malware utilities are notorious for introducing their
> own instability, performance, and security vulnerabilities to Macs. 

For those apps you mentioned, perhaps, but Malwarebytes (even the 
resident version) has been unobtrusive and stable on 3 Macs under my 
direct control, and a couple others at work.

Currently 3.3.32, non-Premium (ie: Unlicensed).


-- 
"2/3 of Donald Trump's wives were immigrants.  Proof that we
  need immigrants to do jobs that most Americans wouldn't do."
                                           - unknown protester

[toc] | [prev] | [next] | [standalone]


#117757

FromJolly Roger <jollyroger@pobox.com>
Date2018-08-20 00:16 +0000
Message-ID<ftufjoFejmqU1@mid.individual.net>
In reply to#117751
On 2018-08-19, Alan Browne <bitbucket@blackhole.com> wrote:
> On 2018-08-18 13:58, Jolly Roger wrote:
>> On 2018-08-18, John Varela <newlamps@verizon.net> wrote:
>>> On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
>>> wrote:
>>>
>>>> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>>>>>
>>>>> My iMac was recently infected by Advanced Mac Cleaner. My feeble
>>>>> attempts at just deleting it didn't work but I was eventually able to
>>>>> get rid of it (apparently) using information I found on line.
>>>>
>>>> Next time, just download and install the free version of Malwarebytes
>>>> from here, scan your system to remove baddies, then uninstall
>>>> Malwarebytes from the Malwarebytes Help menu when you are done:
>>>
>>> Why delete Malwarebytes after uning it?
>> 
>> Because Mac anti-malware utilities are notorious for introducing their
>> own instability, performance, and security vulnerabilities to Macs. 
>
> For those apps you mentioned, perhaps, but Malwarebytes (even the 
> resident version) has been unobtrusive and stable

I'm more concerned with security than you then:

<https://malwaretips.com/threads/malwarebytes-starts-bug-bounty-program-after-discovery-of-vulnerabilities.55899/>

Like I said, they are notorious for this sort of thing, and yes, that
includes Malwarebytes. No thanks.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#117794

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2018-08-22 23:25 +0000
Message-ID<slrnpnrs7o.133b.g.kreme@jaka.lan>
In reply to#117751
In message <qtudnaH1JaXsIeTGnZ2dnUU7-a3NnZ2d@giganews.com> Alan Browne <bitbucket@blackhole.com> wrote:
> On 2018-08-18 13:58, Jolly Roger wrote:
>> On 2018-08-18, John Varela <newlamps@verizon.net> wrote:
>>> On Fri, 17 Aug 2018 23:50:40 UTC, Jolly Roger <jollyroger@pobox.com>
>>> wrote:
>>>
>>>> On 2018-08-17, Charles H. Sampson <csampson@inetworld.net> wrote:
>>>>>
>>>>> My iMac was recently infected by Advanced Mac Cleaner. My feeble
>>>>> attempts at just deleting it didn't work but I was eventually able to
>>>>> get rid of it (apparently) using information I found on line.
>>>>
>>>> Next time, just download and install the free version of Malwarebytes
>>>> from here, scan your system to remove baddies, then uninstall
>>>> Malwarebytes from the Malwarebytes Help menu when you are done:
>>>
>>> Why delete Malwarebytes after uning it?
>> 
>> Because Mac anti-malware utilities are notorious for introducing their
>> own instability, performance, and security vulnerabilities to Macs. 

> For those apps you mentioned, perhaps, but Malwarebytes (even the 
> resident version) has been unobtrusive and stable on 3 Macs under my 
> direct control, and a couple others at work.

You should keep up to date with the news then.

-- 
On a scale of one to ten, it sucked.

[toc] | [prev] | [next] | [standalone]


#117714

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2018-08-18 03:09 +0000
Message-ID<slrnpnf3fh.1d0j.g.kreme@jaka.lan>
In reply to#117706
In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
> Does anyone know how I might have picked it up? I'm pretty good about
> not messing around with sites that are unfamiliar. It might have been
> done by one of the other users of this computer, in which case I will
> speak to him sternly.

It is generally installed by the user, often without their explicit
knowledge as it will be a "feature" of a downloaded installer.

-- 
e DID NOT SEE ELVIS Bart chalkboard Ep. 7G07

[toc] | [prev] | [next] | [standalone]


#117723

FromJolly Roger <jollyroger@pobox.com>
Date2018-08-18 18:01 +0000
Message-ID<ftr58kFltkpU3@mid.individual.net>
In reply to#117714
On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
>> Does anyone know how I might have picked it up? I'm pretty good about
>> not messing around with sites that are unfamiliar. It might have been
>> done by one of the other users of this computer, in which case I will
>> speak to him sternly.
>
> It is generally installed by the user, often without their explicit
> knowledge as it will be a "feature" of a downloaded installer.

In this case, very likely a fake "Adobe Flash" installer:

<https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/>

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#117737

Fromcsampson@inetworld.net (Charles H. Sampson)
Date2018-08-19 00:18 -0700
Message-ID<1ntr7ba.qeik288r1k8aN%csampson@inetworld.net>
In reply to#117723
Jolly Roger <jollyroger@pobox.com> wrote:

> On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> > In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson
> > <csampson@inetworld.net> wrote:
> >> Does anyone know how I might have picked it up? I'm pretty good about
> >> not messing around with sites that are unfamiliar. It might have been
> >> done by one of the other users of this computer, in which case I will
> >> speak to him sternly.
> >
> > It is generally installed by the user, often without their explicit
> > knowledge as it will be a "feature" of a downloaded installer.
> 
> In this case, very likely a fake "Adobe Flash" installer:

Aha! Just before the Advanced Mac Cleaner problem arose, I had an Adobe
Flash installer that came close to taking over the computer. I did such
heroic things as rebooting to get rid of it. I haven't read your link
yet, but I will. (It's 12:15 a.m.)

> <https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-
> installs-configuration-profiles-on-macs/>

Charlie
-- 
Nobody in this country got rich on his own.  You built a factory--good.
But you moved your goods on roads we all paid for.  You hired workers we
all paid to educate. So keep a big hunk of the money from your factory.
But take a hunk and pay it forward.  Elizabeth Warren (paraphrased)

[toc] | [prev] | [next] | [standalone]


#117749

FromJolly Roger <jollyroger@pobox.com>
Date2018-08-19 17:00 +0000
Message-ID<fttm13F91b2U1@mid.individual.net>
In reply to#117737
On 2018-08-19, Charles H. Sampson <csampson@inetworld.net> wrote:
> Jolly Roger <jollyroger@pobox.com> wrote:
>
>> On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>> > In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson
>> > <csampson@inetworld.net> wrote:
>> >> Does anyone know how I might have picked it up? I'm pretty good about
>> >> not messing around with sites that are unfamiliar. It might have been
>> >> done by one of the other users of this computer, in which case I will
>> >> speak to him sternly.
>> >
>> > It is generally installed by the user, often without their explicit
>> > knowledge as it will be a "feature" of a downloaded installer.
>> 
>> In this case, very likely a fake "Adobe Flash" installer:
>
> Aha! Just before the Advanced Mac Cleaner problem arose, I had an Adobe
> Flash installer

Yes and you downloaded that "Flash" installer from a strange website.
There is no need to have Flash installed these days in macOS. If a
website claims you need Flash to watch a video, just go to the Safari
Develop menu and choose User Agent > and iOS string in the list. Like
magic, the video will play.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#117742

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2018-08-19 12:34 +0000
Message-ID<slrnpniouo.2c5q.g.kreme@jaka.lan>
In reply to#117723
In message <ftr58kFltkpU3@mid.individual.net> Jolly Roger <jollyroger@pobox.com> wrote:
> On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>> In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
>>> Does anyone know how I might have picked it up? I'm pretty good about
>>> not messing around with sites that are unfamiliar. It might have been
>>> done by one of the other users of this computer, in which case I will
>>> speak to him sternly.
>>
>> It is generally installed by the user, often without their explicit
>> knowledge as it will be a "feature" of a downloaded installer.

> In this case, very likely a fake "Adobe Flash" installer:

Then it's really hard to have any sympathy. Anyone dumb enough to
install Flash...

> <https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/>



-- 
'Ah... I see that the new traffic division is having the desired
effect.' He indicated a large pile of paper. 'I am getting any amount of
complaints from the Carters' and Drovers' Guild. Well done. Do pass on
my thanks to Sergeant Colon and his team.' 'I will, sir.' 'I see in one
day they clamped seventeen carts, ten horses, eighteen oxen and one
duck.' 'It was parked illegally, sir.'

[toc] | [prev] | [next] | [standalone]


#117755

From"John Varela" <newlamps@verizon.net>
Date2018-08-19 22:57 +0000
Message-ID<51W5y0sPNk52-pn2-dXdq8ZuEzOdF@localhost>
In reply to#117742
On Sun, 19 Aug 2018 12:34:32 UTC, Lewis 
<g.kreme@gmail.com.dontsendmecopies> wrote:

> In message <ftr58kFltkpU3@mid.individual.net> Jolly Roger <jollyroger@pobox.com> wrote:
> > On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> >> In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
> >>> Does anyone know how I might have picked it up? I'm pretty good about
> >>> not messing around with sites that are unfamiliar. It might have been
> >>> done by one of the other users of this computer, in which case I will
> >>> speak to him sternly.
> >>
> >> It is generally installed by the user, often without their explicit
> >> knowledge as it will be a "feature" of a downloaded installer.
> 
> > In this case, very likely a fake "Adobe Flash" installer:
> 
> Then it's really hard to have any sympathy. Anyone dumb enough to
> install Flash...

Well, I installed Flash on Firefox (not Safari, Chrome, or Opera) 
ages ago and I can't find any way to get rid of it. 

Flash is marked in Firefox Preferences to "Never Activate" but I'd 
be happy to be rid of it entirely if only I knew how.

-- 
John Varela

[toc] | [prev] | [next] | [standalone]


#117756

Fromnospam <nospam@nospam.invalid>
Date2018-08-19 19:03 -0400
Message-ID<190820181903295184%nospam@nospam.invalid>
In reply to#117755
In article <51W5y0sPNk52-pn2-dXdq8ZuEzOdF@localhost>, John Varela
<newlamps@verizon.net> wrote:

> > Then it's really hard to have any sympathy. Anyone dumb enough to
> > install Flash...
> 
> Well, I installed Flash on Firefox (not Safari, Chrome, or Opera) 
> ages ago and I can't find any way to get rid of it. 
>
> Flash is marked in Firefox Preferences to "Never Activate" but I'd 
> be happy to be rid of it entirely if only I knew how.

<https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-mac-os.h
tml>
  Solution: Download and run the uninstaller
  ...

[toc] | [prev] | [next] | [standalone]


#117769

FromJ Burns <burns@nospam.com>
Date2018-08-20 05:05 -0400
Message-ID<ple08q$h8s$1@dont-email.me>
In reply to#117755
On 8/19/18 6:57 PM, John Varela wrote:
> On Sun, 19 Aug 2018 12:34:32 UTC, Lewis
> <g.kreme@gmail.com.dontsendmecopies> wrote:
> 
>> In message <ftr58kFltkpU3@mid.individual.net> Jolly Roger <jollyroger@pobox.com> wrote:
>>> On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>>>> In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
>>>>> Does anyone know how I might have picked it up? I'm pretty good about
>>>>> not messing around with sites that are unfamiliar. It might have been
>>>>> done by one of the other users of this computer, in which case I will
>>>>> speak to him sternly.
>>>>
>>>> It is generally installed by the user, often without their explicit
>>>> knowledge as it will be a "feature" of a downloaded installer.
>>
>>> In this case, very likely a fake "Adobe Flash" installer:
>>
>> Then it's really hard to have any sympathy. Anyone dumb enough to
>> install Flash...
> 
> Well, I installed Flash on Firefox (not Safari, Chrome, or Opera)
> ages ago and I can't find any way to get rid of it.
> 
> Flash is marked in Firefox Preferences to "Never Activate" but I'd
> be happy to be rid of it entirely if only I knew how.
> 
<https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-mac-os.html#main_uninstall>

[toc] | [prev] | [next] | [standalone]


#117784

From"John Varela" <newlamps@verizon.net>
Date2018-08-21 01:46 +0000
Message-ID<51W5y0sPNk52-pn2-XLF5SEsvD4uZ@localhost>
In reply to#117755
On Sun, 19 Aug 2018 22:57:13 UTC, "John Varela" 
<newlamps@verizon.net> wrote:

> On Sun, 19 Aug 2018 12:34:32 UTC, Lewis 
> <g.kreme@gmail.com.dontsendmecopies> wrote:
> 
> > In message <ftr58kFltkpU3@mid.individual.net> Jolly Roger <jollyroger@pobox.com> wrote:
> > > On 2018-08-18, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> > >> In message <1ntogjr.qfo5c1c07bakN%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
> > >>> Does anyone know how I might have picked it up? I'm pretty good about
> > >>> not messing around with sites that are unfamiliar. It might have been
> > >>> done by one of the other users of this computer, in which case I will
> > >>> speak to him sternly.
> > >>
> > >> It is generally installed by the user, often without their explicit
> > >> knowledge as it will be a "feature" of a downloaded installer.
> > 
> > > In this case, very likely a fake "Adobe Flash" installer:
> > 
> > Then it's really hard to have any sympathy. Anyone dumb enough to
> > install Flash...
> 
> Well, I installed Flash on Firefox (not Safari, Chrome, or Opera) 
> ages ago and I can't find any way to get rid of it. 
> 
> Flash is marked in Firefox Preferences to "Never Activate" but I'd 
> be happy to be rid of it entirely if only I knew how.
 
Thanks for the responses.

-- 
John Varela

[toc] | [prev] | [next] | [standalone]


Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.sys.mac.system


csiph-web