Forums
New posts
Articles
Product Reviews
Policies
FAQ
Log in
Register
What's new
Search
Search
Search titles only
By:
New posts
Menu
Log in
Register
Install the app
Install
Forums
Apple Computing Products:
macOS - Operating System
.rserv virus?
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Reply to thread
Message
<blockquote data-quote="rez" data-source="post: 1390130" data-attributes="member: 228220"><p>If you get to the last post on that Thread, it suggests that the trojan will delete itself, if it finds Little Snitch, Xcode or Clamxav applications, all of which I have. Yet it still tried to connect to the cuojshtbohnt.com address, making me think this is something else. </p><p></p><p>Interesting, when running the command: launchctl list com.adobe.reader</p><p></p><p>"Label" = "com.adobe.reader";</p><p> "LimitLoadToSessionType" = "Aqua";</p><p> "OnDemand" = true;</p><p> "LastExitStatus" = 256;</p><p> "TimeOut" = 30;</p><p> "StandardOutPath" = "/dev/null";</p><p> "StandardErrorPath" = "/dev/null";</p><p> "ProgramArguments" = (</p><p> "/Volumes/Macintosh HD/Users/ryanhall/.rserv";</p><p></p><p>Enough evidence to suggest its related to flash player update version? I'm pretty sure I didn't fall for that. </p><p></p><p>MacScan still in progress.</p></blockquote><p></p>
[QUOTE="rez, post: 1390130, member: 228220"] If you get to the last post on that Thread, it suggests that the trojan will delete itself, if it finds Little Snitch, Xcode or Clamxav applications, all of which I have. Yet it still tried to connect to the cuojshtbohnt.com address, making me think this is something else. Interesting, when running the command: launchctl list com.adobe.reader "Label" = "com.adobe.reader"; "LimitLoadToSessionType" = "Aqua"; "OnDemand" = true; "LastExitStatus" = 256; "TimeOut" = 30; "StandardOutPath" = "/dev/null"; "StandardErrorPath" = "/dev/null"; "ProgramArguments" = ( "/Volumes/Macintosh HD/Users/ryanhall/.rserv"; Enough evidence to suggest its related to flash player update version? I'm pretty sure I didn't fall for that. MacScan still in progress. [/QUOTE]
Verification
Post reply
Forums
Apple Computing Products:
macOS - Operating System
.rserv virus?
Top