Adware found. ? This is a first in 29 years of mac use.

[macgig]

so I was reading a post about anti virus, and decided to take Randy's advice.... install virus barrier... and low and behold it found adware in my library folder... OSX/Conduit.A. No idea how it got there? I download and install few things on this mac, and almost always use the app store with a few exceptions. These days you never know... Ive seen stuff by "conduit" a lot on PCs when I removed viruses for people... interesting. Odd that malwarebytes never finds anything.

View attachment 31752

 

[ferrarr]

What is Conduit? Is it an app or an extension your use?

 

[macgig]

I don't have any apps or extensions that use that name. so I"m a little baffled how it got here. wonder what it was doing, I never got any popups or weird behavior that I've noticed. Conduit is something I've seen on the PC side when removing viruses....

this is interesting reading it now.

another link about Conduit

also, where does malwarebytes scan? it scanned a total of 13,760 files and it was done... found nothing... scanning my one library folder is 43,000 files where the malware was found with virus barrier... my home folder has 110,000 files... so Malwarebytes does not scan everywhere it seems to me... seems like that makes malwarebytes pretty useless?

had to be something I installed right? since its in the library folder.... it would not get there from visiting a website I would not think?

 

[macgig]

my attachment has changed on the first post. its showing something I did not upload??? I'm unable to edit to insert the correct image.

 

[chscag]

We are aware of the problem. Please read what Admin Nick wrote in the "bug thread".

 

[macgig]

here is the image again... the correct image. full image this time, no thumbnail.

been using Macs a long time. It just floors me that something bad was installed on my system (and DetectX Swift and Malwarebytes never found it). I was hoping there would be a little more feedback and discussion about it, but perhaps there is nothing to say?

times have changed... use to be Macs were never targeted at all or very rarely. Maybe that is slowly changing?

What is ct_scripting and is it something I can or should disable?

 

[ferrarr]

here is the image again... the correct image. full image this time, no thumbnail.

been using Macs a long time. It just floors me that something bad was installed on my system (and DetectX Swift and Malwarebytes never found it). I was hoping there would be a little more feedback and discussion about it, but perhaps there is nothing to say?

times have changed... use to be Macs were never targeted at all or very rarely. Maybe that is slowly changing?

What is ct_scripting and is it something I can or should disable? View attachment 31847

Did you see this thread in the Apple Support Community Forums?

What is 'OSX/Conduit.A' malware? and why … - Apple Community

discussions.apple.com

 

[macgig]

reading it now thanks.

all the stuff he mentions I did not seem to have on my system. I just let virus barrier remove it and that seems to have worked fine.

 

[pm-r]

And if one needs more... Just try a Google Search...

OSX/Conduit.A MAC

OSX/Conduit.A MAC - Google Search

www.google.com

- Patrick
======

 

[macgig]

I wish I knew which app installed it. it must have been hidden in something I installed?

 

[Rod]

I don't think worrying about how it came to be on your device is the issue. There are so many ways that malicious scripts can get onto a computer it's just mind boggling. At the end of the day it's just a matter of being careful and having a decent app that can detect and remove them. I too am now using VirusBarrier Scanner and although it found nothing on my MBP it did detect three instances of spigot files on my wife's MBP. Interestingly this family of browser hijackers are mentioned on MalwareBytes site https://blog.malwarebytes.com/detections/pup-optional-spigot/. yet MalwareBytes didn't detect them on my wife's device.

 

[pm-r]

I wish I knew which app installed it. it must have been hidden in something I installed?

Try doing a Get Info on the file, and there just might be some small hint as to where it might have come from or at least its creator.


- Patrick
======

 

[macgig]

unfortunately I deleted everything before I thought of looking at it closer. ? I thought virus barrier would have some logs I could check but I found nothing in the app or in console.