Machines compromised by the Tsunmai Trojan?

[substance]

Tsunami Trojan: First Mac attack based on Linux crack ? The Register

My fiances mac seems to have been compromised by this trojan. I've seen plenty of reports about this backdoor existing that have popped up over the last few days but nothing of anyone who may have experienced it. Before I go on please forgive my lack of knowledge of all things technical and my layman terms but something is very wrong with my fiances machine, which coincides with this backdoor coming to light as well as a few others in the apple store having the same problems.

There's been signs that my fiance's mac had been hijacked a few days ago with strange messages, screwing with internet settings, hard drive modifications, strange user logs left behind, cell phone been synced up, then a gloved curser appearing and clicking on items on her desktop. Then last night it just wouldn't boot. It seems to me someone has remote access and has screwed about with it and the couple in the store with her reported the same problems. The guy had his hard drive already wiped twice and osc reinstalled twice by the apple guys in the last couple of days but this problem persisted.

My fiances was wiped, reinstalled and has got it home only to noticed the same has begun happening again. We're both worried and unsettled by this and it just seems odd that there's plenty of articles about this backdoor existing but little in the way of people who've dealt with it. Forgive me being cheeky and using my first post to ask this but we're very concerned about this and are looking for a fix for this.

If anyone can help in anyway at all it'll be much appreciated.


Thank you

 

[dobby]

Install and run Sophos antivrus .
It should find it as Tsunami-A .
Put in quarantine .
BTW there is free version of sophos antivirus you can try that one first

 

[Doug b]

So, your fiancee chats regularly on IRC channels? I also sincerely doubt that if the HD was wiped, with the OS reinstalled that this would be related to said Trojan.

Doug

 

[bobtomay]

So, your fiancee chats regularly on IRC channels? I also sincerely doubt that if the HD was wiped, with the OS reinstalled that this would be related to said Trojan.

Doug

"Sincerely" is not a strong enough term in this case.

 

[substance]

Install and run Sophos antivrus .
It should find it as Tsunami-A .
Put in quarantine .
BTW there is free version of sophos antivirus you can try that one first

So sophos is legit? We'll try that and see. Cheers for the help!

So, your fiancee chats regularly on IRC channels? I also sincerely doubt that if the HD was wiped, with the OS reinstalled that this would be related to said Trojan.

No. As I said I'm not a mac or tech boffin but saw the two correlating in the last few days. It may well not be that but there's obviously something going on there. Even the apple people on the hotline said it had been remotely accessed and messed with.

"Sincerely" is not a strong enough term in this case.

Ta for the input...

 

[Doug b]

"Sincerely" is not a strong enough term in this case.

I'm up for alternate suggestions!

No. As I said I'm not a mac or tech boffin but saw the two correlating in the last few days. It may well not be that but there's obviously something going on there. Even the apple people on the hotline said it had been remotely accessed and messed with.

Well, if you go back and read the article that you've linked... it states that:

The newly discovered Tsunami Trojan is derived from an earlier Linux-infecting backdoor Trojan, called Kaiten, which phoned home from infected machines to an IRC channel for further instructions.

Whether or not your machine is being accessed via remote connection is another story, and then would have nothing to do with this particular Trojan, I'm just trying to stop the spread of misinformation and perhaps do some troubleshooting.

My advice would be to make sure that you have him change the main Administrator (login) password to something rather strong. Use uppercase, lowercase, numerals and characters. Then I'd recommend making sure that your router's password is also encrypted well, with WPA2 and a strong password that is different from your admin password. Then, I'd go into system preferences and go into the "sharing" tab and make sure everything is unticked. (unless you're sharing two computers on the home network).

Then of course make sure that the lock icon at the bottom of Preferences is locked. I'd also go ahead and change all of your other passwords at this point. Email accounts, bank accounts, ebay etc.. etc...

Doug

P.S. And as competent as the Apple Care tech's are, I would not be so apt to take their word for it unless they've physically seen the machine. Not saying they're wrong but I'd rather get that particular opinion from a Genius at an Apple store.