Windows virus on Mac?

[Gavin]

A friend says her Mac has a file (called TUD.EXE) in the recycle bin which
can't be deleted.

An online virus scan says it's a Win32 virus. How can a Win32 file run on
her Mac?

I'm not a Mac user so please be gentle with me!


VIRUS: <http://www.datafilehost.com/download-ab00f13c.html>
SCAN RESULT: <http://preview.tinyurl.com/y9c584n>

 

[FromTheRafters]

A friend says her Mac has a file (called TUD.EXE) in the recycle bin
which
can't be deleted.

An online virus scan says it's a Win32 virus. How can a Win32 file
run on
her Mac?

It can't, but that doesn't mean it can't *be* on a Mac.

 

[Mr. Strat]

A friend says her Mac has a file (called TUD.EXE) in the recycle bin which
can't be deleted.

An online virus scan says it's a Win32 virus. How can a Win32 file run on
her Mac?

I'm not a Mac user so please be gentle with me!

It can't run (without Windows running in some fashion). There are no OS
X viruses...never have been.

 

[FromTheRafters]

It can't run (without Windows running in some fashion). There are no
OS
X viruses...never have been.

http://www.sophos.com/security/analyses/viruses-and-spyware/osxleapa.html

 

[Gavin]

It can't, but that doesn't mean it can't *be* on a Mac.

Her file TUD.EXE can't be deleted from the recycle bin of her Mac. I
thought the reason for not being able to delete the file is because
TUD.EXE is actually running.

What other reasons should she look at?

It would be nice to get something to delete the file, but it is said the
virus (on Windows) infects lots of other files. This means deleting it
may not solve the problem at all.

What checks or tests should my friend do?

 

[FromTheRafters]

Her file TUD.EXE can't be deleted from the recycle bin of her Mac. I
thought the reason for not being able to delete the file is because
TUD.EXE is actually running.
Doubtful.

What other reasons should she look at?

Try using the master account and delete it from there.

Try moving it from the trash to a folder on the desktop (maybe rename
it) - then delete the entire folder.

It would be nice to get something to delete the file, but it is said
the
virus (on Windows) infects lots of other files. This means deleting
it
may not solve the problem at all.

It won't be running.

What checks or tests should my friend do?

Search the web for 'undeletable files on Mac' or 'emptying trash on Mac'
and try some of the suggestions offered.

 

[Mr. Strat]

http://www.sophos.com/security/analyses/viruses-and-spyware/osxleapa.html

OK...the standard qualifiers...no OS X viruses so long as there is no
physical access, special rights, or PEBCAK.

 

[FromTheRafters]

OK...the standard qualifiers...no OS X viruses so long as there is no
physical access, special rights, or PEBCAK.

There is nothing standard about limiting the definition of virus just to
suit your argument.

It is a virus for the Mac - and runs on OS-X

http://www.sophos.com/pressoffice/news/articles/2006/02/macosxleap.html

There is nothing about that Mac OS that excludes the possibility or
viruses.

http://www.macforensicslab.com/Prod...in_page=document_general_info&products_id=174

 

[David W. Hodgins]

Her file TUD.EXE can't be deleted from the recycle bin of her Mac. I
thought the reason for not being able to delete the file is because
TUD.EXE is actually running.

Linux (and I assume osx) doesn't lock a directory entry, just because
a copy of the executable happens to be running.

Deleting a file (aka unlink) just removes the directory entry. The
inode used by the file will remain in use (by that file), until all
programs that have the file open, are closed, at which time the
space will be available for reuse.

A common example where this matters, shows up when a log file is
filling the disk, due to some program generating an error message
in a loop. Deleting the log file does not free up the disk space,
until the syslog daemon is stopped/restarted.

Not being able to delete the file would be caused by either file
ownership, or file permissions.

Most likely, the file is marked as read only. I expect right clicking
on the file, in the file manager, and then selecting properties would
allow the write permission for the user to be turned on.

Regards, Dave Hodgins

 

[John Gentile]

Her file TUD.EXE can't be deleted from the recycle bin of her Mac. I
thought the reason for not being able to delete the file is because
TUD.EXE is actually running.

What other reasons should she look at?

It would be nice to get something to delete the file, but it is said the
virus (on Windows) infects lots of other files. This means deleting it
may not solve the problem at all.

What checks or tests should my friend do?

Gavin, here is a help page from Apple. Basically, the first thing to do
is check to see if the file is locked. You can see that from the Get
Info. Move the file to the desktop, right click or control click and
select Get Info. In the dialog box at the bottom it will show a lock -
open is not locked, closed is locked. You should be able to click off
the check box to unlock it. If this is the reason, then you should be
able to empty the trash. Another option is to hold down the Option key
while emptying the trash.
Here is the link: http://support.apple.com/kb/HT1526

 

[Mr. Strat]

There is nothing standard about limiting the definition of virus just to
suit your argument.

It is a virus for the Mac - and runs on OS-X

The point is...OS X cannot become infected without "help." Can't say
that about Windows.

 

[Dustin Cook]

The point is...OS X cannot become infected without "help." Can't say
that about Windows.

Truth be told, Windows requires help as well. A virus doesn't magically
execute itself. In almost ALL infection cases, the user can rightfully be
blamed.

 

[FromTheRafters]

The point is...OS X cannot become infected without "help." Can't say
that about Windows.

Yes, I can. If a program runs, it is because the user supplied power to
the machine. The OS or related programs can invoke other (infected or
otherwise malicious) programs to run.

Whether or not user interaction is required, is *not* part of the
definition for virus or worm.

Many definitions do (wrongly) make a point of whether or not user action
is required, but that is a red herring.

 

[veronique]

A friend says her Mac has a file (called TUD.EXE) in the recycle bin which
can't be deleted.

An online virus scan says it's a Win32 virus. How can a Win32 file run on
her Mac?

I'm not a Mac user so please be gentle with me!


VIRUS: <http://www.datafilehost.com/download-ab00f13c.html>
SCAN RESULT: <http://preview.tinyurl.com/y9c584n>

 

[VanguardLH]

Nothing to add, eh?

 

[Mr. Strat]

But if you want to do it yourself, Google on "Mac anti-virus software",
you'll find quite a few. (Macs are _not_ immune!) For advice on which is
best, go to a newsgroup for Mac users. You can also ask there about how
to change the permissions on any file so that you can delete it, which
in this case may be the best way to go. I've posted questions on
seattle.users.macintosh and received courteous replies. it's not a very
active group, though.

There are not now nor have there been any OS X viruses in the wild. Any
infections depend on physical access, special rights, or PEBCAK.

 

[FromTheRafters]

There are not now nor have there been any OS X viruses in the wild.

Yes there has.

http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?vname=OSX_LEAP.A

Any infections depend on physical access, special rights, or PEBCAK.

Excluding malware that exploits software vulnerabilities, and malware
that requires exploiting user's bad habits (mostly worms and trojans),
then "yes" perhaps there aren't any of those for OS-X in the wild up to
and including this point in time. However, you seem to be implying that
this trend will continue due to some sort of "security" built into the
OS. It might be worth noting that "viruses" do not depend on any
functions other than what users are normally supplied by the OS.

http://vx.netlux.org/lib/afc08.html

Having a secure OS (and adhering to safe computing practices) is a good
thing, but it won't stop "viruses" from being able to spread on that
platform or any other.

 

[Mr. Strat]

Yes there has.


http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?vname=OSX_LEA
P.A
PEBCAK

Excluding malware that exploits software vulnerabilities, and malware
that requires exploiting user's bad habits (mostly worms and trojans),
then "yes" perhaps there aren't any of those for OS-X in the wild up to
and including this point in time. However, you seem to be implying that
this trend will continue due to some sort of "security" built into the
OS. It might be worth noting that "viruses" do not depend on any
functions other than what users are normally supplied by the OS.

Software maybe...but the operating system, no. I wasn't implying
anything...maybe there will be an infection in the future...but nine
years is a pretty good record, far better than any version of Windows.

And it has nothing to do with market share; it has everything to do
with the basic design of the operating system.

 

[FromTheRafters]

PEBCAK

Irrelevant to your assertion: "There are not now nor have there been any
OS X viruses in the wild." (that you edited out).

[...]

you seem to be implying that this trend will continue
due to some sort of "security" built into the OS.

[...]

Software maybe...but the operating system, no. I wasn't implying
anything...maybe there will be an infection in the future...but nine
years is a pretty good record, far better than any version of Windows.
Indeed!

And it has nothing to do with market share; it has everything to do
with the basic design of the operating system.

It has to do with *both* of those things.

 

[Harry]

Irrelevant to your assertion: "There are not now nor have there been any
OS X viruses in the wild." (that you edited out).

[...]

you seem to be implying that this trend will continue
due to some sort of "security" built into the OS.

[...]

Software maybe...but the operating system, no. I wasn't implying
anything...maybe there will be an infection in the future...but nine
years is a pretty good record, far better than any version of Windows.

Indeed!

And it has nothing to do with market share; it has everything to do
with the basic design of the operating system.

It has to do with *both* of those things.

It also has to do with the unreasonable hatred of MS and Windows IMO.
Odd, since Stevie Joeboy is the real megalomaniac, not Willie Wallholes.
Apple gets away with anti-competitive practices that make other
companies drool with envy.

cheers,
wolf k.

One must remember....Apple started as a COMPUTER company....get it?
Hardware! Why would someone making their profits on hardware want
something else to run on it other than software meant for that
hardware. There are other software developers, right? What about M$
attempting to make their software proprietary to their OS?