Its a PDF – so either read using Mac’s built in PDF reader or Adobe Acrobat

NOVEMBER 2012 Newsletter

1) If you get any pop ups while browsing that say your computer is infected, force quit your browser. These are fake messages intended to get you to click the OK button, at which point a download will be initiated.

• Force quit by going under APPLE menu in upper left and picking FORCE QUIT
• click on your Browser name – Safari, Firefox, or Chrome In window that popped up.
• pick FORCE QUIT in the bottom right of window.
• It will ask you one more time if you are sure you want to force quit.
• Click Force Quit. (Be AWARE – This will close all SAFARI window you have open)

2) Go under Apple Menu TODAY and pick SOFTWARE UPDATE. A window will pop up with a list of items to be updated. Click Update Now and Type in your Password. Apple is providing in their updates as of yesterday a fix for this malware. Doing all of your updates will insure you have this protection on your system. Apple refers to this update as a SECURITY FIX.

3) If you are asked to put in your password at any point while browsing or using your computer and after reading the window asking for your password – you still don’t know who is requesting your password… don’t enter your password.

4) Apple does not, nor does any website, offer VIRUS software automatically to install while you are browsing the web, if you are asked to install virus software or pay for virus software… do not put in credit card info or passwords to carry out the process.
This is 100% Fake and is an attempt to get your personal information. Please contact Apple or Me if you are unsure.(323-401-7722)

5) If you are using SAFARI to browse the web you can disable a preference that will fix some of these attacks.

• Open Safari.
• Go under the SAFARI menu item (near Apple Icon in upper left of screen) Pick Preferences under this menu.
• Pick the GENERAL Preference Icon (usually already picked).
• At bottom of window UNCHECK – OPEN SAFE FILES AFTER DOWNLOADING.

This will insure files you download purposely or also in the case of malware not purposely, will not open automatically. This is how the software auto launches itself on the system. Unfortunately, the bi-product of this action, are files you legitimately want to download will not auto launch when done downloading – you will have to find them in your downloads folder and double click them to launch.

6) If you feel you have been hit already by this malware – and you have a constant warning to update your virus definitions or some odd message… please contact Apple or Me (323-401-7722)

7) A very well composed article about this malware is available from TUAW as a supplement to my email. http://aol.it/kRCz1j

8) Let me add that their are a number of fake emails from Adobe and other companies saying to download updates to their products through links provided in the emails. Adobe for one and mostly all other software installed on macs these days have auto installers built into their software that keep you updated locally. Legit emails or not legit – I would advise not to follow these links. I would go directly to the site by typing in the browser the name of the company and browsing their website for possible updates. This will insure you are downloading directly from the company and not from a faked version of the website.

http://bit.ly/jHKYDs

New malware attacks Mac OS X users through Apple Safari browser

By Katie Marsal

Published: 10:00 AM EST

Newly discovered malicious software dubbed “MACDefender” takes aim at users of the Mac OS X operating system by automatically downloading a file through JavaScript. But users must also agree to install the software, leaving the potential threat limited.

The new MACDefender malware was first noted on Saturday”> by users of the Apple Support Communities, and was highlighted on Monday by antivirus company Intego. If the right settings are enabled in Apple’s Safari browser, MACDefender can be downloaded to a system after a user clicks a link while searching the Internet.

“When a user clicks a link after performing a search on a search engine such as Google, this takes them to a web site whose page contains JavaScript that automatically downloads a file,” Intego said. “In this case, the file downloaded is a compressed ZIP archive, which, if a specific option in a web browser is checked (Open ‘safe’ files after downloading in Safari, for example), will open.”

However, users must still agree to install the malware after it downloads. After the ZIP file is extracted, users are presented with the “MACDefender Setup Installer,” at which point they must agree to continue and provide an administrator password.

Because of the fact that users must agree to install the software and provide a password, Intego categorized the threat with MACDefender as “low.”

Users on Apple’s support forums advise killing active processes from the application using the Mac OS X Activity Monitor. MACDefender can then be deleted from the Applications folder by dragging it into the trash.

The malware is not to be confused with MacDefender, the maker of geocaching software including GCStatistic and DTmatrix. The company noted on its site it is not affiliated with the malware.

Malware spreads through search engines like Google via a method known as “SEO poisoning.” The sites are designed to game search engine algorithms and show up when users search for certain topics.

1.

The first is a possible TROJAN Horse Program that can install a backdoor to your computer.

This would give access to files etc on your computer.  And in some cases redirect you through their servers for all of your surfing – opening up the possibility that they could get access to passwords you type.

http://www.tuaw.com/2010/10/27/security-alert-new-trojan-horse-apps-attacking-the-mac/

http://www.appleinsider.com/articles/10/10/27/java_based_trojan_horse_targets_computers_running_apples_mac_os_x.html

Take a screen shot of the pop up message if you can.  You can take a shot of your whole screen by holding down SHIFT KEY, COMMAND (apple), and 3. Push them all at once like clicking a camera. You will hear a camera sound and a file will appear on your desktop called Picture 1 or Screen Shot with a date.

Its important to note this is by no means a Virus.  It requires you the user to install it.  Being aware of what you ok to be installed will keep you safe from this and future attacks.

2.

The second is just as malicious – but it comes from Apple. It comes in the form of Iphoto 11. The newest version of the ILIFE Suite that apple is selling.

There are some cases in which upgrading to Iphoto 11 has been wiping out – and deleting a good portion of the users photos and videos.  So far, the only way to get these back is from a backup.

If you really need to upgrade, then make sure you backup before upgrading. Try Macworld’s help article on how to successfully do the update.

http://hints.macworld.com/article.php?story=20101027093832151

If you can wait, Apple will surely release an update that will remedy this situation.