Since OS X Hints is intentionally not a news site, I've stayed away from discussing the 'opener' malware that's been covered on most every major Mac site out there. The site's focus is not changing, but since there are finally some 'hint related' aspects of this issue, I will take some time to cover those pieces of it this morning. If you're not familiar with the opener malware (also known as a 'root kit'), it's basically a large shell script that, once installed, does all sorts of Really Bad Things to your machine - nothing overt like erasing your user's directory, but much worse stuff. It installs software that disables Little Snitch (an outbound firewall, basically. Edit: It actually kills it before making outbound connections, and moves it to last in the boot order, but doesn't actually disable it), it installs remote access software, it installs a password decoder app, etc.

• Yo-kai Watch For Mac
• Eye Opener Watch For Machine

It goes by many names; Symantec calls it, and their writeup of it covers all its evilness in great detail. Read the rest of the hint for some tips on how to avoid Opener, and how to remove it if you do get it. Opener is a lot of things, but it's not a worm or virus: it can't self-propagate, and it doesn't automatically infect a machine. Opener has to be installed, either during a software installation (of a package that's been intentionally infected with Opener), or by a user who has gained root access to a machine. If your machine is secure, you can't be infected accidentally - it requires proactive action on your part. So the best ways to avoid Opener are:.

Eye Opener: What to watch with the stimulus. By Ed O'Keefe Updated 10:18 a.m. As the back-and-forth about the stimulus continues, keep a close Eye on these movers, shakers and scenarios that could impact the public's perception and future recovery efforts. Categories: Eye Opener, Tracking the Stimulus Save & Share: Previous: No.

Physically secure your machine, if possible. Always use a screensaver/locking program when you leave your machine, even for a minute or two. Apply all security updates in a timely fashion. Only install software from trusted sources - stick to places like MacUpdate, VersionTracker, HyperJeff's OS X Software page, etc.

• MOV files are compatible with both Windows and Mac computers. Quick Look enables you to view files quickly and easily without opening full applications. You can also open Quick Look by highlighting the file and pressing the eye icon at.
• ‘It was an eye-opener to watch Kohli bat, to see a master at work’. England’s efforts with the bat seemed insufficient when Shikhar Dhawan and Murali Vijay, the openers, put on 50 but.

Don't download and run things from Limewire, etc., unless you really like living on the edge. Think twice before giving your admin password to every installer that asks for it. Personally, I only 'trust' the major names in the business (i.e. Adobe, Apple, Microsoft, etc.) when it comes to giving an admin password on install. Beyond that, I'll quit the installer and dig around inside the package to see if I can figure out why it wants my admin password. If I can't figure out why, I'll usually email the author before I try to install it.

Your admin password should be protected, and that includes not letting any old application have it when it requests it. To be extremely cautious, don't run as 'admin' at all - create a non-privileged user account for your day-to-day stuff. Personally, I find this a bit onerous (I tried for a while), but it definitely would give you a more secure environment (assuming you don't then just provide the admin password when requested!). KEEP GOOD BACKUPS!

This is important in any context, but especially one in which a piece of malware could easily rm -rf. (force erase everything NOW - do.not. try this command!).

Good backups are easily worth the time they take to create. How can you tell if you have somehow managed to get Opener installed on your machine? The fastest way is to open Terminal (in Applications - Utilities), and type sudo ls -l /Users/./Public/.info, then hit return. If your machine is most likely. clean, you'll see ls: /Users/./Public/.info: No such file or directory as the result. If you see anything else, your machine is infected.

Since this is a malware script, and it's installation requires root, you can't be 100% sure you're clean with the above command. If the hacker is really good, they can replace ls with their own version, or just rename the script components, etc - since they have to have root access to install in the first place, they can do whatever they like! But the above command will catch all the simple 'script kiddie' installations of Opener. The above little tidbit came from Macintouch's excellent Reader Reports series, which is also where you can find other monitoring tools, as well as a removal tool (all subject to the above disclaimer, of course). In particular, check out:. Donald Hall's script on the October 22nd report to monitor for a process named John (the password decoder).

Rams' entry on the Oct 28 page about how to create and set permissions on /Library/Statup Items, which will close one method that the Opener malware uses to accomplish its evilness. Harold Martin's 'Closer' script on the Oct 31 page. This will (hopefully) get rid of an installed Opener.

Greg Guerin's Watcher script (also on the Oct 31 page), which watches the two Startup Items folders and alerts you if they are modified. Since Greg was kind enough to release his code into the public domain, I have also on macosxhints. Finally, for a great general overview on securing OS X, read the NSA's new OS X System Configuration Guide. It's definitely not required for most home users to institute everything listed in its entirety, but it's a great overview of the system and some ways to make it even more secure than it already is. At nearly 100 pages, it's not a light read, but it's well worth the time. In summary, malware can (and does) exist for any platform - with the assumption that root access has been obtained, anything and everything is possible.

Yo-kai Watch For Mac

Opener is not a worm, nor a virus. Spreading it requires either user intervention or a compromised machine, and it must be hand-installed on each machine to be infected.

Take the basic steps necessary to secure your machine and your work habits, and you should feel quite comfortable with the safety of your system and its data - but please, have a backup or two or three, just in case! There are additional problems beyond merely giving out your password. Nothing gaurantees the permissions of /Library/StartupItems and any StartupItems placed in the folder run as root during the next startup. As the opener script itself points out, there are numerous programs that store passwords in preference files rather than in the keychain and some of those preference files can contain an admin password in clear text so if a person has read access to your drive (for instance physical access and you do not set a screen-saver password) then the person may well be able to obtain your password without 'you' giving it to them. If someone has physical access to your machine, they can restart it with the Install CD or via 'single-user' mode and thus obtain 'root' privileges without the need for any password.

Thus the admonition to physically secure your machine. For machines that are publicly accessible, it is essential to set the 'open firmware' password to prevent the above. If you leave your Mac running without activating the screensaver, anyone can access your files and (for example) install hidden malware using the privileges of your user account. This is often the first step towards obtaining your password and full control of the machine. The first poster should also know that all precautions, OF security modes and otherwise, go out the window if the machine's case is unlocked. A real padlock completes the 'reasonable' physical security checklist.

Without a locked case, I wouldn't bother with OF mode changes, frankly. You should keep your machine's case integrity in mind when considering counterintrusion policies unless you live alone in the woods with lethal perimeter security, and see other humans infrequently. - d i l i g e n t i a.

C e l e r i t a s -. No, you are not infected. (Well, probably not. There might be variants of Opener that manifest themselves differently. So far, however, we only know of the one.) The difference depends on which shell you are using.

The shell is decided upon when your account is created and only changes after that if you do so explicitly. Before Panther, the default shell was 'tcsh'. If your account was created under Jaguar or earlier then your shell is tcsh, even if you have subsequently upgraded to Panther.

Under Panther, the default shell is 'bash' for newly created accounts. Anyway, what the command is doing is checking whether the file '.info' exists in the Public directory of any user.

If it exists in one of your user directories, it means you have 'Opener'. If it does not exist, then you get an error message (which is good; it means you probably don't have Opener). However, bash and tcsh appear to give different error messages. Yes, although 'virus' is used in very general terms to mean 'porgrams that secretly do bad things to your computer' (more accurately called 'malware'), it has a more precise definition, and Opener does not fit it. Roughly:.Virus - A program that, like a biological virus, automatically replicates itself.Worm - Very similar to a virus, but it actively tries to infect other computers (for example by emailing itself to other people or via network backdoors). Almost all the big Windows nasties are, therefore, technically worms.Trojan - A program that pretends to do one thing, but actually does something else (usually installs some other malware or virus).

Coming back to Opener: as explained above, it needs to be installed by someone (or something) with administrator-level access to your computer, so by itself it is none of these things. It does not (so far as I have read) replicate itself, and it certainly does not have any means of spreading itself beyond the computer on which it is installed and any connected machines (if it can even do that, in which case it would, I suppose, be a virus, albeit a very limited one since it is only installed in specific locations). Why is the command to find out if you are infected 'sudo ls -l /Users/./Public/.info'? In particular, I presume that the sudo is there just in case the permissions on the directory have been changed. (Ordinarily, everyone is allowed to see your Public directory.) However, because the '.' is expanded before sudo is executed, it won't help; if the directory is not readable by the user executing the command, it will never even get passed to sudo.

Eye Opener Watch For Machine

I can't think of a simple way to do this. One can either: sudo -sls -l /Users/./Public/.infoexit (Make sure to type exit! Sudo -s gives you a root shell, which is very dangerous, so you want to exit the shell as soon as you are done.) Or you can write a loop:In tcsh: foreach i (/Users/.) sudo ls -l '$i'/Public/.infoend In bash: well, I dunno, but I'm sure someone will translate the above script.

If see a bunch of error messages, that's good. If you see an actual listing of a file, that is bad. Opener can be disguised as a trojan in the form of an MP3 or stolen software-it can also be hidden in stolen software as an extra piece of code. You download it, run it and it does it's thing. Also, someone else can physically sit in front of your Mac and download the script from a web or ftp site. Hence all the posts above about physically securing your machine when you're away from it.

Also since it's just a script and doesn't require an installer, someone sitting at your machine may not even need an admin password to run it-a shell script (which is what Opener is, IIRC)is just a text file until it's made executable. The MacNut.