Uma ukhumbula esikhathini esedlule, sakhuluma ngokuthi iTrojan entsha yahlelwa kanjani ukweba ama-bitcoins kumakhompyutha anegciwane avele kwinethiwekhi.
Ngokuqondile, iTrojan imayelana OSX/CoinThief futhi isatshalaliswe ngaphansi kwamagama amane ahlukene kuze kube manje kufaka iBitVanity, StealthBit, Bitcoin Ticker TTM, neLitecoin Ticker.
Phakathi kwazo zonke lezi zinhlobonhlobo zamagama siyazi ukuthi lawo ahambelana neBitVanity neStealthBit asatshalaliswa ngeplathifomu yeGithub, ngenkathi I-Bitcoin Ticker TTM neLitecoin Ticker Benze okufanayo ngeThandwa.com nakuMacUpdate.com ngokulandelana.
Into ehlekisayo ukuthi lawa magama akhethwe ezinhlelweni ezisemthethweni ezivela kwi-Mac App Store ngenhloso esobala yokukhohlisa umsebenzisi, noma kunjalo into ebi kakhulu akuyona le kodwa ukuthi uma isebenza ngemuva ifaka isandiso kusiphequluli, noma I-Chrome, iSafari noma iFirefox.
Uma sekufakiwe sizobona okuthile okufana nalokhu 'I-Pop-Up Blocker 1.0.0 ″ kepha akukho okunye okuqhubekayo okuvela eqinisweni, ngoba uzomane uxhumana ukude neseva ukuzama ukuqoqa okhiye bokufinyelela ngokushesha nje lapho ufinyelela iwebhusayithi ehlobene neBitcoin, ushiye inqubo enonya ngemuva isebenza unomphela ngomsebenzi owethulwe.
Ukukuqeda kuzofanele silandele lezi zinyathelo ezilula:
- Sizobheka inqubo "com.google.softwareUpdateAgent" nge-Activity Monitor kufolda ye-Utilities.
- Bheka ukuthi sinesandiso se- "Pop-Up Blocker" ku-Safari, i-Chrome noma esinye isiphequluli, ngenqubo eshiwo ngenhla ikhona ku-Activity Monitor, kufanele siyisuse.
- Sizosebenzisa imiyalo ku-terminal yalokhu, yize ngaphambi kokuthi kufanele sisuse iBitVanity, iStealhBit ... noma yiluphi uhlelo olufakiwe, siludonsele kudoti.
- Sivula ukuphela bese sifaka lo myalo:
launchctl ethula ~ / Library / LaunchAgents / com.google.softwareUpdateAgent.plist
Lokhu kuzomisa inqubo enonya leyo ugijima ngemuva noma kungenzeka ukuthi ibuyisa okuthi "Alikho lelo fayela noma umkhombandlela, akukho okutholakele ukulayishwa" ngakho-ke kuzokhombisa ukuthi inqubo esetshenzisiwe ayisebenzi yize inganele ukuyibheka. - Isinyathelo esilandelayo ukuhambisa ifayili noma i-malware uqobo kudeskithophu bese uyisusa ngokuyihudulela kudoti ngomyalo olandelayo:
mv ~ / Library / Support Support / .com.google.softwareUpdateAgent ~ / Desktop / com.google.softwareUpdateAgent - Ekugcineni kuzofanele senze kuphela hamba kudeskithophu futhi nefayela eliqalisa ukwethulwa, okuyinqubo yangemuva exhumana neseva ekude:
mv ~ / Library / LaunchAgents / com.google.softwareUpdateAgent.plist ~ / Desktop / com.google.softwareUpdateAgent.plist
Kusele ukuqeda kuphela noma yimuphi umkhondo wesandiso kusiphequluli se-Pop-Up Blocker futhi sizobe sikulungele ukudlulisa amehlo 'ngokukhululeka kakhudlwana'.
Imininingwane engaphezulu - Kuvela iTrojan ekwazi ukweba amaBitcoins kuma-Macs