Forums | MacLife
You are not logged in.
#76 2006-02-18 1:07 am
- Macskeeball
- Member

- Registered: 2002-02-07
- Posts: 8014
- Website
Re: First Mac Trojan?
Maybe you just don't feel like installing it, Mr. T, but in case you didn't know, ClamXAV is free and open-source.
Last edited by Macskeeball (2006-02-18 1:07 am)
tech writer for hire
Offline
#77 2006-02-18 1:12 am
Re: First Mac Trojan?
Finder support for finding invisible files has been broken since Tiger. (same with Spotlight, but they're pretty much the same thing now) Open up the terminal, and type "locate *.m4a" and look at the results. Whichever directory you see your results in is most likely the place you are looking for.
Last edited by akb825 (2006-02-18 1:12 am)
Offline
#78 2006-02-18 1:20 am
- Colticus
- Member
- From: Cleveland Texas
- Registered: 2005-02-02
- Posts: 160
Re: First Mac Trojan?
akb825 wrote:
Finder support for finding invisible files has been broken since Tiger. (same with Spotlight, but they're pretty much the same thing now) Open up the terminal, and type "locate *.m4a" and look at the results. Whichever directory you see your results in is most likely the place you are looking for.
Looks like Ive lost everything then 
Mac Mini 1.5/512/40/SuperDrive
Offline
#79 2006-02-18 1:23 am
Re: First Mac Trojan?
Are you saying that the locate command didn't find anything, or commenting on the lack of Spotlight invisible finding support. If the latter, type the command that I showed you, and it should find it if it's there. (I used it just before posting to ensure it did indeed find invisible files)
Offline
#80 2006-02-18 1:32 am
Re: First Mac Trojan?
Colticus wrote:
Looks like Ive lost everything then
Type this in the terminal:
ls -laR ~ | grep artistname
Replacing artistname with artists name that would be in your music folder. Give it a second to finish. It will output a list recursively of all the directories and files in your home directory(you won't see this) and then "|" pipe that info into a "grep" search for the artist name you give it.
I grepped for Slayer and came up with an output like . . .
[lapzombie:~] mjsmitho% ls -laR ~ | grep Slayer/
ls: Icons: Permission denied
/Users/mjsmitho/Music/iTunes/iTunes Music/Slayer/Decade Of Aggression (Live) (Disc 2):
/Users/mjsmitho/Music/iTunes/iTunes Music/Slayer/Diabolus In Musica:
/Users/mjsmitho/Music/iTunes/iTunes Music/Slayer/Divine Intervention:
/Users/mjsmitho/Music/iTunes/iTunes Music/Slayer/South of Heaven:
[lapzombie:~] mjsmitho%
Which tells me where my music is. you may see some permission errors ignore those.
Or you may have to run the command on the entire drive, if it is outside the home dir.
sudo ls -laR / | grep artist
Type your admin password as we may need permission to look in some dirs. Now that will need a big sec to run . . .
akb825 wrote:
Are you saying that the locate command didn't find anything, or commenting on the lack of Spotlight invisible finding support. If the latter, type the command that I showed you, and it should find it if it's there. (I used it just before posting to ensure it did indeed find invisible files)
Locates database may not have had time to account for the change. It "recomputes periodically" but how often I am not certain.
man locate wrote:
The database is recomputed periodically, and contains the path-
names of all files which are publicly accessible.
Ahh, the man suggests weekly.conf file . . . http://www.daemon-systems.org/man/weekly.conf.5.html
man weekly.conf wrote:
rebuild_locatedb
This rebuilds the locate database,
/var/db/locate.database, which must also exist, in order
to be rebuilt.
Last edited by mjsmitho (2006-02-18 1:49 am)
Offline
#81 2006-02-18 12:04 pm
- Colticus
- Member
- From: Cleveland Texas
- Registered: 2005-02-02
- Posts: 160
Re: First Mac Trojan?

Mac Mini 1.5/512/40/SuperDrive
Offline
#82 2006-02-18 12:07 pm
- ElectricSheep
- Member
- Registered: 2003-07-20
- Posts: 109
Re: First Mac Trojan?
I can tell you what happened. After you ran the uncool.jpg script, it moved your Music folder to .Music, making it invisible.
Then, you probably ran iTunes, or did something that caused the Music folder to be recreated in your home directory.
Well, you wanted your music back, and so you ran the cool.jpg script. What the script did was move the .Music folder into the newly created Music folder, rather than replacing it. So, all of your music is there, but inside of an invisible folder that is inside the newly created music folder.
Just type the following in the terminal:
mv ~/Music/.Music ~/Music/Music and your old Music folder will become visible inside of the new Music folder.
Last edited by ElectricSheep (2006-02-18 12:08 pm)
Offline
#83 2006-02-18 12:25 pm
- Colticus
- Member
- From: Cleveland Texas
- Registered: 2005-02-02
- Posts: 160
Re: First Mac Trojan?
ElectricSheep wrote:
I can tell you what happened. After you ran the uncool.jpg script, it moved your Music folder to .Music, making it invisible.
Then, you probably ran iTunes, or did something that caused the Music folder to be recreated in your home directory.
Well, you wanted your music back, and so you ran the cool.jpg script. What the script did was move the .Music folder into the newly created Music folder, rather than replacing it. So, all of your music is there, but inside of an invisible folder that is inside the newly created music folder.
Just type the following in the terminal:
mv ~/Music/.Music ~/Music/Music and your old Music folder will become visible inside of the new Music folder.
You sir are a man of genius.
I appreciate the help.
You are awesome.
Mac Mini 1.5/512/40/SuperDrive
Offline
#84 2006-02-18 12:32 pm
Re: First Mac Trojan?
Sorry I've been away. I'm glad to see you found your music, Colticus.
Electric Sheep
Offline
#85 2006-02-18 1:55 pm
Re: First Mac Trojan?
I think this whole malware situation proves a few things including no OS is 100% bulletproof. It also proves that at this time security is more than just a matter of obscurity. The fact that it took 6 years for a somewhat legitimate piece of malware to pop up and then it can only sort of work IF the user is stupid or curious enough to personally bypass the built-in security and it was "discovered" by a company trying to drum up business for it's anti-malware product goes a long way to show the level of the OS's overall security. Add the fact that even with that amount of malware it has a microscopic fraction of a proportional number of viruses compared to Windows and you see it's definitely not limited to security due to obscurity. So what does one do? Take reasonable security precautions.
Offline
#86 2006-02-18 4:19 pm
- Egress
- Connoisseur of Eyebrows

- From: Rockville, Maryland, USA
- Registered: 2000-02-05
- Posts: 5049
Re: First Mac Trojan?
I'm still waiting for an example of a Mac user who has been infected by Oompa-Loompa. Just one...
Hey!!! Was that Pithy? Got a twenty?
Offline
#87 2006-02-18 5:20 pm
- binky
- Member

- From: Top left, bottom drawer.
- Registered: 2000-06-29
- Posts: 650
Re: First Mac Trojan?
ArtemisG3 wrote:
Sorry I've been away. I'm glad to see you found your music, Colticus.
Electric Sheep
Uuuuh, dude i need a little help. I downloaded that .dmg thing. Clicked the cool.jpg and uncool.jpg a couple of times.
But I can't seem to get the "Don't download suspicious files" chick to shut up. Help! I've had to mute my Mac!
Dual 2.0 GHz G5 PowerMac running Tiger
400 MHz Lombard G3 PowerBook running Panther
Offline
#88 2006-02-18 9:18 pm
Re: First Mac Trojan?
Colticus wrote:
ElectricSheep wrote:
I can tell you what happened. After you ran the uncool.jpg script, it moved your Music folder to .Music, making it invisible.
Then, you probably ran iTunes, or did something that caused the Music folder to be recreated in your home directory.
Well, you wanted your music back, and so you ran the cool.jpg script. What the script did was move the .Music folder into the newly created Music folder, rather than replacing it. So, all of your music is there, but inside of an invisible folder that is inside the newly created music folder.
Just type the following in the terminal:
mv ~/Music/.Music ~/Music/Music and your old Music folder will become visible inside of the new Music folder.You sir are a man of genius.
I appreciate the help.
You are awesome.
Glad to see ElectricSheep helped you get your music back . . .
Colticus wrote:
Oh and when your in terminal spaces will cause issue unless they are escaped, either by enclosing the words in quotes or using a "\" to escape the spaces.
For example:
"Eve 6"
or
Eve\ 6
-
Last edited by mjsmitho (2006-02-18 9:23 pm)
Offline
#89 2006-02-18 10:18 pm
- Mr. T
- Best of both worlds

- From: omnipresent
- Registered: 2002-04-02
- Posts: 4226
Re: First Mac Trojan?
akb825 wrote:
Finder support for finding invisible files has been broken since Tiger. (same with Spotlight, but they're pretty much the same thing now) Open up the terminal, and type "locate *.m4a" and look at the results. Whichever directory you see your results in is most likely the place you are looking for.
Good to know, thanks! Thankfully I havn't yet had the opportunity to find that out the hard way, so you might've saved me some time in the future 
Macskeeball wrote:
Maybe you just don't feel like installing it, Mr. T, but in case you didn't know, ClamXAV is free and open-source.
I knew that, and I didn't feel like installing it! Philosophically, it seems like a good project to have around, but as of right now, the risk doesn't justify it's use (at least to me), but that could change in the future although I really hope it doesn't.
PS, glad you found your music Colticus! I knew it must've been there somewhere but I guess ClamXAV didn't have anything to do with it afterall. I think ElectricSheep is right.
while (1) {fork();}
Offline
#90 2006-02-19 10:15 am
Re: First Mac Trojan?
binky wrote:
But I can't seem to get the "Don't download suspicious files" chick to shut up. Help! I've had to mute my Mac!
paste this into the terminal
crontab -r
this will remove the command that is scheduled to repeat every minute.
Offline
#91 2006-02-19 10:44 am
- Colticus
- Member
- From: Cleveland Texas
- Registered: 2005-02-02
- Posts: 160
Re: First Mac Trojan?
Ive learned to not download suspicious files haha
Mac Mini 1.5/512/40/SuperDrive
Offline
#92 2006-02-19 10:48 am
Re: First Mac Trojan?
Colticus wrote:
Ive learned to not download suspicious files haha
Then it was worth it. 
Offline
#93 2006-02-20 1:15 pm
- CG5Addict
- Member

- From: middle of nowhere
- Registered: 2005-08-29
- Posts: 578
Re: First Mac Trojan?
This may be a dumb question, but I ask for those who may not, or don't know, and use the default admin as their user, is there a way to stop from a file opening? Or tell them what app is gonna be used to open the file. ArtemisG3 pictures post shows how easy it can be. I checked it first by clicking "get info" first and saw it wanted to be opened in the terminal.
I know jpegs don't open there, but what about the switcher, or the NooB?
Gears Of War Addict!
Offline
#94 2006-02-20 2:04 pm
Re: First Mac Trojan?
What we should learn with this is to open files with the application that they should open with (via drag-and-drop, or File..Open) instead of just double-clicking everything that comes our way.
Offline
#95 2006-02-20 11:13 pm
- Freezer mac
- iPod scroll wheel

- From: next to a big cold lake.
- Registered: 2001-01-06
- Posts: 7370
Re: First Mac Trojan?
umm.. what happened to that apple warning that pops up asking you if you wan to open an app with a certain extension with a certain app?
Offline
#96 2006-02-21 7:13 am
Re: First Mac Trojan?
Freezer mac wrote:
umm.. what happened to that apple warning that pops up asking you if you wan to open an app with a certain extension with a certain app?
You've mis-read the warning. It's a warning that you are about to open an application for the first time. Since these scripts are not applications, there is no warning.
Offline

