yep. I forgot about the "a" option there. still, if the folder is not there, then its likely you are not infected. still, as a placeholder that has no write perms, that would definitely work to keep the worm off.
now all we need is a bird to catch the worm. :) -eric On Oct 6, 2014, at 7:02 AM, 'Chris Blouch' via MacVisionaries wrote: > Close, spaces in terminal commands imply separate commands unless you tell it > that you really meant a space by putting a backslash "\" in front. So the > test would be: > > ls -a /Library/Application\ Support/JavaW > > The -l also isn't needed. The L means to display the listing in long format > so it shows the date, number of bytes etc. Since we're just checking for > presence of the folder we don't really care about formatting of the list. > > I read elsewhere that you can foil their install by creating a JavaW folder > yourself and then locking it down: > > sudo mkdir '/Library/Application Support/JavaW' > sudo chflags schg '/Library/Application Support/JavaW' > > CB > > On 10/4/14, 12:17 AM, Eric Oyen wrote: >> hello all, >> >> there is a simpler way and it works with voiceover. >> >> just open a terminal window and type at the command prompt: ls -al >> /Application Support/JavaW >> >> if it returns no such directory, then you are gold! :) >> >> -eric >> >> On Oct 3, 2014, at 9:06 PM, Eileen Misrahi wrote: >> >>> Hello, >>> >>> When I first followed the instructions, I didn't see what needed to be >>> copied. I manually inputted the file thread into the edit field. I'm okay >>> too. >>> >>> Best, >>> Eileen >>> >>> Sent from my iPhone >>> >>>> On Oct 3, 2014, at 1:12 PM, Andrew Lamanche <ioani...@me.com> wrote: >>>> >>>> I've followed your instructions but I get nothing back. maybe there's a >>>> visual window that displays no folder found but I can't see it with >>>> Voiceover. >>>>> On 3 Oct 2014, at 19:09, Christopher Hallsworth <challswor...@icloud.com> >>>>> wrote: >>>>> >>>>> New Mac malware discovered; how to check your Mac for 'iWorm' malware >>>>> by MacDailyNews >>>>> [cfsp key="adsense_336x280"]"Dr. Web announced the discovery of a new >>>>> piece of Mac malware on Monday, which they are calling >>>>> Mac.Backdoor.iWorm. According to their report, they believe the malware >>>>> is affecting 'more than 17,000 unique IP addresses,'" The Safe Mac >>>>> reports. "Of course, this may not correlate well with the number of >>>>> infected Macs, since most Macs do not have static IP addresses, but the >>>>> number of infected Macs should at least be on the same order of >>>>> magnitude." >>>>> "It's unclear from Dr. Web's report exactly how the malware gets >>>>> installed," The Safe Mac reports. "The name 'iWorm' suggests some kind of >>>>> virus-like behavior. According to the report, the 'dropper' (ie, the >>>>> program that installs the malware) puts the executable in a folder named >>>>> JavaW in the /Library/Application Support/ folder, but this does not >>>>> necessarily mean that Java is involved in any way. The name could simply >>>>> be chosen as camouflage." >>>>> "To check to see if you are infected, go to the Finder and choose Go to >>>>> Folder from the Go menu," The Safe Mac reports. "Copy the following path >>>>> and paste it into the window that opens - /Library/Application >>>>> Support/JavaW - then, click the Go button. If you just get a beep, and >>>>> the window displays a message in the bottom left corner that the folder >>>>> can't be found, then you should be okay. >>>>> -- >>>>> >>>>> Sent from my laptop >>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google Groups >>>>> "MacVisionaries" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send an >>>>> email to macvisionaries+unsubscr...@googlegroups.com. >>>>> To post to this group, send email to macvisionaries@googlegroups.com. >>>>> Visit this group at http://groups.google.com/group/macvisionaries. >>>>> For more options, visit https://groups.google.com/d/optout. >>>> -- >>>> You received this message because you are subscribed to the Google Groups >>>> "MacVisionaries" group. >>>> To unsubscribe from this group and stop receiving emails from it, send an >>>> email to macvisionaries+unsubscr...@googlegroups.com. >>>> To post to this group, send email to macvisionaries@googlegroups.com. >>>> Visit this group at http://groups.google.com/group/macvisionaries. >>>> For more options, visit https://groups.google.com/d/optout. >>> -- >>> You received this message because you are subscribed to the Google Groups >>> "MacVisionaries" group. >>> To unsubscribe from this group and stop receiving emails from it, send an >>> email to macvisionaries+unsubscr...@googlegroups.com. >>> To post to this group, send email to macvisionaries@googlegroups.com. >>> Visit this group at http://groups.google.com/group/macvisionaries. >>> For more options, visit https://groups.google.com/d/optout. > > -- > ¯\_(ツ)_/¯ > > -- > You received this message because you are subscribed to the Google Groups > "MacVisionaries" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to macvisionaries+unsubscr...@googlegroups.com. > To post to this group, send email to macvisionaries@googlegroups.com. > Visit this group at http://groups.google.com/group/macvisionaries. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "MacVisionaries" group. To unsubscribe from this group and stop receiving emails from it, send an email to macvisionaries+unsubscr...@googlegroups.com. To post to this group, send email to macvisionaries@googlegroups.com. Visit this group at http://groups.google.com/group/macvisionaries. For more options, visit https://groups.google.com/d/optout.
