How to clean infected external hard drive?

Avast Mac Security
1

Hello,

I’ve just run my first full scan with Avast for Mac on my MacBook Pro and have found a number of infections in my external hard drive (G-drive). The problem is I don’t know how to deal with them as when I press Delete I get this message:

Failed to delete /Volumes/G-DRIVE slim/Backups.backupdb/Kylie’s MacBook Pro/2013-06-21-115749/Macintosh HD/Users/KylieH/Library/Mail/V2/POP-kylieh@communitysolutions.ca@pop.communitysolutions.ca/INBOX.mbox/761886C8-0963-4DF6-A630-6F844BFB2880/Data/1/2/2/Messages/221928.emlx.

Some of the infections that have come up are:

JS:Blackole - DT [Expl]
JS:lframe - AIQ [Trj]
JS:Redirector - AID

etc. etc.

Can anyone please tell me what I should do next?

Thanks,

Kylie

2

Hello Kylie,
could you please try to repeat a delete operation an take a look to system log (i.e through /Applications/Utilities/Console), if there’s a more detailed information? The path you have mentioned looks like you backup your computer (i.e. using parallels) to your external drive. In such a case I’m not sure, if the partition is mounted as writable and what would be reaction of a backup tool, if you would delete these files manually. Otherwise, if there is not a bug in avast! code and if your user account is among computer administrators, I would expect that you should be asked to enter a password during a delete operation and then the file should be deleted with a superuser permissions.

Best Regards,
Martin

3

I’m not very technical, but I’ve found and attached the systems log.

Yes, I’m backing up my computer to my hard drive.

I’m afraid I don’t understand the rest of your posting. ???

Thanks for your patience,

Kylie

4

Hello Kylie,
in the system.log I don’t see anything suspicious.

I wouldn’t delete a backup file directly - I would not be sure, how a backup tool would behave in a moment when you would try to do a restore. For the Time Machine, if you still have an original infected file on your hard drive, see attached a guide how to remove a file from all backups: http://reviews.cnet.com/8301-13727_7-57597578-263/how-to-clear-unwanted-files-from-time-machine-backups/

As the virus was in yours mailbox, the infected file will be downloaded from a mail server to your hard drive again, until you delete the mail message that has it as an attachement. If the infected file is only in backups and nowhere else, I would leave it there, it is harmless.

Best Regards,
Martin

5

Okay, good to know.

Thanks Martin,

Kylie