html:script-inf ; how do I get rid of pop ups for it?

Viruses and worms
1

I tried posting this in the mac forum since I use a mac, but haven’t had much response so I thought I’d try here:

I’m not sure if I have this virus or not. My webshield keeps blocking something, coming up with this warning about every day or second day:

infection: html:script-inf
url: h??p://www.rytterfalk.com/2011/02/04/calibrate-your-mac-for-free

I did visit that website via a google search about a week ago, however I still get ‘infection detected!’ pop ups even though I am not at that website.

When I do a system scan, no infection comes up. I do, get some ‘warning’ about:
/System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/Loaders/MKDrivers.bundle/Contents/Resources/bootroot.loader
but nothing else.

I’ve deleted my cookies, history and temporary internet files. Avast (on mac) doesn’t seem to give me an option on repair/delete/quarantine a file. How do I clean up this infection (if I have one)?

2
Avast (on mac) doesn't seem to give me an option on repair/delete/quarantine a file. How do I clean up this infection (if I have one)?
what file is that?

attach screen shot …

is it this one ?

/System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/Loaders/MKDrivers.bundle/Contents/Resources/bootroot.loader
and what is the warning ....what does avast say ?
3

well it’s not really the file I’m concerned about. It’s the URL that webshield keeps blocking… even if I am not visiting the website.

I have a feeling the the warning is just a false positive.

But I’ve attached a few screenshots if its helps

4

here’s a log of the webshield

5

log of the system scan, with warnings showing:

6

OK i am not familiar with the avast mac …so i dont know what the “File with warning” means ?
is there some thing you can click to get details ?

anyway since you get the pop up when not doing anything …may indicate a infection
i scanned the URL with a bunch of online tools and they give that website a clean ?

i have sendt a PM to the removal specialist so that he will have a look when he arrive here later …not sure if he can fix a Mac but he may know someone :wink:
…may take some hours so be patient

7

If you have indeed visited the site, then it is highly possible that you were infected from it.

There was a trojan downloader on that site… See:
https://www.virustotal.com/file/6b7d923f4215c96d19e708ff1440e48da003dd35ff5756fce98e122bee560296/analysis/

8

so how do I clean it out if avast isn’t picking it up on the system scan?

9

The removal experts recomend you try Geeks to Go as they have a Mac section and Mac OS experts there…the one here in the forums only work on windows OS

http://www.geekstogo.com/forum/