安装了 Transmission 2.9.0 版本的朋友们请立即更新并检查

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

这是一个创建于 3190 天前的主题，其中的信息可能已经有所发展或是发生改变。

New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer
“安全”的 Mac 再中招：勒索软件入侵，赎金达 400 美元

20 条回复 • 2016-03-09 15:24:06 +08:00

cheny95

2016-03-07 11:45:24 +08:00

2.84 (14306) 路过

tracyone

2016-03-07 11:46:02 +08:00 via Android

呵呵敲诈勒索，传播计算机病毒，入侵网站，够那些 cracker 蹲个十几年了

RoberMac

2016-03-07 11:57:17 +08:00

"Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger."

xenme

2016-03-07 12:17:07 +08:00 via iPhone

都挂 nas 下载，没这问题。

wbsdty331

2016-03-07 12:20:39 +08:00

帖子里说这个勒索软件有有效的开发证书，那不是开发者的信息苹果那里会有吗，这人还跑的了？

wushuang

2016-03-07 12:27:19 +08:00

我去， 2 月份装过一个版本，太危险了

squid157

2016-03-07 13:46:04 +08:00 via iPhone

@wbsdty331 偷别人的证书啊

boywang004

2016-03-07 13:50:23 +08:00

勒索软件比一般的木马病毒都可怕……不过话说这种勒索软件运行时不会要求 root 权限么？

xbb7766

2016-03-07 14:41:19 +08:00 via Android

擦，这软件好久没发布新版了，一更新就来个大新闻也是醉了……

SilentDepth

2016-03-07 14:48:52 +08:00

基于行为检测的安全软件有可能预防这类勒索程序吗？

lv_v

2016-03-07 15:24:07 +08:00

我擦，周末升级了 2.90 啊~！
这几天一直没关机过，刚才升级到 2.92 了，目前没发现什么不正常情况，怎么检测是否中招及清除感染啊？

hahasong

2016-03-07 15:24:54 +08:00

昨天提示我升级被我拒绝的路过，下载软件能用就行，越升越卡，广告越多。 ut 就是鲜活的例子

lv_v

2016-03-07 15:30:39 +08:00

按以下步骤检查我貌似没中招……

We suggest users take the following steps to identify and remove KeRanger holds their files for ransom:
1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission.
2. Using “ Activity Monitor ” preinstalled in OS X, check whether any process named “ kernel_service ” is running. If so, double check the process, choose the “ Open Files and Ports ” and check whether there is a file name like “/Users/<username>/Library/kernel_service ” (Figure 12). If so, the process is KeRanger ’ s main process. We suggest terminating it with “ Quit -> Force Quit ”.
3. After these steps, we also recommend users check whether the files “.kernel_pid ”, “.kernel_time ”, “.kernel_complete ” or “ kernel_service ” existing in ~/Library directory. If so, you should delete them.