Hacker News Reader

Comment by mmgutz | Hacker News Reader

Does installing 2.9.1 remove it completely or just from the Transmission app? I'm concerned the malware is still there.

Additionally, what does the malware do? "OSX.KeRanger.A" appears to be a name that Apple assigned it in their malware definitions, but Google doesn't know anything except the pages about Transmission.

I'm curious what sort of malware we're looking at. Botnet? General remote access/control? Harvesting keychains?

According to this article it's ransomware.

http://www.cnbc.com/2016/03/06/reuters-america-apple-users-t...

Thanks! Guess my search was too specific. The important bit:

> The malware is programmed to encrypt files on an infected personal computer three days after the original infection, according to Olson.

Anyone who may have been hit, update your backups NOW so you can restore the files.

Careful not to backup the malware infection though...

Of course, and if you only have the one backup drive, be wary of connecting it to an infected computer with read/write access. Link posted in another comment suggests that this malware has encryption of Time Machine backups in development (should be safe this time around?).

Safer option would be to create a write-only network share on another computer and copy files to that.

Looks like the developer is working on a version that will remove the malware if it has been installed :https://github.com/transmission/transmission/commit/dc60d256...

Interesting and scary. Wouldn't that risk removing any chance of actually recovering files (by paying the ransom?)

Reply on news.ycombinator.com