I think I got hacked! Weird behavior with Safari

[porter]

I have a G5 running OSX 10.2.8 with the latest security release.

So my dad tries to log into his banking account using IE and a weird message pops up saying that the certificate expired or that the webpage may be posing as fidelity. OK, so I'm thinking that they're doing some maintenance work over the weekend.

Later on Safari, I try to log into .Mac with Safari and I get the message that the certificate is not valid or expired. Which is a first for me, I've never seen this before.

So I try the same thing on Netscape and I get the same message, only this time it says the certificate won't be valid until 10/11/03 or something like that and it says to check my date and time- the time is correct, so just for shits and giggles I check the date and it's Jan. 1 1970. So I change it and now I don't get the weird messages. I don't think anybody in my family changed it, what could have caused it?

[Ryan]

Did you zap the PRAM recently? That would reset the clock to that date.

Just connect to a network time server(there should be one in System Preferences) and all will be well with the world. :)

[porter]

No nothing like that, I did unplug the computer last night because of thunderstorms, but this has never happened before.

But yeah, I did change the date and everything works, but I'm trying to figure out why the computer did what it did.

[AirSluf]

XXXXX

[usurp]

sorry this might be out of topic but how come your G5 is running 10.2.8? dont all G5s come with 10.3? or were the first G5s out before 10.3?

[DMBand0026]

First G5s that came out ran a special build of Jaguar, 10.2.7 if I recall correctly. That build was only available for the G5s.

[Brad]

Simple, it checked the date on the computer and the date of the certificate and the check failed as the certificate was showing a date newer than what the computer had.
Bingo.

In further details, if the computer loses power or nukes the PRAM or NV-RAM, the internal clock is reset to the UNIX Epoch Time of 00:00 1970 January 1, GMT. This time is noteworthy because the clock on your computer is actually a simple counter that increments every second from that time. At least, that's how it works in UNIX and Mac OS X.

[FFL]

First G5s that came out ran a special build of Jaguar, 10.2.7 if I recall correctly. That build was only available for the G5s.
You Recall Correctly.

[thuh Freak]

Bingo.

In further details, if the computer loses power or nukes the PRAM or NV-RAM, the internal clock is reset to the UNIX Epoch Time of 00:00 1970 January 1, GMT. This time is noteworthy because the clock on your computer is actually a simple counter that increments every second from that time. At least, that's how it works in UNIX and Mac OS X.
uninteresting side note: classic mac epoch was 00:00:00 1904 Jan 1, local time. from the jargon file (http://catb.org/~esr/jargon/html/E/epoch.html)

[porter]

Well after I reset the date, I downloaded Virex from .Mac and ran it- I had 5 infected files all infected with the Exploit-ByteVerify Trojan!

[Brad]

Well after I reset the date, I downloaded Virex from .Mac and ran it- I had 5 infected files all infected with the Exploit-ByteVerify Trojan!Keep in mind, of course, that this is a Windows trojan. Like all Windows viruses, trojans, etc. it was completely inert on your Mac and could have caused you no harm.

This is a mere coincidence that you found it after your power was zapped and clock reset. It's very likely that it's been sitting on your computer for a very long time in an e-mail or something and since it can do you no harm you never noticed it.

That previous paragraph is so important that is bears repeating. This is a mere coincidence that you found it after your power was zapped and clock reset. It's very likely that it's been sitting on your computer for a very long time in an e-mail or something and since it can do you no harm you never noticed it.

[alcimedes]

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Systems Not Affected: Linux, Macintosh, OS/2, UNIX

as per symantec's page.

[_Ω_]

Do you think they get tired of cutting and pasting that information for every virus/trojan out there?

:lol:

[porter]

Hmm... I didn't see that systems not affected section, but I wasn't too worried- not too many viruses out there for OSX.

If I had 5 infected files on a Mac, I wonder how many I had on my old PC!