Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Alert

What do I do with OSX10.6.8 with Cowhand-C virus?

Feb 22, 2015 5:44AM PST

Hi,

I'm new here. Years ago I installed some free Sophos virus software on my computer and forgot about it. Today it popped up telling me that I have been infected with Cowhand-C a trojan. Their solution was way too complex for me to tamper with. Online it said that this virus effects the operating system. I use snow leopard with an iMac and for various reasons I don't want to upgrade it. In another place online it said that these virus's basically only effect Windows machines and that it's probably attached to something that has Windows involved. I don't and never have used Windows. So, I'm not sure what is correct. I'm having quirky things going on with my Mac but mostly it keeps chugging along; with no major problems that I can tell.

Can someone please suggest a solution that is either easy or understandable - or maybe there's nothing I have to do???

Thanks!

Discussion is locked

- Collapse -
From what I could tell this is an old neutered Trojan.
Feb 22, 2015 6:09AM PST
http://comp.sys.mac.advocacy.narkive.com/7DnfZGtz/new-mac-os-x-malware-mac-cowhand-a

I think the first sighting was in 2004 but it was relabeled and added to Sophos in 2005.

Given it's a Trojan, you should be able to find it and delete the file that it runs. It's not a virus.
http://forums.macrumors.com/showthread.php?t=123714 repeats:

"NO, this is a Trojan, meaning its something you downloaded or put on your system knowingly that then harmed your system. Viruses are self replicating, this is not. Viruses usually get into the system without you knowing."

Check your startup items next.
Bob
- Collapse -
I'm going to stop being exasperated over this!
Feb 22, 2015 9:16AM PST

Thanks so much, you're correct, my bad, it is a Trojan - not a virus. They are in a similar category, but very different. I've read your links and lots of other stuff too. I've locked my shared items so nobody can get in without my permission (I think), probably making the Trojan inept. I couldn't find any startup items that I could identify. I removed the Sophos software. I can't do the technical stuff with the terminal. So, I guess I have to live with it - as it is.

Now I'm concerned about when I get a new computer, I wanted to transfer only old files from my external hard drive to the new computer. I think it will be okay because I won't be transferring the old operating system.

So, I'm hoping that it's true that this Trojan is neutered.

Thanks for all your help.

- Collapse -
No problem.
Feb 22, 2015 9:33AM PST

I'm running into folk that lump everything into "virus." I can't do that since it's not been accepted by those that work with such pests. If we want to call them malware, pests, etc. I could go for that.

This trojan shouldn't be an Apple OS file. The scanner (Sophos) should have a report on where the suspect files are.
Bob