Virus Keeps Returning

[Laisha]

This is probably the wrong forum for this question, but since there are no threads I can find about viruses, I have guide as to where it should go.

My anti-virus keeps finding the same virus -- JS_NEMUCOD.SMAA9 -- in my /MobileSync/ folder.

I know it's a Windows virus, but it's irking me no end. Can anyone tell me how it is transferred? The fact that it's in MobileSync is confusing me, I think.

I review websites and blogs for a living, so basically, for 40 hours of every week, I'm going to all manner of websites, hence the anti-virus. And hence, no doubt, the virus. I download pretty much nothing, unless it's from my lawyer or my husband, so I don't understand.

 

[simonsi]

Mobilesync is where iTunes backups of your mobile devices are kept, I'm not sure they are kept there as openly-readable files so it may be a false positive but you can always copy the backups elsewhere and start again.

 

[burgman]

That zip is loaded from an Email according to Microsoft "The text of the email will instruct you to open the attachment which it claims is an invoice, passport, or some other official document" So Maybe try a free or trial version of another anti-virus to see if a false positive. If same hit then delete device backups in iTunes then scan again, if clean perform a backup of one device, scan then another if all clean then it's from an old backup. Do you use iCloud backup or just on your desktop? Scary part is even though you can't be infected you could have forwarded it to others with windows machines.

 

[techwarrior]

MobileSync is your iTunes device backup location (~/Library/Application Support/MobileSync). This would suggest that the document is on an iPhone or iPad and probably keeps getting written to this directory every time you sync\backup the device. If it is in an email, delete the email on all of your devices, then re-run virus scan.