HTML/Phishing.Agent.BUJ trojan // cleaned by deleting

[PACA 0]

Hi! 

Since 7 days ago I've been seeing this pop up notification about this HTML/Phishing.Agent.BUJ trojan thread found. It's saying it has been cleaned by deleting but it keeps popping up this message. 

I looked for the file in the computer and I deleted but even when I did that it didn't work. 

I am not exactly sure if I opened a link or what is the cause of this thread. I would like to know what can I do to delete for sure this threat from my computer. 

I already run a deep scan and it's saying that there are no threats.

Please help!

Thanks! 

 

 

[Marcos 5,074]

Please provide logs collected with ESET Log Collector for a start.

[PACA 0]

Hello Marcos, 

I am replying to this response. Please guide me to solve the issue base on the information I am posting from the set log collector. 

Thanks, 

 

customer_info.zip

[Marcos 5,074]

The file keeps being re-created by the application: /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd (3512586AF44D531F2FF16C5C3E81DBB32AB93238).

It appears to be related to iCloud so make sure you don't have the phishing html in your iCloud container.

[PACA 0]

How I can recognize the phishing html and How can I eliminate that from the iCloud? Thanks! 

[Marcos 5,074]

I don't use iCloud so maybe somebody who use it will be able to help you. I assume that if a file is deleted locally, it should be deleted in the cloud upon the next sync.