Mac Malware from Fake Flash Installer

[Corran]

No, very different. A virus self-replicates. A trojan is something installed by a user who has privileges to do so.

No operating system will ever be immune to trojan horse or other "social engineering" attacks. The exploit targets the user, not the computer.

It doesn't matter what kinds of locks are on your door of the bogey man tricks you into letting him in.

While splitting hairs might be fun, the point remains that there are programs designed to do harm in some way (be it stealing your personal info or messing with your files) affecting Macs these days and my point was only that they are not immune from trojans or viruses or whatever you want to call them due to the increased potential of Macs as targets these days.

[Ivan J. Eberle]

I use No Script as a plug-in for Firefox and it acts like a firewall. ( It's free. ) Don't expect that it causes any trojans to self-immolate, though.

[bobwysiwyg]

Little Snitch is great. I just installed it last night.

It operates initially in a free mode, which will turn itself off after three hours. You can restart it as often as you wish, still for free.

If you purchase the license it runs continuously; no restarts required. I bought the license.

I also use Sophos anti-virus for the Mac. There are very few viri for OS X, but some do exist.

No computer is entirely immune from malware, including those that are not connected to the internet.
Check the history of Stuxnet if you don't believe me.

- Leigh

Read "America the Vulnerable."

[Robert Kalman]

Thanks so much for this info! I just ran a check on my Mac (thought I may have run this fake program) and found that it is fine, though this has made me aware that I need to install some protection... so much for being a smug Mac user.

If people are now installing protection on their Macs, what's the preferred vendor??

[Winger]

If people are now installing protection on their Macs, what's the preferred vendor??

Macs still don't have the blue screen of death. I like my Mac because of no crashes. That was the bigger problem with PCs, imo (admittedly, that may have finally changed with their newer OS). I also don't like when I have to turn off all the "features" there to "help" me - and turn them off in two places. That's something I haven't had a problem with using a Mac.

[Corran]

I like my Mac because of no crashes.

[Winger]

That one hasn't happened to me. My Macbook Pro has gone from Feb '07 to now just fine. My iMac is over a year with no crashes. My last 2 PCs (on 4 different versions of Windows) crashed about twice a week. The ones at work were nearly up to once a day.

[Frank Petronio]

The only thing that ever locks up my Macs in recent years has been Adobe Flash.

[Bruce M. Herman]

Before anyone goes off and runs a clean install of their Mac, look to the comments of the MacWorld article cited at the start of this thread. Toward the bottom of the page are commands to run in Terminal (one for Safari and one for Firefox) that will check to determine if the browsers have been infected. If they have, the fix is as simple as deleting the browser and re-installing it. Here's the text if you don't want to go to the article.

From Apple Insider, I picked this up:
"Because the Trojan appends launch instructions to property lists within the Safari and Firefox programs, if you would like to check to see if a system has been infected with this Trojan, you can open the Terminal (in Applications > Utilities) and run the following commands:

If you have Safari:

defaults read /Applications/Safari.app/Contents/Info.plist LSEnvironment

If you have Firefox:

defaults read /Applications/Firefox.app/Contents/Info.plist LSEnvironment

On an uninfected system these commands should produce an error message stating the specified domain/default pair does not exist. However, if these commands give an output that includes the text "DYLD_INSERT_LIBRARIES" followed by a path to a file, then the Trojan installer has been run and has infected the system. If this is the case, you can remove the infection either by editing Safari or Firefox to prevent the payload from running, or by simply deleting the browsers and downloading them again. Doing the latter should completely remove the payload from your system."

[jb7]

A couple of weeks ago a pesky Flash installer popped up asking to update my Adobe Flash plug-ins on my Mac.

The only thing that ever locks up my Macs in recent years has been Adobe Flash.

Good to see the hacker has a healthy sense of irony...