Thursday, February 16, 2006

First True MacOS X Virus? NOPE! (Updated)

Probably not. But MacRumors.Com is reporting on a new piece of code which is causing many users problems.

On the evening of the 13th, an unknown user posted an external link to a file on MacRumors Forums claiming to be the latest Leopard Mac OS X 10.5 screenshots. The file was named "latestpics.tgz"
The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but is actually a compiled Unix executable in disguise. An initial disassembly (from original discussion thread) reveals evidence that the application is virus-like or was designed to give that impression.
This is a good time to remind folks about ClamXAV which is a FREE Virus Scanner for MacOS X. Download it now, and be sure to run it at least weekly.

UPDATE at 2 PM: This site confirms this is not a true virus but a trojan horse. The difference? A virus can spread on its own by simple exchange of files. A trojan horse requires the user to perform actions. In this case, unless you uncompress the file AND OPEN THE RESULT you are safe. Just receiving this in the mail is no threat.

1 comment:

Anonymous said...

I read the linked forum article and I'm sorry to say this is bullshit.

If it spreads from one file to another, it's a virus. A trojan is something that doesn't spread from file to file. A worm propogates itself using social engineering or security holes. The only other combination that makes sense is a virus and a worm together.

This fits the definition of virus, it does not fit the definition of trojan or worm.