This one is a real non starter, other than Intego trying to drum up
more business.
Here is the "malware". You can write your own if you like:
rm -rf
Save it as a file and then run it and you to can wipe out your home
directory if you like. It is a unix command that has been around since
the start of Unix. It is equivalent to the DOS command of a: del *.*
or any other operating system that is out there that has a delete file
function (including every Mac OS since the first). Basically all
someone has done is put it in an AppleScript file and stick a M$ icon
on it and set it loose on the P2P network.
It is really just a one line program, it truthfully does not really
even fit the Trojan Horse definition (bad Intego, shame shame shame),
there are programs in every Mac OS that will let you delete
directories, this one is not even exciting.
Jerry
----------------------------------------------------------------------
new, adj:
Different color from previous model.
----------------------------------------------------------------------
On May 12, 2004, at 7:07 PM, Tony LaFemina wrote:
> Hi All
>
> I just got this in an e-mail from another list and thought it might be
> of interest to all you MS Word lovers.
>
> << From MacWorld UK...
>
> http://www.macworld.co.uk/news/top_news_item.cfm?NewsID=8664
>
> Mac under fake Word 2004 attack
>
> By Karen Haslam
>
>
> Macworld UK has learned of a dangerous malware that deletes the Home
> folder on a Mac. The file is cunningly disguised as a Word 2004 for
> Mac demo - from the forthcoming Office 2004 for Mac suite.
>
> A Macworld reader alerted the magazine to the malware after he
> downloaded the file from Limewire. The reader told Macworld: "I
> downloaded the file in the hope that perhaps Microsoft had released
> some sort of public beta. The file unzipped, and to my delight the
> Microsoft icon looked genuine and trustworthy."
>
> However, he added: "I clicked on the installer file, and to my horror
> in 10 seconds the attachment had wiped my entire Home folder!"
>
> Mac malicious
>
> Macworld has been able to acquire the file from Limewire, and has
> received confirmation from Internet security company Intego that its
> contents appear to be malicious.
>
> Intego was initially criticized for exaggerating the threat of the
> concept Trojan Horse identified last month.
>
> Microsoft responds
>
> Microsoft has issued no official public beta of Microsoft Office 2004,
> which has not yet shipped.
>
> A Microsoft spokesperson said: "Security is a top priority for
> Microsoft, and we are committed to ensuring a safe and reliable
> computing experience for all of our customers. Microsoft does not
> currently offer any Web downloads for Microsoft 2004. The best way to
> ensure you have a legitimate copy of any Microsoft products is to
> ensure you purchase it from any licensed reseller or VAR.
>
> "Microsoft Office 2004 for Mac should only be installed from retail or
> site-licensed media purchased through authorized resellers or VARs,
> where the authentic install icon will be found in the product install
> wizard.
>
> "When looking for product enhancements from Microsoft customers should
> always download from www.microsoft.com/mac or use the new auto-update
> tool in Microsoft Office 2004 for Mac."
>
> Unix under attack
>
> Macworld had previously warned that malware writers are showing
> renewed interest in Unix systems. Sophos senior technology consultant
> anti-virus expert Graham Cluley told Macworld: "A small number of
> virus writers are showing an increased interest in Unix, and there
> have been Unix worms which have spread in the wild."
>
> He added: "For this reason Mac OS X users should not think they have
> nothing to worry about moving into the future."
>
> Macworld is speaking to all concerned, and will publish more
> information as it becomes available.
>
>
>
> --
> Tony LaFemina
> When you want to do more than just buy software
> http://hometown.aol.com/visitmacland/index.html
> mailto:remacs at optonline.net
>
>
>
>
> | The next meeting of the Louisville Computer Society will
> | be May 25. The LCS Web page is <http://www.kymac.org>.
> | List posting address: <mailto:macgroup at erdos.math.louisville.edu>
> | List Web page: <http://erdos.math.louisville.edu/macgroup>
>
>
-----------------------------------
Someday, I will come up with a clever signature line. I am not sure if
I will use it or not, but I will come up with one.
| The next meeting of the Louisville Computer Society will
| be May 25. The LCS Web page is <http://www.kymac.org>.
| List posting address: <mailto:macgroup at erdos.math.louisville.edu>
| List Web page: <http://erdos.math.louisville.edu/macgroup>
