The folks over at Intego let the world know about a new trojan making the rounds along with copies of an application designed to crack Adobe Creative Suite 4. They consider the risk “serious.”
If you don’t download software using peer-to-peer tools like BitTorrent, then you’re perfectly safe. You can stop reading this story, if you like. If you’re one of the 5,000 people who recently downloaded and installed the serial crack, then you have a bad day ahead of you.
The malware, after asking for your administrator password, installs an executable with a random name in /var/tmp, a folder that isn’t deleted when the computer restarts.
The randomly-named program will install itself in /usr/bin/DivX, create a startup item in /System/Library/StartupItems/DivX, and if it has root privileges, save a hash of your password in the file /var/root/.DivX.
The software then listens on a random TCP port and awaits instructions from its evil overlords. With an infected computer’s root password, those in control of the software will be able to execute commands on the infected computer, including deleting files and performing malicious network tasks.
Late last week, pirated copies of iWork ‘09 were infected with similar malware.
Intego VirusBarrier X4 and X5, as you might imagine, protect you against the Trojan. Either looking for (and removing) the files mentioned above or using a virus removal utility is recommended.
Also recommended: Not downloading pirated software (and their associated tools) on peer-to-peer networks. If you do choose to get your software that way, you have nobody to blame but yourself if your system gets infected.
