bofors Posted April 11, 2008 Share Posted April 11, 2008 Porn4Mac (attached) appears to be a trojan similar to or perhaps the same as the OSX.RSPlug.A trojan that emerged last fall: http://www.intego.com/news/ism0705.asp http://www.macworld.com/article/60819/2007/10/trojan.html http://www.macworld.com/article/60823/2007...rojanhorse.html http://forum.insanelymac.com/index.php?sho...=68825&st=0 I ran into this trojan via this Digg page: http://digg.com/world_news/Victoria_Lindsay At least two of the bogus video links on that page lead to this .dmg trojan which claims to be installing a "new version of Video ActiveX Object" to view a video (the other links lead to .exe file trojans): http://exclusive-videos.net/video/Cheerleader_Ambush http://hotwn.com/index.php?vid=Cheerleader-Ambush The only report of this specific "Porn4Mac" trojan that I found was on a French Mac forum which seems to indicate that it is a version of the OSX.RSPlug.A trojan: http://forums.macgeneration.com/vbulletin/...ad.php?t=212094 (Anyone actually interested in watching the Victoria Lindsay video can find at least part of it here: http://wiresmash.com/people/victoria-lindsay/ ) 1023.dmg Link to comment Share on other sites More sharing options...
xtraa Posted April 11, 2008 Share Posted April 11, 2008 Thanks for the warning. This trojan is out now for about two weeks, but it is good to post a warning about an actual link to it! Link to comment Share on other sites More sharing options...
socal swimmer Posted April 17, 2008 Share Posted April 17, 2008 wait, you seriously just attached it to your post? I would download it to see, but that would be stupid. Link to comment Share on other sites More sharing options...
(MoC) Posted April 17, 2008 Share Posted April 17, 2008 I would download it to see, but that would be stupid. No, it would be smart man! I expect a patch from Apple in a few... Link to comment Share on other sites More sharing options...
bofors Posted April 17, 2008 Author Share Posted April 17, 2008 wait, you seriously just attached it to your post? I would download it to see, but that would be stupid. InsanelyMac appears to have screwed up the posted file by making it a zip archive. But you can still get it from the links I posted above. It is safe to download and even execute because it a disk image of .pkg file, just don't install it by clicking <Continue> unless you want to activate the Trojan. Link to comment Share on other sites More sharing options...
rollcage Posted April 17, 2008 Share Posted April 17, 2008 Well your first hint should be "new version of Video ActiveX Object". Well, that and porn trying to install something. After you install it, does the video load? Cause some people might think it's worth it... Link to comment Share on other sites More sharing options...
bofors Posted April 17, 2008 Author Share Posted April 17, 2008 After you install it, does the video load? I didn't install it because, as you point out, it is obviously malware. The videos are clearly bogus too, there is no reason to suspect they have any capacity to load. Link to comment Share on other sites More sharing options...
DJ Loe Kee Posted April 17, 2008 Share Posted April 17, 2008 i've seen this "you need to dl a video codec in order to watch this video" on other websites before. but the thing is, i watch/dl anime with zoomplayer (vlc player in the past) so i have most of the codecs available 'cause anime files come in many different formats. some of them are formats that wmp can't play even with plugins 'cause wmp doesn't recognize the "turn subtitles on and off" function for those files that come with dual japanese/english audio (i always switch to japanese audio/subtitles on). Link to comment Share on other sites More sharing options...
Redliner Posted April 20, 2008 Share Posted April 20, 2008 lol I almost installed it! good thing I didn't!* *I'm not really that stupid Link to comment Share on other sites More sharing options...
bofors Posted April 29, 2008 Author Share Posted April 29, 2008 SecureMac offers a free tool that appears to detect and remove this Trojan: http://www.dnschanger.com/ Link to comment Share on other sites More sharing options...
solaar Posted May 1, 2008 Share Posted May 1, 2008 lol good one. Who in his right mind would install something called Porn4Mac? That's almost as funny as Iloveyou.exe back in the Windoze days. priceless sorry guys but... come on... Link to comment Share on other sites More sharing options...
Dellius Posted May 3, 2008 Share Posted May 3, 2008 April 11th! LOL ! I also found something similar around that date, and it downloaded itself automatically and made an attempt to unpack itself and perform an install. Yes, I cancelled the unpacking process and I sent the dmg to the Trash and I felt very said that people are starting to make such things for Macs too. Link to comment Share on other sites More sharing options...
Recommended Posts