Tuesday, November 06, 2007
Tech: Leopard Trojan / Phishing fix
Last week the net was swamped with reports of a new Mac malware, the OSX.RSPlug.A Trojan Horse. Macworld has a detailed report on what it does and how to remove it.From MacWorld:
- In the Finder, navigate to /Library -> Internet Plug-Ins, and delete the file named plugins.settings. Empty the trash. This deletes the tool that sets the rogue DNS Server information.
- In Terminal, type sudo crontab -r and provide your admin password when asked. This deletes the root cron job that checks the DNS Server settings. You can prove it worked by typing sudo crontab -l; you should see the message “crontab: no crontab for root.”
- Open your Network System Preferences panel, go to the DNS Server box, and copy the entries you can see to a Stickies note, TextEdit document, or memorize them. Now retype those same values in the box, then click Apply.
- Reboot your Mac.
Bottom line is to follow typical 'safe computing' guidelines...
As always, the best way to avoid these things is to not install software from untrusted sources—especially if it comes as an installer package and requests your administrator’s password! But if you do get infected, at least you’ll know how to confirm you have an issue, and remove the troublesome software.
Labels: Apple Mac OS X, Malware, Security, Trojan Horse
Article Link posted by Edward at 11:01 AM
