I've looked through the latest version of the script available online (2.3.8 it looks like), and here's a brief rundown about everything that this script does...Opener tries to install ohphoneX, a teleconferencing program - for spying on you through your webcam I'm sure.It kills LittleSnitch before every Internet connection it makesIt installs a keystroke recorderAllows backdoor access in case someone deletes the hidden accountGrabs the open-firmware passwordInstalls OSXvncGrabs your office 2004 PID (serial number), as well as serial numbers for Mac OS XServer, adobe registrations, VirtualPC 6, Final Cut Pro, LittleSnitch, Apple Pro Apps, your DynDNS account, Timbuk2, and webserver users to name a few.It tries to decrypts all the MD5 encrypted user passwordsDecrypts all users keychains.Grabs your AIM logs, and tons of other settings and preferences with info you probably don't want folks to have... even your bash (terminal) historyGrabs stuff from your Classic preferencesChanges your Limewire settings to max out your upload and files.The hidden user account is called LDAP-daemon instead of the name hacker used in earlier versions. Looks more innocent than hacker.Even has your daily cron task try to get your password from the virtual memory swapfileIt installs an app called John The Ripper - a password cracker that uses a dictionary method to crack passwordsinstalls dsniff to sniff for passwords...
sudo ls -l /Users/*/Public/.info
Appleidee om 20:02, 23-10-2004Ach Apple zou een precies log moeten geven van alleswat er gebeurd. Dit zou je aan kunnen zetten als je ietsniet vertrouwd. Dan kun je meteen op stop drukken alshet niet goed is.Ik ben het wel met Reflex eens. Kijk maar even, ik weetniet zeker of ik het goed heb gelezen, maar als het goedmoet je het script zelf installeren, dus zo erg is het nogallemaal niet.
leonardo61 om 20:54, 23-10-2004@Macsterdam:Heb je deze gedaan $sudo ls -l /users/*/Public/.info en dan de 'entertoets'?Bij mij werkt(e) 't zo prima.
sudo ls -l /users/*/Public/.info
Argh.As several others have said in this thread, this is NOT a virus.It's a freaking SHELL SCRIPT that needs admin or root access to even install!It has NO vector of spread, NO method of remote infection, NO way to propagate.It is a UNIX script that needs to be MANUALLY INSTALLED by someone with admin, root, or physical access to the machine.Though this script tries to do nifty/nasty things specifically with OS X, it is no more of a piece of malware than this:#!/bin/shsudo rm -rf /There. A new "virus" that erases your whole drive when run!! OMG!!!Jeez. Of course, there will be some super-sensationalized article now from some media outlet talking about how there's a new Super-Duper Dangerous Worm for Mac OS X...Could something like this be installed by a trojan, such as a malicious installer masquerading as something else that prompts for admin privileges during the install? Sure. Would people find out about it in a heartbeat if anything like that ever happened? Yes. Would there be any mechanism or method of automated spread or infection? Nope.This is *NOT* a virus. It's not even a trojan! A "trojan" is an app that masquerades as one thing, but actually does another (e.g., an app that *installed* this code would be a trojan). But the script itself isn't even that! Technically, I suppose you could call it "malware", whose loose definition is any software that does something undesirable. But then, it's only malware when it's applied and actually in the wild. The one guy who claims to have found this thing on his computer probably had it put there manually by someone else.In short: this is NOT a virus, and NOT a trojan. It is a UNIX shell script that, when installed, tries to do some bad things. But it needs to be MANUALLY installed (or installed secretly by SOME OTHER PROGRAM WITH ADMIN ACCESS, which itself would be a trojan). But you folks need to understand that no matter what, if there is no mechanism or vector for automated propagation, even the nastiest thing someone can dream up will never rise to the level of of even the most benign viruses and worms on Windows, period.
sudo ls -l /users/+Public/.info
supertib% sudo ls -l /users/+/Public/.info tcsh: sudo: No match.
Gast
