McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

This trojan was distributed in a file called "Microsoft Word 2004 OSX Web Install", hence the name. (Note - the name can be easily changed and alone can be an indicator of neither malware presence nor absence).

The trojan contains a short malicious OS-X script (Unix script, in fact). When run the program executes this malicious script which performs a recursive deletion of all the files belonging to the current user. This deletes the trojan file too.

It is a simple trojan of "bang-you-are-dead" type and it is not using any vulnerabilities in Mac OS-X.

This trojan is not a threat on any Macintosh computers running OS Version 9 or below.

Symptoms

The trojan file carries the following icon:

Finder reports:

• Microsoft Word 2004 OSX
• Application
• 108 kb on disk (104,989 bytes)

Method of Infection

Trojans do not self-replicate.

Common vectors for trojan distribution are peer-to-peer file-sharing networks, Internet newsgroups and spamming of malware via Email.

Removal

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This trojan was distributed in a file called "Microsoft Word 2004 OSX Web Install", hence the name. (Note - the name can be easily changed and alone can be an indicator of neither malware presence nor absence).

The trojan contains a short malicious OS-X script (Unix script, in fact). When run the program executes this malicious script which performs a recursive deletion of all the files belonging to the current user. This deletes the trojan file too.

It is a simple trojan of "bang-you-are-dead" type and it is not using any vulnerabilities in Mac OS-X.

This trojan is not a threat on any Macintosh computers running OS Version 9 or below.

Symptoms

Symptoms -

The trojan file carries the following icon:

Finder reports:

• Microsoft Word 2004 OSX
• Application
• 108 kb on disk (104,989 bytes)

Method of Infection

Method of Infection -

Trojans do not self-replicate.

Common vectors for trojan distribution are peer-to-peer file-sharing networks, Internet newsgroups and spamming of malware via Email.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Variants

Variants -

N/A