Trojan Horse spreads around the internet, targeting your Mac
Wednesday, October 31st, 2007Intego, a security research company, has issued a security alert for Mac users about a new Trojan Horse called OSX.RSPlug.A. Specifically, the Trojan changes your DNS address and points it to phishing and adult sites. If you have this trojan, more then likely you acquired it from a.. adult site. But if you haven’t (promise?) then you’ll know it’s there because a fake codec will be “required” to watch videos and once you install it, you will: a) not have said codec, and 2) have a Trojan Horse on your computer. Luckily, your virus software (if you have any) will probably remove it, or you can follow these simple steps as described by Macworld:
In the Finder, navigate to /Library -> Internet Plug-Ins, and delete the file named plugins.settings. Empty the trash. This deletes the tool that sets the rogue DNS Server information.
In Terminal, type sudo crontab -r and provide your admin password when asked. This deletes the root cron job that checks the DNS Server settings. You can prove it worked by typing sudo crontab -l; you should see the message “crontab: no crontab for root.”
Open your Network System Preferences panel, go to the DNS Server box, and copy the entries you can see to a Stickies note, TextEdit document, or memorize them. Now retype those same values in the box, then click Apply.
Reboot your Mac.
Even if you don’t think you have OSX.RSPlug.A, it probably isn’t a bad idea to check. All it requires is looking for a file called “plugin.settings” in your Library folder (presumably the one in the root of the HD, check your user Library folder too though).
