Mac trojan expands to affect Photoshop CS4
updated 10:50 am EST, Mon January 26, 2009
Mac trojan hits Photoshop
A second Mac trojan is being spread through pirated software, Intego warns. Following the discovery of a trojan linked with copies of iWork '09, the security firm says it has now found a variant, attached to pirated versions of Photoshop CS4. OSX.Trojan.iServices.B also grants a remote user root access; the new trojan is associated with the crack application however, and is spawned under a different name whenever the crack is run.
If a user is tricked into entering his administrator password, executables are also copied to fake user and system DivX folders. At this stage the trojan will begin listening on a random TCP port, and making regular connections to two different IP addresses.
The infected version of Photoshop is said to have been downloaded approximately 5,000 times already, and is once again described as an "extremely serious" threat, best avoided by either avoiding pirated copies of Photoshop or updating virus definitions. Active malware remains rare in the Mac world; the iServices variants are in fact believed to be two of the earliest confirmed trojans.
LOL!
01/26, 11:27am reply
One could simply not download from bittorrent sites or LimeWire, the equivalent of buying medicine from the people hanging out in the alley behind Walgreen's, instead of having your prescription filled inside the store.
gskibum3
Fresh-Faced Recruit
Joined: Nov 2006
must be slow
01/26, 11:29am reply
Im starting to wonder if they are the ones introducing these trojans for some "businesses"
Athens
Addicted to MacNN
Joined: Jan 2003
repeat after me...
01/26, 11:33am reply
repeat: A trojan is not a virus, a trojan is not a virus... A trojan, by definition, requires action by the (stupid) user where a virus can go scuttling off on it's own sweet way. Frankly, anyone who gets taken-in by a trojan (or a fake e-mail) deserves what they get, particularly if they have an eye-patch and a parrot on their shoulder!
Feathers
Forum Regular
Joined: Oct 1999
Brand new !
01/26, 11:51am reply
Pirated software contains trojan.
Guest
Fresh-Faced Recruit
Joined: Nov 1999
Thank you!
01/26, 11:53am reply
Thank you virus checker guys for helping me to steal software. I was becoming a little worried that I might suffer some consequences. And thank you Macnn for letting me know that the virus checkers are helping to make my stealing stuff a trojan free experience! What is the world coming to when I can't steal something and not suffer for it?
myramoki
Fresh-Faced Recruit
Joined: Jul 2004
Intego Desperation Sale!
01/26, 12:18pm reply
They are at it again - suddenly 5,000 Mac users, yesterday it was 20,000 Mac users and yet PB, MN and BTJunkie's downloaders say "nothing here". Selling anti-virus software to the Mac community is a very lonely business. Obviously Intego needs to scare up some sales. And MacNN is helping them out! Hooey - it is all Hooey.
OS2Guy
Fresh-Faced Recruit
Joined: Jun 2006
Fake
01/26, 12:25pm reply
Honestly, I've downloaded the iWork that they speak of. Two different torrents. This Trojan was not on either.
I think they are making it up.
ericdano
Fresh-Faced Recruit
Joined: Nov 2002
Intego's job
01/26, 12:44pm reply
How it is convenient that the same company who warned us of this "serious threat" coincidentally has something to protect our macs with, right?
ViktorCode
Fresh-Faced Recruit
Joined: Jan 2006
Shocking Development...
01/26, 12:56pm reply
Gee, using stolen software from some random download location could have consequences. Who knew?!?
heavyboots
Fresh-Faced Recruit
Joined: Dec 2003
this just in
01/26, 04:50pm reply
Intego recommends that all pirates illegally download a copy their virus software for there own protection.
Intego wants to scare the non-pirates into buying a copy because they now have sourced out a legitimate threat.
Intelligence will always supersedes virus protection.
circus
Fresh-Faced Recruit
Joined: Sep 2008