[Macpartners] new OS X Trojan horse?

[Chris Griffith]

On Apr 9, 2004, at 6:05 AM, Stan Diamond wrote:
> I have seen two separate reports yesterday concerning a new Trojan 
> Horse exploit that comes in the form of an MP3 file. It has been 
> identified as VirusMP3. See more info here - 
> http://www.macnn.com/news/24167
>
> Have you seen these references? what are you recommending to deal with 
> it?

My advice has been:

*  If you own anti-virus software, check the vendor's web site for 
updates. If you don't, you may want to think about getting some.

*  Make sure Software Update is set to check for new updates regularly.

*  Apple Mail and most modern email programs will warn you if you try 
to open an attachment that's actually an application. If you are asked 
for permission to run an application, and you thought you were opening 
a document file, you should probably say "no".

*  Here's a way to check whether a file is really an application in 
disguise:

- Open a Finder window and navigate to where the file is saved.
- Click the View menu and change to "As List". Or hit Command-2 (same 
thing).
- Look at the "Kind" column for your file. (If there's no "Kind" 
column, click the View menu and "Show View Options" to display it.)

If your file is listed as an "Application" but you thought it was a 
document file like an MP3, then be very suspicious.

*  Finally there's the same advice that's been given to Windows users 
for years: don't open attachments that you didn't expect to receive, 
and be wary of files received from an unknown or anonymous source, such 
as downloads from a file-sharing program.

That's my 2c anyway.

Cheers,
-Chris