Mac malware uses Windows-style PDF camouflage ruse

[#1]

Have you guys seen this? I will be checking with McAfee to see there is a
definition update to detect this.
Anyway to use Casper to restrict this?
http://www.theregister.co.uk/2011/09/23/mac_malware_pdf_disguise/

[briangoldstein]

According to the story on Cult of Mac (http://www.cultofmac.com/?p=115345)
the process is named checkver. You can make a Restrict Software entry for
'checkver' that kills the process and deletes the file.

Brian

--
Brian Goldstein
Singer Consulting, Inc.
brian at randsinger.com
888.222.2959 x2103
For general support inquiries please email support at randsinger.com

[ernstcs]

One correction to this would be that it's 'checkvir' with an I.

Craig E

[#4]

I think that website has typo? Checkvir and checkfir.plist .

See this one make sense to me: restrict/delete checkvir in
/Applications/Utilities and delete checkvir.plist in
~/Library/LaunchAgents/
http://macs.about.com/b/2011/09/23/f-secure-reveals-new-mac-trojan.htm

I am also seeing other sites and most of them says checkfir.plist. So I
will delete both checkvir.plist and checkfir.plist .

Cem

Sent from my iPhone

[bentoms]

Apple's on the case

http://www.macrumors.com/2011/09/26/apple-updates-anti-malware-tools-to-address-new-trojan-threat/

Regards,

Ben.