Oompa-Loompa Trojan Horse Q & A

By Michael Santo
Contributing Writer, RealTechNews

Intego, who discovered the Oompa-Loompa virus early last week, and who publishes VirusBarrier X and VirusBarrier X4, has a Q & A page on its website that addresses some of the questions regarding the virus.

Some examples:

Does this Trojan horse indicate its presence by asking for an administrator’s password?
No. This Trojan horse runs a script in a Terminal window, but gives no other indication of its actions. It does not need an administrator’s password, since it infects either the current user’s home folder, or, if the user is logged in as root, a system folder. In the first case, no password is required to add files to a user’s home folder. In the second, relatively rare case, a user logged in as root does not need to enter a password to install files in system folders.

Where did Intego first find out about this Trojan horse?
Intego received a copy of this Trojan horse on February 14, 2006, after an Intego user discovered it on a Macintosh forum. The user expected the file to contain pre-release pictures of a new operating system, but instead it infected his Mac. The user discovered this later when iChat buddies on his local network asked why he was sending them files; he also found that some of his applications no longer launched. Source: Intego Press Release

We Say: There’s a great deal of other interesting information regarding this in the press release. I have plenty of friends who have Macs who have no Antivirus solution, but most of themare convinced that with the change to Intel, plus with the additional attention Apple has been getting lately, they are going to have to change this. I think they may be right.