Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Asgerhj

macrumors newbie
Original poster
Aug 20, 2009
12
1
Hi

Yesterday I googled for reviews of the new Playstation 3 Slim and came across a site, which looked like having a video-review.
But clicking on the player a “QuickTimeUpdate.dmg” started downloading and mounted automatically.
Suddenly the following warning appeared:

“install.pkg” will damage your computer. You should move it to the Trash.

“install.pkg” is on the disk image “QuickTimeUpdate.dmg”. Safari downloaded this disk image today at 23.25 from redrocktube.com. It contains the “OSX.RSPlug.A” malware.

I booted into Leo and tried the same procedure and got NO warning.
Scanning the .dmg with ClamXav I got a warning.


So what I am basically trying to say is:

1: I wasn't aware that SL has built in some kind of Antivirus/malware. Were you?

2: Take care - don't feel too secure running a Mac (I still hear lots of people telling lots of other people that there is no reason to fear malware on the Mac platform......)
Others say that the only way to get infected on a Mac is if you install the malware yourself (hence you are stupid) - but that is the whole point in trojans: You think that you are installing something useful, but...

For my part, I was sceptical about the download, because QT updates doesn't work that way, but had it been named e.g. "videocodec.dmg" I am not sure that I wouldn't have installed it....
Hopefully ClamXav would have caught it!
 

RemarkabLee

macrumors 6502a
Nov 14, 2007
562
9
Interesting.

Would be nice if SL had this added protection. Was it a system warning or Safari? Are you running the same version on Leopard (4.0.3?)
 

r.j.s

Moderator emeritus
Mar 7, 2007
15,026
52
Texas
Yeah, it would be a problem if I didn't suspect that the .pkg could harm me!

Actually, thinking about it ... I think Leopard does the same thing. Whenever you download an app, it will ask you if you are sure you want to run it, because it was downloaded from the internet and may harm your computer.

In Leopard:
Picture 1.png
 

Asgerhj

macrumors newbie
Original poster
Aug 20, 2009
12
1
Would be nice if SL had this added protection. Was it a system warning or Safari? Are you running the same version on Leopard (4.0.3?)[/QUOTE said:
Same version, 4.0.3

I think it was a system warning, because it appeared after mounting the .dmg.
I didn't launch the .pkg so it seems that SL scans .dmgs on mount.
 

RemarkabLee

macrumors 6502a
Nov 14, 2007
562
9
Same version, 4.0.3

I think it was a system warning, because it appeared after mounting the .dmg.
I didn't launch the .pkg so it seems that SL scans .dmgs on mount.

Perhaps it scans the 'downloaded from' location and compared it to a blacklist, either as part of the system or an online database. Would be a nicer alternative to a traditional daemon that scans all file activity - yeuch!
 

Asgerhj

macrumors newbie
Original poster
Aug 20, 2009
12
1
Actually, thinking about it ... I think Leopard does the same thing. Whenever you download an app, it will ask you if you are sure you want to run it, because it was downloaded from the internet and may harm your computer.

Well, the warning I got is different from the Leo-warning you mention:
1. You were launching an app - I wasn't
2. "My" warning also points out the exact malware (later confirmed by ClamXav)


I could post the link so you could try for yourself, but I don't want to because of the risk...
But read my 1.st post, and do a bit of googling then you can find it.
:mad: BUT BEWARE!!!! This is a LIVE TROJAN :mad:
 

r.j.s

Moderator emeritus
Mar 7, 2007
15,026
52
Texas
Well, the warning I got is different from the Leo-warning you mention:
1. You were launching an app - I wasn't
2. "My" warning also points out the exact malware (later confirmed by ClamXav)


I could post the link so you could try for yourself, but I don't want to because of the risk...
But read my 1.st post, and do a bit of googling then you can find it.
:mad: BUT BEWARE!!!! This is a LIVE TROJAN :mad:

At first you didn't say you didn't run the package ... once you did add that part, I saw the difference.
 

stainlessliquid

macrumors 68000
Sep 22, 2006
1,622
0
You have to wonder what possesses apple to think forcefully downloading files whether you want them or not is a good feature for Safari, and then opening them by default...(PDF's and certain image formats are NOT "safe" files, same with quicktime) Its like theyre stuck in 1995 where people think the internet is safe and all downloads are useful. Not only is it extremely annoying, its just outright stupid.
 

MisterMe

macrumors G4
Jul 17, 2002
10,709
69
USA
Hi

Yesterday I googled for reviews of the new Playstation 3 Slim and came across a site, which looked like having a video-review.
But clicking on the player a “QuickTimeUpdate.dmg” started downloading and mounted automatically.
...
I'm having a really difficult time trying to figure out what you are getting at. Everyone with the sense God gave red brick knows that MacOS X system software comes exclusively from Apple and no one else. QuickTime is MacOS X system software. It is available nowhere except Apple. New releases are available exclusively through Apple's website. Updates are available via Software Update or via download from Apple's website. Unless you are dumber than a bag of hammers, there is no way to fool anyone into downloading malware that pretends to be QuickTime.
 

tvon

macrumors newbie
Aug 17, 2006
7
0
I'm having a really difficult time trying to figure out what you are getting at. Everyone with the sense God gave red brick knows that MacOS X system software comes exclusively from Apple and no one else. QuickTime is MacOS X system software. It is available nowhere except Apple. New releases are available exclusively through Apple's website. Updates are available via Software Update or via download from Apple's website. Unless you are dumber than a bag of hammers, there is no way to fool anyone into downloading malware that pretends to be QuickTime.

I think maybe you should re-read the original post, you seem to have misunderstood and entirely missed the point.
 

haineuxApple

macrumors newbie
Aug 25, 2009
1
0
Please provide the link to the page where the virus-ridden package is.

I promise to use these powers only for good -- or for awesome.
 

richard.mac

macrumors 603
Feb 2, 2007
6,292
4
51.50024, -0.12662
here is a link i found to test the anti malware protection in Snow Leopard (ive left it unlinkable on purpose to protect unsuspecting downloads)

fishwildlife.org/lurd.php?sodini+blog WARNING: This URL contains malware and if installed will infect your Mac.

when the disk image is mounted (may mount automatically when downloaded if you have this set in Safari) and the installer package is opened this message appears
0da685a0f94608142395aca5ec9f0576.png

here is the help document that opens once you click the purple help button

What is malware?

If a warning message tells you that something you have downloaded from the Internet is “malware,” you should exercise caution. The safest action is to put the item in the Trash, and then empty the Trash.

Malware is an abbreviated term for malicious software. Malware includes viruses, worms, trojan horses, and other types of software that can damage your system or violate your privacy. Malware can be installed on your computer when you download content or applications from the Internet, either from email or websites.

Certain instances of malware are merely harmless or annoying. More often, its intent is to take control of your computer to collect personal information, host illegal content, send spam email, or cause harm to other systems on the network. Personal information that’s collected often includes credit card, banking accounts, social security numbers, or other identifying information leading to identity theft and financial loss.

Avoid opening items downloaded from websites and email messages unless you are certain that they come from a legitimate, trusted source. If you are uncertain about the source of a downloaded item, it is best to delete the item. You can always download it again later, after you have made certain that the item is not malware.

This article provides safety tips for handling email attachments and content downloaded from the Internet:

Apple Support article: Safety tips for handling email attachments and content downloaded from the Internet
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.