OSX/OpinionSpy Free Detection + Removal Tool

[javacool]

Reference: MacRumors: Antivirus Firm Warns of New Mac OS X Spyware Application

Saw the interest in a free way to check if this spyware is installed, so I'm pleased to release a small, 100% freebie detection and removal tool for OSX/OpinionSpy.

OSX/OpinionSpy Detection + Removal Tool
Works on Mac OS X 10.5 + 10.6. Free.
Details + download:
http://blog.javacoolsoftware.com/2010/06/osxopinionspy-free-removal-tool/

Suggestions, questions, feedback welcome.

Odds are you don't have this particular spyware installed, but it's easy to check (and remove it if you do).

----

Developer Note:

This is an official user account for us at Javacool Software (providers of the above tool, the linked blog, etc). We've been producing security / privacy software since 2002 (historically for Windows, hence the lack of posts at Mac-related places like MacRumors).

For more general information about us, please feel free to visit:
http://www.javacoolsoftware.com/about.html

 

[ziggyonice]

I hope it helps alleviate any concern people may have...

I have no concern, and never had any concern to begin with.

 

[angelwatt]

Hmm, download a piece of software from someone who just created an account here at MR to post this? Seems like a good way to get infected. Can't say I'd trust this tool. Download at your own risk, which is exactly how the spyware gets installed in the first place.

 

[old-wiz]

Hmm, download a piece of software from someone who just created an account here at MR to post this? Seems like a good way to get infected. Can't say I'd trust this tool. Download at your own risk, which is exactly how the spyware gets installed in the first place.

Just what I was thinking when I read the post. Why should we trust a newbie who's offering a malware removal tool? How would we know the tool is not malware as well?

 

[sushi]

Anybody who is considering to download this removal tool, needs to consider the situation.

1. Newbie who has no record on MR.

2. First post is for software to install on your computer.

3. As of today, there are no virus for Mac OS X.

4. As of today, the only malware for Mac OS X requires the user to enter an administrative password to install.

Best to avoid.

 

[javacool]

Hi,

While this is a new forum account, we've been producing security / privacy software since 2002 (historically for Windows, hence the lack of posts at Mac-related places like MacRumors).

For more information:
http://www.javacoolsoftware.com/about.html

The point of releasing the tool is simply to help, but for those who don't feel like running it (and I can't blame anyone for general caution, as it's important to practice safe hex regardless of OS), I'm happy to provide manual detection instructions.

Manually Detecting OSX/OpinionSpy / PremierOpinion

Method 1:
1.) Open Activity Monitor (search in Spotlight, or browse to /Applications/Utilities/)
2.) From the drop-down at the top that (likely) says "My Processes", choose "All Processes".

3.) Look for a process with the name "PremierOpinion" running as user "root". If found, you likely have the spyware installed. (Do not try terminating the process as it will simply respawn.)

Method 2:
1.) Open Finder and browse to your Applications folder (/Applications/).
2.) Look for a "PremierOpinion" folder. If you find it, the spyware is installed on your machine.

Method 3:
1.) Open Terminal (search in Spotlight, or browse to /Applications/Utilities/)
2.) At the command prompt, enter:

launchctl list

and press "Return".
This will list all auto-starting programs on your system.
3.) Peruse through the list for anything with a "label" of "JobPremierOpinion". If found, the spyware is installed.

If you have exhausted all three methods without finding the requisite pieces, you do not have the current version of OSX/OpinionSpy on your machine (future versions could obviously change their behavior).

 

[angelwatt]

The point of releasing the tool is simply to help, but for those who don't feel like running it (and I can't blame anyone for general caution, as it's important to practice safe hex regardless of OS), I'm happy to provide manual detection instructions.

Thanks for providing manual instructions as well. Despite some of the Mac user stereotypes, there are a number of Mac users who are security conscious and take caution when threads like this get created.