I have written a script that will detect and remove the malware, if found. Don't click the "Delete" button unless you are sure. When in doubt, just press "enter".
Not that one
If you think you are one of the handful of people to actually have this malware, you will have to look manually.
and report the results.
Thanks for the reply.
I presume the "Run" and "and do" are in Terminal.
Is "~" for user name?
From Cnet Reviews, I ran the 3 Terminal routines [below] and received "does not exist".
Is this a valid test for OSs < 10.7 such?
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
defaults read /Applications/Safari.app/Contents/Info LSEnvironment
defaults read /Applications/Firefox.app/Contents/Info LSEnvironment
Cnet Review link here >
You can just type those lines in the terminal exactly as they are here:
Your chances of actually having any infection are infinitesimally small. But if you are worried about it, run the commands above. Those other commands you posted are inadequate. The first one is valid. The second two are testing for something that seems to happen only in theory and only if the user has provided their password. If you don't do:
Then you could have a partial infection waiting in the wings. Apple is working on an official detection and removal script. I don't know if it will work on 10.5 or not.
You wrote "Those other commands you posted are inadequate."
So confusing when C/net posts and others post "relaible tests".
In OS 10.6, for both scripts, Terminal responded "no such file or directory".
However in OS 10.5 on same iMac with HD partitioned for 10.6 and 10.5 [to run legacy applications requiring rosetta]:
cat: /Users/Bob/.MacOSX/environment.plist: No such file or directory
Interesting that clicking on the above opens a mail message to me.
Does this response mean anything?
Thanks again. I'll pass on your scripts to my few friends who have Lion.