My MBP is Infected with iWorm , How Can I Remove It Without Reinstalling OS X ?

Here are instructions to restore the hosts file to its default state:

http://osxdaily.com/2014/04/12/restore-original-hosts-file-mac/

Maybe get a new computer?

You should be able to remove the malware using a free trial version of Bitdefender Antivirus for Mac.

Hey!

You may try to "solve" this problem through Terminal!!
Check this out: http://jacobsalmela.com/roll-defense-mac-backdoor-iworm/

Hope it helps!

richard3 wrote:

You should be able to remove the malware using a free trial version of Bitdefender Antivirus for Mac.

The OP said they already removed the malware and no A-V software will be able to repair the hosts file. The information provided by Esquared describes one way, and apparently that worked.

Mnkbsnss wrote:

Hey!

You may try to "solve" this problem through Terminal!!
Check this out: http://jacobsalmela.com/roll-defense-mac-backdoor-iworm/

That's a good way to guard against being infected, but does not do anything to fix an already infected user.

I advised FarzadV to remove iWorm using anti-malware software for two reasons: Firstly, I know from experience that the average user isn't capable of manually removing malware without making errors. Secondly, it's possible that one or more of the three later strains of iWorm store their constituent files in different locations in order to evade detection.

According to the research that I performed before I made my original post, iWorm doesn't modify the file

/private/etc/hosts

richard3 wrote:

I advised FarzadV to remove iWorm using anti-malware software for two reasons: Firstly, I know from experience that the average user isn't capable of manually removing malware without making errors. Secondly, it's possible that one or more of the three later strains of iWorm store their constituent files in different locations in order to evade detection.

I'm only aware of two variants that had slightly different installer scripts. The original was included with several different Adobe products on PirateBay. That same variant appears to have come more recently with a pirate copy of Parallels. The second variant came disquised as software needed in order to view various TV videos. There have been rumors of a Flash Player update, but I have not run across one. Can you point me to samples of the other two please?

According to the research that I performed before I made my original post, iWorm doesn't modify the file

/private/etc/hosts

. Do you have any evidence that proves otherwise?

It isn't iWorm itself, but the rather installer used with the pirated software that also installs iWorm. There are multiple examples cited here in the forum including the one the OP mentioned at the top Can't connect to Software Update server(swscan.apple.com)