Welcome to the MacNN Forums.

ryarber · Jan 2, 2005, 03:35 PM

Is there a virus called MP3Virus.gen that has effected MacOS X systems? Just talking with a windows person and they alerted me to this and told me that I was mistaken that there had never been a virus for MacOS X. They said that it was disguised as an MP3 file with a .mp3 extension. Can anyone shed any light on this for me?

wtmcgee · Jan 2, 2005, 03:38 PM

It was a proof of concept thing, not a virus per se. It couldn't self replicate, and all it basically entailed was a malicious program with an mp3 icon rather than the icon of the app.

It was harmless, and apple has since fixed finder so such things cannot happen in the future.

ryarber · Jan 2, 2005, 03:39 PM

Originally posted by wtmcgee:
It was a proof of concept thing, not a virus per se. It couldn't self replicate, and all it basically entailed was a malicious program with an mp3 icon rather than the icon of the app.

It was harmless, and apple has since fixed finder so such things cannot happen in the future.

Thanks.

TETENAL · Jan 2, 2005, 04:04 PM

Basically it was a application that had an mp3 icon pasted on. That makes it a trojan (an application that disguises as something else). As an additional gimmick it was also a proper mp3 file, so it could be played with iTunes, but that is rather irrelevant.

I dont remember Apple changing the Finder in response to it. I can't think of anything that could be done here. Applications just can have arbitrary icons, the system can't really tell how these icons look like. And if it does you just give it an installer icon and call it "Office Update" and people will double-click it. There is no principle protection against trojans except user care and alertness (and virus definitions after they have been discovered).

What protects the Mac against trojans rather well, is the fact that applications either need to have a resource fork or need to be in a certain folder structure. So they always need to be in compressed/archived before they can be transferred over the net.

Spheric Harlot · Jan 2, 2005, 05:15 PM

Originally posted by TETENAL:
Basically it was a application that had an mp3 icon pasted on. That makes it a trojan (an application that disguises as something else). As an additional gimmick it was also a proper mp3 file, so it could be played with iTunes, but that is rather irrelevant.

I dont remember Apple changing the Finder in response to it. I can't think of anything that could be done here.

They added a dialog box that tells you that the application "so-and-so" is launching for the first time and asks you whether this is okay.

So when you double-click a disguised trojan, you get that dialog, alerting you to the fact that something fishy's going on.

deboerjo · Jan 2, 2005, 05:15 PM

It can't replicate itself, so it's not a virus, it's a trojan.

TETENAL · Jan 2, 2005, 05:43 PM

Originally posted by Spheric Harlot:
They added a dialog box that tells you that the application "so-and-so" is launching for the first time and asks you whether this is okay.

They added that in response to the HelpViewer/random internet protocol vulnerability. The dialog comes when you open a document for the first time. There is no dialog when you double-click applications directly the first time.

Big Mac · Jan 2, 2005, 06:10 PM

Originally posted by ryarber:
Is there a virus called MP3Virus.gen that has effected MacOS X systems? Just talking with a windows person and they alerted me to this and told me that I was mistaken that there had never been a virus for MacOS X. They said that it was disguised as an MP3 file with a .mp3 extension. Can anyone shed any light on this for me?

Pathetic PC Pukes really are desperate to defend their miserable platform, aren't they? There has not yet been a true OS X virus. There will eventually be one - there were viruses for the classic Mac OS, and no OS is immune to malicious code. But the Mac is very secure and will remain so.