Quantcast
PCWorld.com is upgrading some back-end systems. Some site features, such as user registration, may be temporarily unavailable.

D'Oh! Simpsons Worm Hits Macs

New worm works much like a Windows-based virus, mass-mailing itself to contacts stored in your address book.

Sam Costello, IDG News Service

  • 0 Yes
  • 0 No

In the Mac versus PC war, Mac partisans always tout the lack of viruses as one of their computer's main benefits. And while there are not very many viruses for the Mac, a new Mac e-mail worm has recently been discovered and is making its way across iMacs and Powerbooks everywhere.

The worm, called Mac/Simpsons@mm (or Mac.Simpsons@mm), is a mass mailer and functions in much the same way as the raft of VBS (Visual Basic Script) worms that have plagued Windows over the last year or so.

The worm arrives in user e-mail boxes promising recipients access to hundreds of never-before-seen Simpsons episodes, if they'll only visit a particular Web site by double-clicking an attachment. When the attachment is launched, however, the worm is spread.

The e-mail has a subject line reading "Secret Simpsons Episodes!" and body text that reads:

"Hundreds of Simpsons episodes were just secretly produced and sent out on the internet, if this message gets to you, the episodes are enclosed on the attachment program, which will only run on a Macintosh. You must have system 9.0 or 9.1 to watch the hilarious episodes, in high quality. Just download and open it."

The attachment, however, is an AppleScript (a scripting language developed by Apple that only runs on Macs), which then resends the e-mail to everyone in the user's Microsoft Outlook Express or Entourage address book. The worm only runs on Mac OS 9.0 or higher and Outlook Express 5.02 or higher.

The worm appears to delete all items from the sent mail folder, though it actually only moves them to the deleted items folder, from which they can be recovered, according to Symantec. The antivirus firm has posted information about the worm on its Web site. (McAfee, a division of Network Associates, has also posted information about the worm on its Web site, though it did not include this detail).

As with any mass mailer, if enough copies of the worm spread over e-mail systems then servers could crash under the volume of mail. This is less likely than with PC-based worms, however, since there are fewer Macs in use than PCs.

To remove the worm, Mac users should boot their systems with extensions off (this is done by holding down the Shift key at startup), then go into the computer's System Folder, locate the Start-up Items Folder and delete the file called "Simpsons Episodes." Alternatively, the Macintosh news site Macintouch recommends that Start-up Items be turned off using the Shift key just after all extensions have loaded but before the Finder launches.

  • Recommend this story?
  • 0 Yes
    0 No
 

Featured APC Accessories

  • APC Back-UPS ES Safeguards your equipment from damaging surges and spikes that travel along your utility & data lines.
  • APC SurgeArrest Performance Highest level of protection for your professional computers, electronics and connected devices, as well as provides surge protection.

People who read this also read:

  • 15 Minutes to a Secure Business Get the Secure in 15 toolkit starting with the "15 Minutes Month-at-a-Glance" calendar. McAfee will send you additional tools and tricks to stay protected around the clock.
  • A Buyer's Guide to Data Protection Implementing data protection products and processes can be daunting. Make the right decisions by exploring what is available and what makes sense for your organization. Use this simple guide to evaluate different vendor offerings.

Sponsored Links