Mac Trojan Virus March 2012

So if you haven't heard already, there was a Mac virus out. Details in the following link.

f-secure.com

I did write a small script to just check to see if some of the files mentioned exist (since it doesn't exist on my computer, I'm not 100% sure what would show if it was found, but at least it will give you an idea). This doesn't remove the virus, just helps you determine weather you may have it.

function pause(){
    read -p "Press [Enter] key to continue..."
}
function code(){
    if grep -q $1 $2; then
        echo "Found some code in $1 for $3"
    else
        echo "No code found in $3"
    fi
}
function Safari(){
    echo Checking Safari
    ls /Applications/Safari.app/Contents/Resources/.*.png
    ls /Applications/Safari.app/Contents/Resources/.*.xsl
    code "LSEnvironmentDYLD_INSERT_LIBRARIES" /Applications/Safari.app/Contents/Info.plist Safari
    echo
}
function Users(){
    echo Checking in Users folder for file in /Users/*
    do
        ls -a ${file}/Library/Application\ Support/.*.tmp
        code "DYLD_INSERT_LIBRARIES" ${file}/.MacOSX/environment.plist ${file}
    done
    echo
}
function Users2(){
    echo Checking in Shared Users folder
    ls /Users/Shared/.*.dylib
    echo
}
clear
Safari
Users
Users2
echo complete
echo
echo If you find everything is saying
echo "No such file or directory"
echo or
echo "No code found in...."
echo then it appears as though you are free and clear of that Trojan Virus

Just copy the text to a new text document, name it with an extension of ".sh" then start up terminal, type sh /My/File/Name/ And/Location.sh and press enter.

Enjoy