Mac security specialists Intego have alerted the Mac community to the presence of malware in installs for many popular screen savers and at least one freeware app. The malware, called OSX/OpinionSpy, is a variant of a well-known form of Windows spyware which has been circulating for at least two years.
The screen savers in question, developed by 7art-screensavers, are distributed through websites such as Softpedia, MacUpdate and VersionTracker. So far, the only other app known to include OSX/OpinionSpy is a streaming media ripping tool called MishInc FLV to MP3.
OSX/OpinionSpy is installed on the user’s computer whenever any of the affected apps or screen savers are installed. It asks for users’ admin passwords, claiming that this must be done for market research purposes. OSX/OpinionSpy then installs PremierOpinion, spyware that acts as a root process. PremierOpinion collects various information from the system and web history, potentially including things like credit card numbers, and makes hidden changes to Safari, Firefox and iChat; this information is then transmitted to other servers.
Even if the original software is uninstalled, OSX/OpinionSpy remains on the computer. It can even repair, relaunch, or reinstall itself if it is ever damaged or deactivated. The only way to protect against this type of malware, or get rid of it if it’s already on your machine, is to use up-to-date antivirus protection. Intego VirusBarrier X5 and X6, for example, were updated to protect against OSX/OpinionSpy on May 31.
Get more information on OSX OpinionSpy malware for Mac, including the full list of affected screen savers.
Related posts:
- Intego Security Memo Details New Malware Variant for Mac OS X
- Mac Malware HellRTS-D Spotted in the Wild
- Apple Quietly Adds Anti-Malware Protection to OS X
