All is not well for Apple, in a week when it should be flag waving the release of Mac OS X 10.5 'Leopard' the firm finds itself, and its users, under attack instead. The culprit being a new Trojan which, once installed, changes the Mac's domain name system server. This kind of DNSChanger Trojan is nearly always criminally motivated, and that would certainly seem to be so in this case, which of course means that the people behind it calculated the potential profit was valuable enough to develop the malware.
That has to be a worry for Mac users.
The OSX.RSPlug.A Trojan is distributed in a common fashion, being distributed exclusively as far as I can tell on pornography websites and forums which link to them. The rather familiar scam of 'view a free dirty video' is used to get the unsuspecting Mac user to click on an image to start the streaming video process. Instead it just displays a standard QuickTime cannot play this movie message and prompts the user to download a new version of the codec which will be able to bring on the porn. Or so the user thinks, what they actually get is an executable .dmg file. The user has to enter their admin password in order to proceed with the 'codec' installation and then, hey presto, the DNSChanger is installed and running with full user privileges.
Just as predictably, the DNS is changed to point towards porn and phishing …