Nouveau virus : 7 juin 2001

[E.T.]

Simpsons AppleScript worm/"virus"

Voici un message d'alerte pour un tout nouveau virus sous Mac utilisant AppleScript pour se propager. L'alerte peut être vérifiée à : http://www.macfixit.com/index.shtml et à : http://www.symantec.com/avcenter/venc/data/mac.simpsons@mm.html
L'alerte est de niveau 2, donc il n'est pas trop dangereux. Un dossier ou un alias portant le nom exact du virus "Simpsons Episodes", placé dans le dossier "Ouverture au démarrage", permet de bloquer la prolifération en attendant un vaccin.

« Daniel Farnworth alerts us to a new AppleScript-based worm/"virus": "The worm allegedly masquerades as an email about new Simpsons episodes available on the web. The text will start off as follows: 'Hundreds of Simpsons episodes were just secretly produced and sent out on the internet...the episodes are enclosed on the attachment program...' The attachment is in fact an AppleScript that attempts to mail itself to recipients in the users Outlook/Entourage address book. It also copies itself to the users startup items folder. Reports point to the script being compiled as read-only so no-one is yet certain exactly what it does." MacInTouch also has an article on this matter.

There is now confirmation of this virus on SARC (thanks, John Ludwigson and John Strung).

Art Delano suggests: "One way to limit the Simpsons propagation is to create a dummy folder alias with the same name as the script, lock the alias, and put it in the Startup Items folder. The script will be unable to write itself into the Startup Items folder if there's something else with the same name there." Note: The title of the script is "Simpsons Episodes". Mark Siple adds: "This doesn't keep the worm from executing upon first launch. It just prevents further automatic launches."