D'oh! 'Simpsons' worm hits Macs
When the Mac
vs. PC wars start up, as
they inevitably do, on
Usenet or Web message boards or
just around the office, Mac partisans
always tout the dearth of viruses for
their chosen computer as one of the
main benefits in adopting Apple's
operating system. And though,
technically, there still may not be
very many viruses for the Mac, a
new Mac e-mail worm has recently
been discovered and is making its
way across iMacs and Powerbooks everywhere.
The worm, called "Mac/Simpsons@mm" (or "Mac.Simpsons@mm"), is a mass
mailer and functions in much the same way as the raft of Visual Basic script
worms that have plagued Windows over the last year or so. The worm arrives
in user e-mail boxes promising recipients access to hundreds of
never-before-seen episodes of "The Simpsons" cartoon, if they'll only visit a
particular Web site by double-clicking an attachment. When the attachment is
launched, however, the worm is spread.
The e-mail has a subject line reading "Secret
Simpsons Episodes!" and body text which
says: "Hundreds of Simpsons episodes were
just secretly produced and sent out on the
internet, if this message gets to you, the
episodes are enclosed on the attachment
program, which will only run on a
Macintosh. You must have system 9.0 or 9.1
to watch the hilarious episodes, in high
quality. Just download and open it."
The attachment, however, is an AppleScript
(a scripting language developed by Apple that
only runs on Macs) that then resends the
e-mail to everyone in the user's Microsoft
Outlook Express or Entourage address book.
The worm only runs on MacOS 9.0 or
higher and Outlook Express 5.02 or higher.
The worm appears to delete all items from
the sent mail folder, though it actually only
moves them to the deleted items folder, from
which they can be recovered, said Symantec,
an antivirus firm that has posted information
about the worm. (McAfee, a division of
Network Associates, has also posted
information about the worm on its Web site,
though it did not include this detail.)
Like any mass mailer, if enough copies of the
worm spread over e-mail systems, servers
could crash under the volume of mail. This is
less likely than with PC-based worms,
however, since there are fewer Macs in use
than PCs.
To remove
the worm,
Mac users
should boot
their systems with extensions off (this is done by holding down the shift key at
start-up), then go into the computer's System Folder, locate the Start-up Items
Folder and delete the file called "Simpsons Episodes." Alternatively, the
Macintosh news site Macintouch recommends that extensions be turned off
using the shift key just after all extensions have loaded but before the Finder
launches.
