D'oh! 'Simpsons' worm hits Macs

From...

By Sam Costello

(IDG) -- When the Mac vs. PC wars start up, as they inevitably do, on Usenet or Web message boards or just around the office, Mac partisans always tout the dearth of viruses for their chosen computer as one of the main benefits in adopting Apple's operating system. And though, technically, there still may not be very many viruses for the Mac, a new Mac e-mail worm has recently been discovered and is making its way across iMacs and Powerbooks everywhere.

The worm, called "Mac/Simpsons@mm" (or "Mac.Simpsons@mm"), is a mass mailer and functions in much the same way as the raft of Visual Basic script worms that have plagued Windows over the last year or so. The worm arrives in user e-mail boxes promising recipients access to hundreds of never-before-seen episodes of "The Simpsons" cartoon, if they'll only visit a particular Web site by double-clicking an attachment. When the attachment is launched, however, the worm is spread.

IDG.net INFOCENTER NWFusion main page Network World Fusion's product reviews Net.Worker: Resources for teleworkers Free daily newsletters Related IDG.net Stories DoS attacks frequent, hit personal PCs Viruses may soon be on a handheld near you Secure? In your dreams Features Network security begins at home Any port is a hacker storm DSL bloodbath continues Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

The e-mail has a subject line reading "Secret Simpsons Episodes!" and body text which says: "Hundreds of Simpsons episodes were just secretly produced and sent out on the internet, if this message gets to you, the episodes are enclosed on the attachment program, which will only run on a Macintosh. You must have system 9.0 or 9.1 to watch the hilarious episodes, in high quality. Just download and open it."

The attachment, however, is an AppleScript (a scripting language developed by Apple that only runs on Macs) that then resends the e-mail to everyone in the user's Microsoft Outlook Express or Entourage address book. The worm only runs on MacOS 9.0 or higher and Outlook Express 5.02 or higher.

The worm appears to delete all items from the sent mail folder, though it actually only moves them to the deleted items folder, from which they can be recovered, said Symantec, an antivirus firm that has posted information about the worm. (McAfee, a division of Network Associates, has also posted information about the worm on its Web site, though it did not include this detail.)

Like any mass mailer, if enough copies of the worm spread over e-mail systems, servers could crash under the volume of mail. This is less likely than with PC-based worms, however, since there are fewer Macs in use than PCs.

	MESSAGE BOARD
Security on the Net

To remove the worm, Mac users should boot their systems with extensions off (this is done by holding down the shift key at start-up), then go into the computer's System Folder, locate the Start-up Items Folder and delete the file called "Simpsons Episodes." Alternatively, the Macintosh news site Macintouch recommends that extensions be turned off using the shift key just after all extensions have loaded but before the Finder launches.