How to Remove the OSX.RSPlug.A Trojan Horse from your Mac

How to Remove the OSX.RSPlug.A Trojan Horse from your Mac. So far the only malicious software known to infect Macintosh Computers is called the OSX.RSPlug.A, a rather insidious Trojan Horse. It's not exactly a virus since it doesn't replicate itself, but it can cause some damage. The only way to get this malware on your computer is to download and install it, and enter in your administrator password.

...
Remove the OSX.RSPlug.A Trojan Horse from your Mac

This malware has been distributed by a video of a certain less-than-sane celebrity. As people have downloaded this video, they've received a message saying they don't have the proper codec to view it, and they're offered the "proper" codec as a download. When the "codec" is installed, it asks for your administrator password which gives it the permissions to run wild on your system.

The Trojan changes DNS information that re-routes all your web traffic to pornography and phishing sites. If you happen to know how to fix this and do, the Trojan Horse will change the DNS information back so your web surfing will still be compromised.

Here's how to identify if you have the Trojan, and what to do to remove it both with Virus Barrier and manually (if you're brave).

Step

Update and run your anti-virus software. This is the preferred method to remove the Trojan Horse and repair the damage caused by the malware. If you choose not to use AV software, continue, but be very cautious.

Step

Go to your root "Library" Folder. Click on your Hard Drive icon in the Finder and select the "Library Folder".

Step

Navigate to the "Internet Plug-Ins" Folder.

Step

See if there's a "plugins.settings" file in this folder. If that file is not in this folder, you're not infected.

Step

Delete "plugin.settings". Either drag it to the Trash on your Dock or hit the Command Key and Delete at the same time.

Step

Empty your trash. Right-click or Control-click the Trash icon on the Dock and select "Empty Trash".

Step

Open "Terminal" (Applications > Utilities).

Step

Type in "sudo crontab -l" (the letter L, and minus the quotes), hit Return, and enter your administrator password when asked. If it returns with anything other than "crontab: no crontab for root", you are most likely infected.

Step

Type in "sudo crontab -r" (minus the quotes) and enter your administrator password. This will remove the scheduled "cron" job that modifies your Mac's DNS information.

Step

Re-type "sudo crontab -1" (minus the quotes) to make sure that the delete process worked. If it did, you should see "crontab: no crontab for root".

Step

Type "exit" (minus the quotes) in Terminal.

Step

Restart your computer. Your Mac should now be clean!

...
...
...
...
...