Latest OS X threat Krowi installs “DivX”
Latest update of threat Krowi was found in Adobe Photoshop cracker installer.
Not much difference with “iWorkServices” except with the repackaging and name. However, this should serve as a reminder to be extra careful in downloading stuff!
Once installed, you’ll find these files and port activity below.
How to Remove? It’s the same as the previous instruction except that you have to change the name from “iWorkServices” to “DivX”.
Categories: Malwares
Adobe cracker, Adobe photoshop crack key, Adobe trojan, DivX, iwork trojan latest
Leave a Reply
Threat Researcher
Pictures of the Day
|
Recent Comments
 | Scott on How to Remove Starfield |
 | Ratan on Summary of ASF File Speci… |
| loewenherz.cc… on Summary of ASF File Speci… | |
 | N. Cheatham on Analysis of OSX Starfield |
 | Rudolf Jockers on Just a note… |
Hello researchers,
This threat removal method leaves out the backdoor executable inside the “/var/tmp/” folder with a random name beginning by “tmp.”
That folder isn’t removed by os x when you restart your Mac according to Apple’s documentation.
Hi Steve,
I appreciate this feedback, I’ll check this and update this article if required. Thanks!