Latest OS X threat Krowi installs “DivX”
Latest update of threat Krowi was found in Adobe Photoshop cracker installer.
Not much difference with “iWorkServices” except with the repackaging and name. However, this should serve as a reminder to be extra careful in downloading stuff!
Once installed, you’ll find these files and port activity below.
How to Remove? It’s the same as the previous instruction except that you have to change the name from “iWorkServices” to “DivX”.
Categories: Malwares
Adobe cracker, Adobe photoshop crack key, Adobe trojan, DivX, iwork trojan latest
Hello researchers,
This threat removal method leaves out the backdoor executable inside the “/var/tmp/” folder with a random name beginning by “tmp.”
That folder isn’t removed by os x when you restart your Mac according to Apple’s documentation.
Hi Steve,
I appreciate this feedback, I’ll check this and update this article if required. Thanks!