Comments for iThreats

Comment on About by Bharani

Bharani — Tue, 10 Aug 2010 10:20:11 +0000

hi “Meths” this is “BB” i gone thru ur LNK File Format right nw im analysing the Exploit named as Trojan LNK/CplLnk.A(Norman).After the Structure of Unknowm,always Zero Contents the structure varies and offset changed.Kindly go thru the variant and let me knw.

“Ur Blog luks gud”

Comment on About by Adrien Pujol

Adrien Pujol — Thu, 29 Jul 2010 10:32:23 +0000

Realy good work, nice blog.

Comment on “PremierOpinion” Spyware Now in Mac OS X by PremierOpinion Revisited – Again! « Mac Virus

PremierOpinion Revisited – Again! « Mac Virus — Sat, 12 Jun 2010 15:44:32 +0000

[...] It turns out, though, that I don’t need to. The estimable Methusela Cebrian Ferrer has put up a thoroughly excellent analysis here. [...]

Comment on About by Dennis D. Hubilla

Dennis D. Hubilla — Wed, 09 Jun 2010 08:38:16 +0000

Methusela,

I visited your web site,,I really appreciated your work…

Comment on “PremierOpinion” Spyware Now in Mac OS X by TheDude

TheDude — Fri, 04 Jun 2010 16:37:00 +0000

Thanks for the feedback.

Best regards

Comment on “PremierOpinion” Spyware Now in Mac OS X by Methusela Cebrian Ferrer

Methusela Cebrian Ferrer — Fri, 04 Jun 2010 03:03:45 +0000

Yes, the installation locations is known. (I’ll try to put up some details later.)

If new threat are discovered, the first response would be awareness and detection. Then, followed by detailed description indicating the complete behaviour of the threat. This enable users to identify suspicious behaviour that is possible undetected. The complete description should also include the installation details as well. Sometimes vendors release portable detection and cleanup (removal) tools to assist possible infected users.

As consumer, I believe people pay for service and product when they find it useful, trustworthy and reliable especially when there is help, in times when users needed the most.

Comment on “PremierOpinion” Spyware Now in Mac OS X by TheDude

TheDude — Thu, 03 Jun 2010 09:50:48 +0000

Hi Methusela,

is it known where the files get installed in the filesystem? Or does Intego hide the information to sell more of their antivirus software?

Best regards

Comment on “PremierOpinion” Spyware Now in Mac OS X by Methusela Cebrian Ferrer

Methusela Cebrian Ferrer — Thu, 03 Jun 2010 09:08:08 +0000

Hi Julien,

My apologies for confusion. I mean, IzPack was used to deploy this threat but it doesn’t mean it is related, responsible or in any way indicated as malicious. The malicious JAR file is now distributed in many sources online (as apps and screensaver), I have to explain a visual awareness for Mac users to spot possible infected packages. Apparently, I have to point out that this threat is using IzPack installer and as you’ve noticed I have added further information about the threat itself.

Comment on “PremierOpinion” Spyware Now in Mac OS X by Julien Ponge

Julien Ponge — Thu, 03 Jun 2010 08:14:42 +0000

What do you mean by that???

Lots of respectable companies use IzPack to deploy very respectable software. We do not make it for deploying spywares, and we don’t have special “spyware”-friendly tricks to offer… contrarily to what your comment suggests.

Blame the spyware authors, and blame users for downloading trojan screensavers and blindly clicking through security checks…

Comment on “PremierOpinion” Spyware Now in Mac OS X by Methusela Cebrian Ferrer

Methusela Cebrian Ferrer — Wed, 02 Jun 2010 11:35:52 +0000

Thanks for dropping by.

Yes, your project is good and attractive for organized groups to easily deploy threats in Mac.