Begin forwarded message:
From: Keith Peck <kdpeck@ist.uwaterloo.ca>
Date: April 8, 2008 2:05:24 PM EDT (CA)
To: isthd@lists.uwaterloo.ca
Cc: Glenn Anderson <anderson@uwaterloo.ca>, Dani Roloson <daroloson@math.uwaterloo.ca>
Subject: DNSChanger Trojan Removal Tool for Mac OS X

Reg Quinton's security scans on uw-wireless have been sending out alarms to users running Mac OS X that are infected with a DNSChanger Trojan
aka FreeVideo Trojan, or OSX.RSPlug.A Trojan Horse, etc.

I've seen just a couple so far but expect that there will be more.

The good news is that there is a tool available to fix the problem...

--------------

http://macscan.securemac.com/dnschanger-trojan-removal-tool-for-mac-os-x/#more-37

DNSChanger Removal Tool detects and removes latest spyware targeting Mac OS X.  DNSChanger Trojan (also known as OSX.RSPlug.A Trojan Horse) attacks users attempting to play a fake video file.

Upon attempting to play the video, the victim receives the following message:

Quicktime Player is unable to play movie file.
Please click here to download new version of codec.

Upon running the installer, the user’s DNS records are modified, redirecting incoming internet traffic through the attacker’s servers, where it can be hijacked and injected with malicious websites and pornographic advertisements. The trojan also installs a watchdog process that ensures the victim’s DNS records stay modified on a minute-by-minute basis.

SecureMac’s DNSChanger Removal Tool allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users’ DNS records will be repaired.

This tool is free.

For more information or to download a copy of DNSChanger Removal Tool, visit SecureMac.com or download directly from http://macscan.securemac.com/files/DNSChangerRemovalTool.dmg .

--------------

Keith Peck
Client Services, Information Systems and Technology
University of Waterloo, Waterloo, Ontario, Canada, N2L 3G1.
MC 1052, (519) 888-4567 x.37770




Glenn Anderson
Client Services, IST
University of Waterloo
Waterloo, On
519-888-4567 x33327
anderson@uwaterloo.ca