OSX/OpinionSpy弹出一个对话框,以市场调查的名义欺骗用户,取得admin密码,安装“PremierOpinion”进程以root身份运行,在8254端口打开http后门,扫描所有本地和网络驱动卷,向Safari,Firefox以及iChat中注入恶意代码,窃取包含电子邮件地址等信息的加密数据以及用户名,密码,信用卡号码等个人数据。
OSX/OpinionSpy可以自动升级并通过Mac OS自启动,即使卸载宿主程序,它依然在Mac中存在。
到目前为止,Intego发现在“MishInc FLV To Mp3”和一些由7art-screensavers制作的屏保程序含有该间谍软件:
* Secret Land ScreenSaver v.2.8
* Color Therapy Clock ScreenSaver v.2.8
* 7art Foliage Clock ScreenSaver v.2.8
* Nature Harmony Clock ScreenSaver v.2.8
* Fiesta Clock ScreenSaver v.2.8
* Fractal Sun Clock ScreenSaver v.2.8
* Full Moon Clock ScreenSaver v.2.8
* Sky Flight Clock ScreenSaverv.2.8
* Sunny Bubbles Clock ScreenSaver v.2.9
* Everlasting Flowering Clock ScreenSaver v.2.8
* Magic Forest Clock ScreenSaver v.2.8
* Freezelight Clock ScreenSaver v.2.9
* Precious Stone Clock ScreenSaver v.2.8
* Silver Snow Clock ScreenSaver v.2.8
* Water Color Clock ScreenSaver v.2.8
* Love Dance Clock ScreenSaver v.2.8
* Galaxy Rhythm Clock ScreenSaver v.2.8
* 7art Eternal Love Clock ScreenSaver v.2.8
* Fire Element Clock ScreenSaver v.2.8
* Water Element Clock ScreenSaver v.2.8
* Emerald Clock ScreenSaver v.2.8
* Radiating Clock ScreenSaver v.2.8
* Rocket Clock ScreenSaver v.2.8
* Serenity Clock ScreenSaver v.2.8
* Gravity Free Clock ScreenSaver v.2.8
* Crystal Clock ScreenSaver v.2.6
* One World Clock ScreenSaver v.2.8
* Sky Watch ScreenSaver v.2.8
* Lighthouse Clock ScreenSaver v.2.8