Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just recently, a new trojan for OS X was discovered. Apparently it only affects Snow Leopard and Lion. Whether it does/doesn't affect Mountain Lion is still unknown. The trojan sits on your computer and hides, doing nothing so far. How do I check to see if this trojan has been installed on my system? If it is, how do I remove it?

share|improve this question

Apparently, Intego has been investigating this trojan and has found that the trojan will only be on your machine if the following folder exists:


If it was installed with admin privileges, this files/folders will exist:

  • /System/Library/Frameworks/Foundation.framework/XPCServices/
  • /System/Library/Frameworks/Foundation.framework/XPCServices/
  • /System/Library/Frameworks/Foundation.framework/XPCServices/
  • /Library/ScriptingAdditions/appleHID/Contents/Resources/appleOsax.r

These files ping the IP address every 5 minutes. It currently doesn't do anything, but at any point the trojan could activate and potentially cause problems. Intego also reports that Mountain Lion is not affected by the trojan. Intego's VirusBarrier will remove the trojan.

share|improve this answer
The existence of /System/Library/Frameworks/Foundation.framework/XPCServices/ does not indicate whether you have this trojan: its a normal directory and is part of the well-documented XPC Services API. – user6703 Jul 26 '12 at 19:49
@MarkTrapp Okay, but according to Intego, that is a part of the trojan. Did you read the article? – daviesgeek Jul 26 '12 at 22:22
I did; I'm saying they're oversimplifying/mischaracterizing the nature of that directory: its mere existence does not indicate you have OSX/Crisis. I found Kaspersky Lab's account of the trojan to be more accurate/measured. – user6703 Jul 26 '12 at 22:45
Okay. I understand. Just a note on the article you linked to; it says the name of the malware is "Backdoor.OSX.Morcut". Intego labels it as "OS/X Crisis" Is this the same piece of malware? – daviesgeek Jul 26 '12 at 22:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.