Click Here
advertisement
Robert Vamosi
Senior editor

CNET's free newsletters


Rob Vamosi's
award-winning
column on Internet threats and how to counter them  
Delivered Mondays

CNET Security Center: Your complete source of antivirus and Internet security information.

Mac OS X Leap prevention and cure
Mac OS X users have their first virus to contend with; fortunately, it's not a major threat.
By Robert Vamosi (February 17, 2006)

QUICK FACTS
Name: Leap (OS X/Leap, also known as CME-4 )

What it does: Spreads from one Mac OS X machine to another via iChat and may cause some Mac apps not to run

Means of transmission: iChat

How to recognize: Contains a file named latestpics.tgz

Who is at risk: Mac OS X users

advertisement
4
out of 10
VIRUS RATING
How we rate
Mac OS X users should be on the lookout for a virus called Leap. Leap (OS X/Leap, also known as CME-4 ) is not a major threat and is probably getting more media attention than it deserves, but the virus does serve to remind us that not every computer virus is confined to the Windows operating system. That said, Leap does not affect Linux or Unix, although Mac OS X is based, in part, upon Unix. Leap uses the Spotlight search within OS X and looks for the opportunity to spread whenever the iChat app is opened. Because Leap does not damage system files, this virus rates a 4 on the CNET/ZDNet Virus Meter.

How it works
To become infected with Leap, Mac OS X users will first be asked to open a file pretending to be images from the upcoming OS X release, code-named Leopard. The victims are sent via iChat a file named latestpics.tgz, which, when opened, contains two files: ._latestpics. Ironically, due to an error in the internal code and not by design, once latestpics.tgz is opened, some Mac applications will fail to run.

Prevention
If asked to accept a file via iChat with the name latestpics.tgz, refuse. By not accepting the file, you can avoid infection.

Removal
A few antivirus software companies have updated their signature files to include this Mac OS X virus. This will stop the infection upon contact and in some cases will remove an active infection from your system. For more information, see McAfee, Sophos, and Symantec.

For up-to-the-minute coverage of this virus, see News.com.