[Pc_Support] OS X virus/trojan?

[Justin M. Keyes]

This wasn't posted the first time.


---------- Forwarded message ----------
From: Justin M. Keyes <m9u35g at gmail.com>
Date: Tue, 1 Mar 2005 09:27:44 -0500
Subject: OS X virus/trojan?
To: pc_support <pc_support at matrixlist.com>


Hi guys,

Has anyone heard of a Mac virus that gives a fake prompt at boot-up?
My girlfriend's powermac has been acting very strangely, and now when
she boots it, she is prompted for a password in what looks like a
legitimate password prompt (aqua theme, apple logo), but one that she
has *never* seen before! And it does _not_ accept her password. I'm
thinking it might be a password fisher, but I have such a hard time
fathoming that such a robust trojan/virus for OS X exists.

Keep in mind she has not installed anything for a very long time, and
she has not downloaded even .mp3's for several weeks. She uses safari
and firefox -- no IE. She also keeps fairly current with Apple's
updates.

She is able to get into single-user mode (i.e., darwin prompt,
read-only mount). I had her do an fsck -f and it repaired a few
things, but did not change the password prompt at startup.

Is there anything *but* a trojan/virus that would cause a prompt to
appear at bootup? I can't imagine what would cause that, but I know
nothing about Macs.

Thanks very much for any insight / tips / tricks for Mac.

Justin