How to find and remove the OSX.RSPlug.A malware

Search

From our Sponsor...

User Functions

Don't have an account yet? Sign up as a New User
Lost your password?

What's New:

Hints

4 new Hints in the last 24 hours

Comments last 2 days

Links last 2 weeks

No recent new links

What's New in the Forums?

The Editor's Corner...

Here are some of my (robg) other projects...

•	The Robservatory My blog - Macs, tech, etc.
•	Mac OS X Power Hound The best of Hints in print
•	Inside iWork An iWork training DVD
•	Macworld Column, features, online...

Hints by Topic

News from Macworld

The macosxhints Poll

What version of OS X are you running as your main OS?

Other polls | 11,335 votes | 42 comments

How to find and remove the OSX.RSPlug.A malware | 15 comments | Create New Account

Click here to return to the 'How to find and remove the OSX.RSPlug.A malware' hint

The following comments are owned by whomever posted them. This site is not responsible for what they say.

How to find and remove the OSX.RSPlug.A malware
Authored by: knujon on Thu, Nov 1 2007 at 10:29AM PDT

Symantec Antivirus 10 (Corporate Edition) installs this root crontab:

#SqzS VERSION = 1.0.0
#SYMANTEC SCHEDULER CRON ENTRIES. THESE ENTRIES ARE AUTOMATICALLY GENERATED
#PLEASE DO NOT EDIT.
# Enc=1 Name="Update Virus Protection" EvType1=1 EvType2=0 Sched=2
0 17 * * 5 "/Library/Application Support/Symantec/Scheduler/SymSecondaryLaunch.app/Contents/schedLauncher" 1 "/Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate" " " "oapp" "aevt" "exAG" "-update LUdf -liveupdatequiet YES -liveupdateautoquit YES"
#SqzS END SYMANTEC CRON ENTRIES