MP3Concept (MP3Virus.Gen) — 08 Apr 2004

Well, believe it or not, this afternoon at 16:15 CET Intego publishes a press release announcing the launch of a Mac OS X Trojan Horse, just after my copy of VirusBarrier popped up with this alert around 15:50 CET:

My definitions were updated this morning by NetUpdate adding the ability to detect MP3 Concept.

I immediately checked the net for more in fo, but was unable to find anything before this evening. But when I write these lines, the CIAC, McAfee, Sophos or Symantec don't mention it. Even Google didn't turn up anything..

MacNN and Slashdot have a post, but the info remains sparse and unconfirmed.

The alert was triggered when I launched BBEdit, and was reproducable once eventhough I clicked 'Repair' on the VirusBarrier alert dialog box. No MP3 files in my case..

Here's a copy of the e-mail alert:

Date: 04/08/2004 15:50:35 Europe/Zurich +0200
File: /.vol/234881033/2656577
Virus: MP3Virus.Gen

Date: 04/08/2004 15:50:52 Europe/Zurich +0200
File: /.vol/234881033/930750
Virus: MP3Virus.Gen

It's actually the first time I've seen it work
:/

April 9 update:

MacNN has an full update on the matter, and a Usenet thread sheds more light on this matter.

0x2a posted an interesting comment which I fully share.

April 11 update:

More info and comments from MacFixIt, Wired, and a clarification from Intego.

Likewise, Apple spokeswoman Natalie Sequeira said the company was investigating. "We are aware of the potential issue identified by Intego and are working proactively to investigate it," she said.