Mac.Simpsons Email Worm Targets Microsoft Software -- Last week, reports surfaced of a new Mac OS worm that arrives by email and takes advantage of Microsoft email clients Outlook Express and Entourage to send itself to everyone in the infected user's address book. According to Symantec, the AppleScript worm, dubbed "Mac.Simpsons@mm" for its promise to show hundreds of never-before-seen episodes of the popular Simpsons television series, may also remove all the user's messages from the Sent Items folder, however, they can be retrieved from the Deleted Items folder. The attachment appears as an AppleScript script named Simpsons Episodes.
<http://www.symantec.com/avcenter/venc/data/ mac.simpsons@mm.html>
Microsoft's Entourage application, the combination email client and personal information manager included with Office 2001, warns the user of suspicious activity before sending copies of the worm to everyone in the address book, but Outlook Express provides no such warning. The worm also places a copy of itself in the user's Startup Items folder, and reports suggest that it attempts to access a specific Web site using Internet Explorer. If you believe your Mac might have been compromised, check your Startup Items folder for the worm or other suspicious files (if your Mac isn't currently running, be sure to start it with the Shift key held down to disable startup items). [MHA]