New iWorm Worm Specifically Targets OS X – How to Know if Your Mac is Infected

Security researchers have discovered a new worm that specifically targets OS X on Macs, and which controls them through Reddit.com. Dubbed the “iWorm”, or the “Mac.BackDoor.iWorm”, the iWorm was first publicly reported last week on the Dr. Web anti-virus site. There is a way to check to see if you have the iWorm on your Mac, which we explain below.

Rather than having the infected Mac report directly to a server for its instructions, the criminals behind iWorm issue instructions through posts on Reddit, and the infected Macs check in on Reddit to get their commands.

(Kind of evil genius stuff, if you think about it, as an instruction server can be targeted and taken offline, but nobody is going to take Reddit offline.)

According to the Dr. Web report, so far more than 18,500 Macs are infected with the iWorm. Dr. Web calculates this based on the unique IP addresses from which each infected Mac is connecting.

To determine whether or not your Mac has been infected with the iWorm, follow these steps:

On your Mac, open Finder, click on “Go”, and select “Go to Folder”:

This will pop open a window in which to type the path of the folder; what you are looking for is the folder that iWorm creates when it infects your machine. If the folder is there, your Mac is infected.

Here is the directory path to type into that window:

/Library/Application Support/JavaW

Copy and paste that into the window:

Hopefully your results will look like this:

If so, breathe a sigh of relief, and consider that if you were one of those people who never bothered to get anti-virus software because you have a Mac, well, it’s time to rethink that strategy.

While we have not extensively tested the various Mac anti-virus options out there ourselves, we’ve heard really good things about the free Sophos anti-virus protection.

Get notified of new Internet Patrol articles!