I was frustrated after writing my Leap-A Q&A for Macworld yesterday, as I couldn’t get Oompa Loompa to do what it was supposed to do–it wasn’t infecting my files, and it wasn’t sending itself out over iChat. So today, my friend and coworker Kirk McElhearn and I spent the better part of the day testing Oompa Loompa on a couple of controlled Macs. We wanted to figure out exactly what it did, or did not, do, and what to do about it if you found it on your machine.
You can read the results of our efforts in the article titled Digging deeper into the Leap-A malware. It took quite a while, but we think we finally figured out exactly how it works (and doesn’t work), and offer some advice on removal. Among the more surprising findings was that it will not attempt to send itself out over Internet iChat, only Bonjour iChat. It also won’t affect applications that are system-owned, only those that have been installed by a user (and are therefore user-owned). Both of these are why I wasn’t seeing the behavior I expected to see yesterday. My test machine had only Apple’s stock Tiger applications on it, and Kirk and I were testing with an Internet iChat.
I am now officially very sick of Leap-A, having spent probably 18 hours on it over the last two days. The short summary is that it’s a bad piece of malware that could have been worse…but it’s far from the self-propagating internet-spreading virus/worm that’s been described on other sites. At the end of the day, it’s really just a good reminder to be very careful about what you download and install on your Mac.
Have a nice weekend everyone!