Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'This download is suspicious' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
This download is suspicious
Authored by: anagram1024 on Feb 06, '09 06:21:55PM

This app prompted me for the location to iphoto and aperture, then crashed. Frankly, I think it's a trojan and I feel foolish for running it.



[ Reply to This | # ]
This download is suspicious
Authored by: palahala on Feb 07, '09 04:09:08AM
It just seems to try to close those programs first. I don't know why. In the package you will find:
--Written by Aric Friesen 9/30/2006
--Modified by Grady Neely 12/29/2008

on run {input, parameters}
	tell application "System Events"
		set the_username to do shell script "whoami"
		set the_password to "your_password_here"
		--		display dialog "You now need to enter the password for the currently logged in account: 
		--" & the_username & "
		
		--This account must have Administrator access to this computer." default answer "password" buttons {"OK", "Cancel"} default button "OK" with icon 2 with title "Password" with hidden answer
		--		set the_password to text returned of the result
	end tell
	if application "iTunes" is running then quit application "iTunes"
	if application "iPhoto" is running then quit application "iPhoto"
	if application "Aperture" is running then quit application "Aperture"
	-- quit verb doesn't wait till it's closed; wait for it
	repeat while application "iTunes" is running
		delay 0.5
	end repeat
	repeat while application "iPhoto" is running
		delay 0.5
	end repeat

	repeat while application "Aperture" is running
		delay 0.5
	end repeat
	return {the_password}
end run
And the actual export action:
#!/bin/bash

exec echo $1 | sudo -v -S;
if [ $? -eq 1 ]	
then
	echo "you are not a sudoer";
else
	exec echo $1 | sudo -S sh -c 'zpool list | cut -d" " -f1 | grep -v NAME | xargs zpool export -f'
fi


[ Reply to This | # ]
This download is suspicious
Authored by: palahala on Feb 07, '09 04:11:29AM

(oops, sorry for messing up the layout, caused by the long lines in the code snippet -- I didn't realize that in preview. For whoever has the power: please adjust my previous comment...)



[ Reply to This | # ]