OSX.Inqtana.A - Removal

Risk Level 1: Very Low

Printer Friendly Page

Discovered: February 17, 2006
Updated: February 13, 2007 12:51:24 PM
Also Known As: Inqtana.A [Panda], OSX/Inqtana-A [Sophos], OSX/Inqtana.a [McAfee], Inqtana.A [F-Secure], OSX_INQTANA.A [Trend], Worm.OSX.Inqtana.a [Kaspersky]
Type: Worm
Systems Affected: Macintosh, Macintosh OS X


Delete the following files:

    • /Users/w0rm-support.tgz
    • /Users/InqTest.class
    • /Users/com.openbundle.plist
    • /Users/com.pwned.plist
    • /Users/libavetanaBT.jnilib
    • /Users/[USER NAME]/Library/LaunchAgents/com.pwned.plist
    • /Users/[USER NAME]/Library/LaunchAgents/com.openbundle.plist

  1. Delete the following folders:

    • /Users/javax
    • /Users/de


Writeup By: Candid Wueest
Search by name
Example: W32.Beagle.AG@mm
Windows 7
Windows Vista Security