This is HN. Can we skip the blogspam and link directly to F-Secure? There is nothing of value in the blog post.

Actual content:

http://www.f-secure.com/weblog/archives/00002256.html

It's important to note that this is a trojan virus, which means the user must download and run it. It would be far more significant if this were a drive-by attack.

One interesting item I noticed in the information about the trojan itself is this bit:

===QUOTE===

On installation, the installer first checks if the following file is found in the system:

* /Library/Little Snitch/lsd

Little Snitch is a firewall program for Mac OS X. If the program is found, the installer will skip the rest of its routine and proceed to delete itself.

===QUOTE===

So if you're running Little Snitch, this trojan deletes itself. Effective.