You are here: precisesecurity.com » asides » “Video ActiveX Object Error” now in Macintosh

“Video ActiveX Object Error” now in Macintosh

Posted: 1 November 2007 | Under: asides

Have you visited movie websites, particularly porn ones and encounters an error “Video ActiveX Object Error;” did it prompt you to download and install a file to be able to display the video? If you have installed the video codec called MacCodec then you may have been infected with OSX.RSPlug.A.

The PC-based fake codec used to trick users is now available on Mac systems. It has been described by Intego as:

A malicious Trojan Horse has been found on several pornography web sites, claiming to install a video codec necessary to view free pornographic videos on Macs. A great deal of spam has been posted to many Mac forums, in an attempt to lead users to these sites. When the users arrive on one of the web sites, they see still photos from reputed porn videos, and if they click on the stills, thinking they can view the videos, they arrive on a web page that says the following:

Quicktime Player is unable to play movie file.
Please click here to download new version of codec.

After the page loads, a disk image (.dmg) file automatically downloads to the user’s Mac. If the user has checked Open “Safe” Files After Downloading in Safari’s General preferences (or similar settings in other browsers), the disk image will mount, and the installer package it contains will launch Installer. If not, and the user wishes to install this codec, they double-click the disk image to mount it, then double-click the package file, named install.pkg.

If the user then proceeds with installation, the Trojan horse installs; installation requires an administrator’s password, which grants the Trojan horse full root privileges. No video codec is installed, and if the user returns to the web site, they will simply come to the same page and receive a new download.

Below are the images for the fake wanings:

Video ActiveX Object Error

Fake Windows Media Player

Comments and Suggestions

On this area you can find Visitor's personal suggestions. We cannot control and evaluate each recommended procedure from visitors so please use it at your own risks.

19 Comments »

  • 1 }
    Dixie dean said:

    Many thanks for this

    On principle I refuse to do anything for a programme which takes over my computer until I do. I just open a new browser window or switch off

    Shooting themselves in the foot. I can’t be bothered looking at their sites any more

  • 2 }
    And Plus 1 said:

    Thank you for this information. It’s possibly saved me a lot of heartache.

  • 3 }
    Mazzy69 said:

    OMG! I was 2 seconds away from just clicking “continue” because it wouldn’t let me even change pages on Safari and I’ve pretty much had the mentality that Mac’s are virus proof (naive, I know) but I am so glad I decided to force quit and check it first! THANK YOU for this information!!

  • 4 }
    Mike said:

    HELP!!! I just downloaded the codec!! I have a mac. PLEASE tell me what to do to remove this threat!!!

  • 5 }
    Leo said:

    My Safari was set to Open “Safe” Files After Downloading, but i did not authorize any installantion wich required admnistrator’s password.
    Is my system infected?

    Please help me out!

    Thanks in advance.

  • 6 }
    George Gale said:

    None of these ActiveX removal tools are for Mac. Where is a Mac tool available?

    Tnx!

    g

  • 7 }
    Charles said:

    Woops I fell 100% into the trap ! But I’m pretty sure my MacBook doesn’t risk much anyways. Just in case, what would be signs that the Trojan is active ? How could I remove it if it seems to be threatening my system ?

  • 8 }
    raymond cantalejo said:

    thnk u 4 that all..

  • 9 }
    raymond cantalejo said:

    thank u 4 imformation about that im happy now to wacth ….

  • 10 }
    misterlove said:

    damn i downloaded and installed it! does the virus also work on leopard??? pls answer me!!!

  • 11 }
    rm said:

    which 1 should i download to watch da video?

  • 12 }
    SC said:

    You should try Virus Barrier x5 and mac scan 2.5,. The first one definitely will find the damn virus or Trojan whatever it is and you can put it in quarantine. The MS 2.5 will find the bad DNS and will delete it. Try it and let me know

    Here are some links where you will have a better view of your problem.

    http://www.macworld.com/article/60823/2007/10/trojanhorse.html
    http://www.macworld.com/article/134212/2008/07/virusbarrierx5.html

    http://macscan.securemac.com

    Good Lock!!

  • 13 }
    NL said:

    How do you know if the virus or watever is active or in ur computer?

  • 14 }
    Beccis said:

    I had a close and scary call tonight and nearly loaded a virus onto my MAC by clicking a link a friend sent me through facebook.

    The link said – “video with you in it – you’re on the right”. I clicked the link and it diverted to a website – and instead of reading “You Tube”, i noticed it said “yuo tube – secret video”. It then said i needed to install the latest version of Video Active X Object to view the video. But it just seemed a bit strange…

    So, I clicked “cancel” when it asked to install ActiveX and then a second pop up screen appeared which gives you no option but to install the darn thing. It says something like “Install Video Active X Object now” with an “ok” button – and you are completely locked out of Safari! I couldn’t quit out of safari because it wouldn’t let me so I turned the computer off at the back, waited a minute and turned it back on – the screen was still giving me no option other than to download it.

    I was able to force quit safari by holding down “command + shift + esc”…

    I hope this will help someone else. :)

  • 15 }
    Jo said:

    I had two of these links . both from bebo so clicked to the link and it came up with yuotube instead of youtube. it then came up with an error box telling me to install the software. stupidly i thought nothing of it and clicked continue but it didnt do anything so i clicked it again. still nothing happened. does this mean i may have the virus. if so how can i find out?

  • 16 }
    xapamg said:

    ola bom o programa seu

  • 17 }
    mk said:

    how do you get around it

  • 18 }
    hma said:

    thank u but i cant download video activex object pls send it fpr me(e-mail)

  • 19 }
    pukuu said:

    plz tell me how to install vedio activex control

Leave your response!