Mac security specialist Intego concurs. Lysa Myers (‘virus hunter’) said on Wednesday, that “this malware is not persistent – perhaps due to a bug, it does not restart after a reboot, and will lie dormant unless it is manually restarted or removed. It does add itself to the login items, but this does not succeed in restarting the malware; it will only open the user’s home folder at login instead.”
Ducklin expands on this. “It adds itself to your login items, presumably with the intention of loading up every time you reboot your Mac. But a bug means that it adds itself as a folder, not an application. All that happens when you log back in is that Finder pops up and displays your home directory.”
So why should anyone be concerned? Particularly since Myers further suggests “you get what you pay for, even in the malware world.” She notes that the altogether more serious Crisis malware costs €200,000; while NetWeird is available for just $60. But that’s what makes it interesting for Ducklin. “It seems that the crooks really are getting into the habit of churning out new Mac malware, not to show how clever they are, but merely to see if they can repeat the trick that's worked on Windows for years: making money out of next to nothing.”
He adds whimsically, “And then the long-suffering but battle-hardened Windows users pop up and say, ‘Back in 1991, we felt the same way. It didn't end well.’ Those of a philosophical bent repeat, with sincerity and concern, the words of George Santayana. ‘Those who cannot remember the past are condemned to repeat it’.” The importance of NetWeird to Ducklin is that it is further evidence that malware writers are beginning to take a nascent interest in the Mac – and the Mac is not as secure as many people believe.