How to detect and remove the SabPub Mac Trojan

It’s apparently a low level threat, but our story that Apple’s Java update is no protection against new SabPub Mac Trojan that is spreading through infected Word documents, has a lot of people worried. If you are wondering to detect and remove the threat you may be pleased to hear that Authorised Apple Service Provider Amsys has made a tool available that can detect and remove the threat.

The company also published a blog explaining how to find out if your Mac is infected with SabPub and remove it. First, notes Amsys, the Trojan is made to look like an Apple launcher, with a similar name to a real Apple launcher called “PubSub”, “so please don’t confuse the two!” (More below)

“The recent Apple security updates have stopped this from sending information out from your system, but the Trojan will still remain on your Mac.”

The company claims its SabPub remover, which can be downloaded here, “will Search to see if your system has this malware and will remove it, saving you the trouble of trawling through your system to find the offending launchers.”

There are two variants of SabPub. One is known as Backdoor.OSX.SabPub.a. Like Flashback, this new threat was likely spread through Java exploits on Websites, and allows for remote control of affected systems. It was created roughly one month ago. Fortunately, this malware isn’t a threat to most users for a few reasons: It may have only been used in targeted attacks, SabPub, Kaspersky Lab Expert Costin Raiu wrote on Securelist, with links to malicious websites sent via email, and the domain used to fetch instructions for infected Macs has since been shut down.

The second SabPub variant is old-school compared to its sibling. Instead of attacking through malicious Websites, it uses infected Microsoft Word documents as vector, distributed by email.

Like the other SabPub variant, this one was used only in targeted attacks, possibly against Tibetan activists. So unless you’re working with a pro-Tibet organization – and you have a habit of opening suspicious Word documents – there’s little reason for alarm. At most, SabPub is more evidence that Macs aren’t immune to attacks – a point that Flashback already made perfectly clear.