Criminals gain control over Mac with BackDoor.Olyx
Published: 2011-06-22 · Archived: 2026-04-05 22:49:29 UTC
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies
related to the collection of visitor statistics.
Learn more
22.06.2011
Real-time threat news | Virus alerts
June 22, 2011
Doctor Web—the leading Russian developer of anti-virus software —informs users that its virus analysts
have discovered a new threat to computers running Mac OS X. BackDoor.Olyx is the second known
backdoor for the operating system. If a machine is compromised by the malware, attackers get an
opportunity to covertly control the computer. The backdoor receives commands from a remote server to
create, transfer, rename, delete various files, as well as some other instructions.
The number of malicious programs for MAC OS X is small, especially compared with the number of threats to
Windows. Until recently only one backdoor program for the OS was known—BackDoor.DarkHole. Versions of
this malware exist for Mac OS X and for Windows. When launched, it enables hackers to open web pages in the
default browser on the infected machine, restart the computer remotely and perform various operations with files.
Now, in the Dr.Web virus database contains entries for both BackDoor.DarkHole and BackDoor.Olyx.
The program gets to a user's computer as an application designed for Macs featuring the Intel-compatible
architecture, BackDoor.Olyx creates the /Library/Application Support/google/ directory on the disk to which it
saves a file named startp. Then BackDoor.Olyx places the file /Library/
LaunchAgents/www.google.com.tstart.plist into the home directory, and uses the file to launch the malicious
object after a system reboot.
After that the program moves itself to a temporary folder named google.tmp to delete the executable from its
original location. As the name implies, BackDoor.Olyx operates in an infected system as a backdoor which
https://news.drweb.com/show/?i=1750&lng=en&c=14
Page 1 of 2

includes downloading and running malicious files on infected machines and executing various commands in the
/bin/bash shell. Thus, attackers can gain control over an infected computer without the user's knowledge.
Users of Dr.Web for Mac OS X can rest assured about the security of their computers, since the signature of the
malware has already been added to the Dr.Web virus database. To prevent BackDoor.Olyx from infecting
systems, users of Dr.Web for Mac OS X are recommended to enable automatic updating and scan their hard drives
regularly.
1750 en 5
0
Doctor Web’s Q1 2026 review of virus activity on mobile devices
01.04.2026
Virus reviews
Read
Doctor Web’s Q1 2026 virus activity review
01.04.2026
Virus reviews
Read
Dr.Web for personal computers receives SKD AWARDS product excellence distinction
24.03.2026
Corporate news | Dr.Web products
Read
Source: https://news.drweb.com/show/?i=1750&lng=en&c=14
https://news.drweb.com/show/?i=1750&lng=en&c=14
Page 2 of 2