New Mac botnet malware uses Reddit to find out what servers to connect to?

Question

Hi all,
I have come across these warnings over the last few days regarding a Mac botnet malware? The Independent published it
17,000 Macs recruited into malware botnet, with a little help from Reddit
Researchers at Russian anti-virus company Dr Web believe that they have uncovered a new botnet, which has recruited thousands of Mac computers. According to their report, the sophisticated malware – which they have dubbed Mac.BackDoor.iWorm – has infected more than 17,000 computers running OS X. Unfortunately, what isn’t presently documented is how the malware spreads – but the consequences can clearly be serious.Like any computers that have been recruited into a botnet, Macs that have been hijacked in this attack could have information stolen from them, further malware planted upon them, or be used to spread more malware or launch spam campaigns and denial-of-service attacks.Fascinatingly, compromised computers receive commands from servers under the control of botmasters, using information posted in messages on Reddit as a navigational aid:Then Mac.BackDoor.iWorm opens a port on an infected computer and awaits an incoming connection. It sends a request to a remote site to acquire a list of control servers, and then connects to the remote servers and waits for instructions.It is worth mentioning that in order to acquire a control server address list, the bot uses the search service at reddit.com, and — as a search query — specifies hexadecimal values of the first 8 bytes of the MD5 hash of the current date. The reddit.com search returns a web page containing a list of botnet C&C servers and ports published by criminals in comments to the post minecraftserverlists under the account vtnhiaovyd.
this is what one forum member on Reddit said.
'Basically, the worm installs itself to look like an application to the operating system and hooks into the automatic startup so that it will launch each time the computer is started.
Once it's running, it does an inventory of what applications you have installed.
It then goes out to reddit to find out where the current botnet command and control servers are located. It then connects to the command and control server to ask for instructions.
The likely reason it looks at the applications that are installed is so that it can use those applications to carry out the botnet's commands (e.g., use Mail to send spam as you.)'
another said
'it is a Trojan packed in a minecraft expansion or custom server or client. Exploiting the same flaw as the flashback worm from 2012."
'another saidUnfortunately, the security analysts fail to mention (or simply don’t know) how the virus is spreading into users’ Macs. Hopefully, this information comes to light soon so Mac users can know what to look out for. Once identified, Apple can add the virus to its security blacklists (which are refreshed nightly) to give some automatic protection to its user base.'
Anyone know about this and is there a way to detect it and then if it is present get rid?
http://9to5mac.com/2014/10/02/new-mac-botnet-malware-uses-reddit-to-find-out-wha t-servers-to-connect-to/
http://www.independent.co.uk/life-style/gadgets-and-tech/hackers-are-using-reddi t-to-control-17000-apple-computers-9773032.html
http://grahamcluley.com/2014/10/mac-malware-botnet-reddit/

Answer 1

seems it has been solved... found this on Mac Rumours
'In an effort to address the threat, Apple has now updated its "Xprotect" anti-malware system to recognize two different variants of the iWorm malware and prevent them from being installed on users' machines. '
'It has been discovered how the botnet is installed. You have to download a pirated app, such as Photoshop, and then give the pirated installer administrator privileges.
No amount of malware security can fix stupid.'
EDIT: Link to evidence: http://www.thesafemac.com/iworm-method-of-infection-found/ (http://www.thesafemac.com/iworm-method-of-infection-found/)'