Osx.Backdoor.Morcut-9 is detected by only 1 AV. Worried...

Question

Hello
I wish I could understand how come ClamXav is the only software still detetecting Osx.Backdoor.Morcut-9 while neither Sophos or Intego installed on my iMac are seeing a problem - which was there a few days ago.
Nor virustotal.com is detecting whatsoever from all AVs except from ClamXav (detecting Osx.Backdoor.Morcut-9)
Does it mean I shoudn't worry or ClamX is the only one seeing something?
Thanx for your time
Pascal

Answer 1

This malware is also known by the names Crisis and Remote Control System DaVinci. This malware is actually still quite active. A new variant of Crisis was discovered about a month ago, and although that variant would not run in Mac OS X 10.8 or 10.9, it would not be prudent to believe that this means no variants of Crisis will run in those systems.
That said, I would expect Intego to detect it. If they don't, it may be a false positive on the part of ClamXav, or there may be some kind of conflict between all these anti-virus apps that you have installed. (It's generally not a good idea to have more than one anti-virus app installed and doing any kind of scanning at the same time.)
What file was actually detected as malware by ClamXav? Re-open ClamXav and click the Open Scan Log button, or choose Logs -> Open Scan Log. This will open the Console app and display a lot of text that displays a log of ClamXav's scans. Then apply a filter by clicking the Filter field in the upper left corner of the Console window and enter "morcut" (without the quotes). Copy any lines that are visible and paste them into a message here. You should see lines like this (as an example I made by scanning some other malware I had on hand):
/Users/thomas/Desktop/CoinThief/com.google.softwareUpdateAgent/com.google.softwa reUpdateAgent: OSX.CoinThief.A.UNOFFICIAL FOUND
/Users/thomas/Desktop/CoinThief/com.google.softwareUpdateAgent.plist: OSX.CoinThief.A.UNOFFICIAL FOUND
/Users/thomas/Desktop/CoinThief/Pop-Up Blocker.safariextz: OSX.CoinThief.A.UNOFFICIAL FOUND