5 ms·

The aim is to look legitimate, but not clobber applications - merely to look like something the user shouldn't delete.

• toyg 10y ago
  But the post says that the malware checks if any of those folders exists, only then writing the necessary plist. By your reasoning, one of these folders should have been created in advance by another process. So this "backdoor" is even incomplete...
  • sordidfellow 10y ago
    It says it checks if those folders are available - which could mean checking if the name is not already taken, and then creating the path for itself to use.
  • djrogers 10y ago
    > But the post says that the malware checks if any of those folders exists Presumably so it doesn't re-infect an already compromised host