A Trojan for OS X that is installed by Mac.Trojan.VSearch.4.
It includes the following components:
The Trojan gets the parameters necessary for its normal work from /Library/Preferences/com.appName.preferences.plist, where appName is an application name generated randomly.
The script injected into webpages displays advertisements, sends statistics to the server, and collects the user’s Web search queries transmitting them to servers, a list of which is incorporated into the script:
www.google. www.bing. .ask. search.whitesmoke thesmartsearch