More on the hacktool.underhand 'trojan'

Yesterday we reported on an alert from Norton Anti-Virus of a trojan called "hacktool.underhand" appearing on a number of user systems.

It was subsequently determined that this was a false positive generated by Norton Anti-Virus, and in fact, Norton Anti-Virus' attempt to eliminate the non-existent "trojan" can cause a host of other issues, including kernel panics and extreme slow-down in some applications.

The problem stems from the fact that Norton Anti-Virus identifies this issue as a problem with Mac OS X's swapfile, and attempts to correct it, causing the aforementioned issues.

The solution is to disable Norton AntiVirus' Auto-Run feature by removing it from the /Library/StartupItems folder.

After applying the latest virus definitions, you can turn Auto-Run back on.

Feedback? Late-breakers@macfixit.com.

Resources