You think you have me in a "Gotcha" don't you, PJ. . . but I told you in a previous that you don't know everything and your Googling doesn't get you anywhere. You really do have a tendency to go off half-cocked without really researching anything, don't you. You should ask yourself why no one bothers to mention that sorry episode in history. It would have been the largest computer bot in history. . . if it were true. The average Windows bot rarely gets above 2000 machines before it is closed down. Too bad it is not true. It disappeared off the news cycle in less than two weeks, because it wasn't true. It was a Hoax intended to sell Anti-virus software published by the so-called discoverer and the ONLY reason it got the "legs" it did was because the pundits so-wanted it to be true.
Did you not bother to read what I wrote or the article you found and see how the link article coincided with what I wrote? Obviously not, because I had already COVERED the Dr. Web hoax because I KNEW someone like you would rise to the bait.
That was the one claimed to have been discovered by Doctor Web. . . but not a single one was found in the wild. Not one. And it wasn't from lack of trying and looking.
To get infected by this supposed FlashBack JAVA Trojan, which had been identified and the vulnerability CLOSED by Apple (who pushed out the fix six months earlier), of which 95% of the claimed 640,000 infected Macs were in the United States and the balance were in the UK, both of which are English speaking countries, one had to log into an obscure RUSSIAN LANGUAGE game website in Siberia and download one of several player profiles in RUSSIAN.
To even get infected by the FlashBack Trojan, the target Mac had to have JAVA installed which was required to play the game. Java was NOT A DEFAULT installation on Mac OS X since OS X.4 four years earlier. . . and was no longer even shipped with OS X since then. To get Java required the user to go to Oracle and download and install JAVA.
The game itself had sold under 20,000 copies, all in Russia or Eastern Europe. Yet the claim was that 640,000 Macs were infected by a download only Trojan that could not be spread any other way. . . from a single source website. RIGHT!
So tell me, PJ, how did a RUSSIAN LANGUAGE role playing game with fewer than 20,000 downloads somehow cause ENGLISH language speaking Mac users to contact a Russian Language Website in the Cyrillic alphabet and induce them to download 500,000 (actually 640,000) character definitions useable ONLY in this obscure game, which then infected their Macs (with a Trojan that the OS X system would automatically RECOGNIZE and block from being downloaded, installed or run, requiring an administrator name and password to continue)? Do you begin to see the logical problem???
In addition, PJ, these infections somehow occurred ONLY in English speaking countries where Dr. Web was marketing its new A/V for Business Mac, and NOT A SINGLE INFECTION was reported in Russia or Eastern Europe???? WOW, what a strange coincidence! How is this possible? Do you see the impossibility of this?
Incidentally, the game was a cross-platform game and only 2% of the so-called infections were claimed to have been on Windows, yet of the 20,000 games sold over 18,000 were for WINDOWS! So now we have 90% of the games are on a platform known for malware, yet one that isn't known for it, somehow is downloading all the malware? Yet there are only 2000 accounting for 640,000 supposed infections? Hold the phone!
Read what I wrote above. . . Then the news reports of the number of infected Macs suddenly and rapidly started SHRINKING. . . as no one EVER found an infected Mac in the wild, even with Dr. Web providing a resource for people to check if their Macs were infected by their UUID. The number reported shrank first to 270,000, then 186,000 then 120,000, then under 100,000, then fewer than 40,000 then the news reports completely disappeared out of the news cycle entirely, never to be heard about again. Not even a reference. Whoops, what's with that? Embarrassment, for falling for the hoax, that's what.
Not a single Mac whose ID was on Dr. Web's "Honey Pot intercepted database" EVER turned out to be infected. Not one.
Then it turned out that many of the UUIDs were for Macs that never had Java installed, so those Macs could NOT ever be infected. . . and then that some of the Macs were STILL IN THE BOX, unsold, and without ever having the chance to have Java installed by an end user, or ever being on the Internet, could never ever have connected to the Russian Game site, well, you get the idea. . . and then it was discovered many of the UUIDs belonged to Macs that had never yet even been assembled by Apple!
It became obvious that all Dr. Web had was a list of UUID's of Macs that had been assembled, were yet to be assembled, or had been sold . . . but were NOT ever part of any kind of Macbot. It was a HOAX intended to scare people into buying their AV software.
Two years later, when Dr. Web announced their Personal AV for Mac, they also simultaneously announced the "discovery" of a new 20,000 member Macbot also using a variant of Flashback. It got a couple of headlines and went "PLUNK!" as the punditry took the attitude of "Fool me once, shame on you!. Fool me twice, Shame on me!" and ignored them. Dr. Web's Personal AV also went "PLUNK!" as no member of that Macbot was ever found in the wild either.