It appears unlikely anyone is affected by the Mac/Cowhand.
1. Check your Startup Items first:
Click the Apple Menu, click System Preferences, and then click Accounts. If you're using OS X 10.4, click the lock icon at the bottom of the window and type in your password. Then click the "Login Items" tab and look at each program in the list to see if you find anything unfamiliar.
For example, I have my printer program (HP), the Microsoft database daemon (for MS Office), the iTunes Helper, and System Events.
2. Check your Preferences folder:
The problem here is that I'm not sure what you'd look for. From what I can find, Sophos is the source of this announcement (and they tend to be sensationalist and to stretch the truth), and they haven't divulged filenames. I guess look for anything that does not have a file extension of ".plist" (without the quotes).
To see filenames, you'd have to go to Finder, click the Finder menu at the top of the screen and click Preferences. Make sure "Show All File Extensions" is checked.
**My opinion: Skip both 1 and 2. At least skip #2. This is another "Sophoax."***
Sophoax = Sophos + hoax = an instance where Sophos "warns" Mac users about a new security threat that turns out to be no threat at all
I made that up!
Doug