 It doesn't infect applications on disk, but rather when they are loaded, by using a system facility called "apphook".Leap only infects Cocoa applications, and it does not infect applications owned by the system (including the apps that come pre-installed on a new machine), but only apps owned by the user who is currently logged in.Typically, that means apps that the current user has installed by drag-and-drop, rather than by Apple's installer system.