Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

My Mac OSX Snow Leopard got exploited by the Flashback malware. There's a summary by F-Secure that I'm trying to follow in order to remove it. This link is similar, and provides a little more detail.

The first step is to type the following:

bash-3.2$ defaults read /Applications/Safari.app/Contents/Info LSEnvironment
{
 "DYLD_INSERT_LIBRARIES" = "/Applications/Safari.app/Contents/Resources/.NeroLite \022@.xsl";
}

This shows the malware. The next step is to do the following:

bash-3.2$ grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLite \022@.xsl
grep: /Applications/Safari.app/Contents/Resources/.NeroLite: No such file or directory
grep: 022@.xsl: No such file or directory

As you can see the file path includes .NeroLite \022@.xsl and the space backslash combination has got me confused, and the system can't find the file. Anyone how I can locate this file? What is the \022@ trying to do? How to complete the next step?

UPDATE1

I've tried the following:

bash-3.2$ grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLite\ \\022@.xsl
grep: /Applications/Safari.app/Contents/Resources/.NeroLite \022@.xsl: No such file or directory

bash-3.2$ grep -a -o '__ldpath__[ -~]*' "/Applications/Safari.app/Contents/Resources/.NeroLite \022@.xsl"
grep: /Applications/Safari.app/Contents/Resources/.NeroLite \022@.xsl: No such file or directory

bash-3.2$ ls /Applications/Safari.app/Contents/Resources/.Nero*
ls: /Applications/Safari.app/Contents/Resources/.Nero*: No such file or directory

bash-3.2$ grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLit*
grep: /Applications/Safari.app/Contents/Resources/.NeroLit*: No such file or directory

UPDATE2

I executed the following commands:

# sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment 
# sudo chmod 644 /Applications/Safari.app/Contents/Info.plist 
# defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
2012-04-01 21:42:40.706 defaults[891:903] 
The domain/default pair of (/Users/myuser/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist

Which is good, according to the first link above.

THEN I REBOOTED THE SYSTEM. However, when I then try to start Safari, it won't start, but instead gives me the same old error:

Safari cannot be opened because of a problem.

Process:         Safari [882]
Path:            /Applications/Safari.app/Contents/MacOS/Safari
Identifier:      com.apple.Safari
Version:         ??? (???)
Build Info:      WebBrowser-75345503~2
Code Type:       X86-64 (Native)
Parent Process:  launchd [110]

Date/Time:       2012-04-01 21:41:24.286 -0700
OS Version:      Mac OS X 10.6.8 (10K549)
Report Version:  6

Interval Since Last Report:          501264 sec
Crashes Since Last Report:           11
Per-App Crashes Since Last Report:   11
Anonymous UUID:                      <removed>

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000002, 0x0000000000000000
Crashed Thread:  0

Dyld Error Message:
  could not load inserted library: /Applications/Safari.app/Contents/Resources/.NeroLite @.xsl

Binary Images:
0x7fff5fc00000 -     0x7fff5fc3bdef  dyld 132.1 (???) <removed> /usr/lib/dyld

<...lists installed hardware...>
share|improve this question
    
could you please show output from: "ls -al /Applications/Safari.app/Contents/Resources/" (enter without ") –  Alex Bolotov Apr 2 '12 at 4:34
    
I can't. There are hundreds and hundres of files. However, none are showing with a dot in front of them (maybe the mac hides those files?). If I type: ls -al /Applications/Safari.app/Contents/Resources/.N* it says no such file or directory. –  gkk Apr 2 '12 at 4:40
    
try "defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES" –  Alex Bolotov Apr 2 '12 at 4:41
    
I included this in UPDATE2 above. –  gkk Apr 2 '12 at 4:48
1  
More recent Is my Mac infected with the Flashback trojan? has an accepted answer. If following answers such as those you find your system either damaged, or possibly infected, then I should recommend reinstallation of the system. –  Graham Perrin Apr 10 '12 at 22:58

2 Answers 2

The safest way to ensure removal of live malware is to (re)boot from external media and to then re-install the OS and all your apps and executables.

share|improve this answer

Just use asterisk instead of all that suspicious combination:

grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLit*

Update:

Your safari got corrupted you should probably try reinstalling it. Even better solution:

  1. install one of:

  2. Perform full system scan (to make sure that there are no traces of malware left)

  3. Maybe backup all data and reinstall OSX

  4. Install antivirus on clean OS. Never use 'Admin' user account as primary account.

  5. Don't trust other sites that they will help you installing Flash Player or whatever other plugin. Always install plugins (like Adobe Flash) by visiting their official sites by yourself (http://get.adobe.com/flashplayer/ in this case).

  6. Uncheck following setting in Safari (from some security advisory articles):

Securing Safari

share|improve this answer
    
In general, it's not a good idea to suggest a wild card when the intent is to deal with a specific file. –  rm -rf Apr 2 '12 at 4:30
    
I added results to UPDATE section above. –  gkk Apr 2 '12 at 4:33
    
I did a full disk scan using ClamXav, and it didn't find anything bad. Mayber I'll try another product... –  gkk Apr 2 '12 at 13:48
    
Cocktail can also search for known Malware (maintain.se/cocktail) –  NOTjust -- user4304 Mar 1 '13 at 19:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.