Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I own a 2011 model of MacBook Pro with a Core i7 processor and Snow Leopard. I have found out there is a trojan horse which now controls 600,000 Macs.

  • How can I find out if my MacBook is being controlled?
  • How can I remove the trojan?
share|improve this question
add comment

5 Answers

up vote 24 down vote accepted

You can follow these instructions from F-Secure to uninstall/remove the malware:

  1. Run the following command in Terminal:

    defaults read /Applications/Safari.app/Contents/Info LSEnvironment
    
  2. Take note of the value, DYLD_INSERT_LIBRARIES

  3. Proceed to step 8 if you got the following error message:

    "The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"
    
  4. Otherwise, run the following command in Terminal:

    grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step2%
    
  5. Take note of the value after "__ldpath__"

  6. Run the following commands in Terminal (first make sure there is only one entry, from step 2):

    sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment`
    
    sudo chmod 644 /Applications/Safari.app/Contents/Info.plist`
    
  7. Delete the files obtained in steps 2 and 5

  8. Run the following command in Terminal:

    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
    
  9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:

    "The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"
    
  10. Otherwise, run the following command in Terminal:

    grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step9%
    
  11. Take note of the value after "__ldpath__"

  12. Run the following commands in Terminal:

    defaults delete ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
    
    launchctl unsetenv DYLD_INSERT_LIBRARIES
    
  13. Finally, delete the files obtained in steps 9 and 11.

Update:

Apple has released an official tool for uninstalling the malware. Read about it and download it on this Apple KB page.

F-Secure has also released a removal tool, which you can download here.

share|improve this answer
    
Ok, I got the error message in both step 3( and step 9). Does that mean I am safe? –  Richard Knop Apr 9 '12 at 20:16
    
@RichardKnop Yes. You are fine. Thanks for asking the question, BTW. –  daviesgeek Apr 9 '12 at 20:18
add comment

Flashback Checker

This is for your relatives and friends that want to avoid using the Terminal.

Download this free app from Github. As referenced in this Macworld article, the single-function app will quickly check your machine for the infection. The app doesn't remove the malware, which will be left up to the user by manually following the instructions from F-secure.

enter image description here

share|improve this answer
add comment

Kaspersky's removal tool

...checks if your Mac is affected and removes the trojan if necessary. You can download it on
http://support.kaspersky.com/downloads/utils/flashfake_removal_tool.zip

enter image description here

Check online using your UUID

You can check if you Mac is affected using your UUID (Universally unique identifier) on http://flashbackcheck.com/

  1. Go to:

    /Applications/Utilites/System Information.app
    

    enter image description here

  2. Check the UUID on http://flashbackcheck.com/

share|improve this answer
add comment

Java for Mac OS X 10.6 Update 8

Apple released an official software update that will remove the flashback malware from your computer. Just run software update on your Mac to install it. Here are the details from the Apple support article:

This Java security update removes the most common variants of the Flashback malware.

Java for OS X Lion 2012-003

From the Lion update:

This Java security update removes the most common variants of the Flashback malware.

This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.

Here is an Apple support article about the security content of the Java updates.

share|improve this answer
add comment

Quick one-liner to paste into Terminal.app:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment &> /dev/null && echo "You seem to have Type 1"; defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES &> /dev/null && echo "You seem to have Type 2"

Unless this outputs anything, you're clean (at least of the known types). If it does say something, go clean up.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.