7

There's been a couple of trojans recently that imitate the Adobe Flash Player installer one of which is called OSX/flashback.A. (More info here) I've been wary of updating Adobe Flash Player due to this trojan. How do I tell if the installer is the real thing, or if it's just a trojan? Also, where does it come from? I'm pretty sure the DMG for the trojan downloaded automatically, opened the installer, and wanted me to install it.

I know that I can download the official installer from the Adobe website, and will probably do this. However, my questions remain.

Improve this question
1
  • Your question is asked and answered. Don't install updates that are pushed on you in your browser. Visit the developer site directly to download updates.
    – jaberg
    Jan 29, 2012 at 17:14

4 Answers 4

Reset to default
5

There are a couple easy ways to identify the trojan in it's current form (aside from downloading directly from Adobe or using AV software):

  1. The trojan is an installer package that opens with Installer.app, the real installer is an application (it doesn't use Installer.app).

  2. When run, the trojan installer looks like the screenshot of the trojan installer in the CNET article you linked to, the real installer looks like the screenshot of the real installer in that same article. (Screenshots reposted below.)

The trojan is found exclusively on sites that are not adobe.com, generally from malicious sites.

Legitimate Flash Player Installer: Real Flash Player Installer

Trojan Installer: Trojan Installer

Improve this answer
1
  • 4
    Please note the words "current form". There is no guarantee that 5 minutes from now, you won't find a different version of the malware where you won't be able to tell any difference just by looking at it.
    – hotpaw2
    Jan 30, 2012 at 6:42
3

If you want to be sure, grab the official installer from Adobe's website. http://get.adobe.com/flashplayer/

Improve this answer
4
  • See my updated question. Sorry, was going to add that then forgot.
    – daviesgeek
    Jan 29, 2012 at 17:10
  • Even with your update, the answer is the same. While I appreciate your academic interest, the solution, particularly for general users, is to discard updates offered up "out of the blue".
    – jaberg
    Jan 29, 2012 at 17:19
  • @jaberg Ok, yes and no. IMO, this answers the question, but not the way I asked it to be answered.
    – daviesgeek
    Jan 29, 2012 at 17:23
  • Okay, if you want to dig, this is why Apple encourages developers to "sign" installers. You may find Apple's Security Overview developer document useful.
    – jaberg
    Jan 29, 2012 at 17:29
2

From the start of 2021, Adobe no longer supports Flash Player and has blocked Flash content from running in Flash Player. Adobe strongly recommends all users immediately uninstall Flash Player to help protect their systems.

Consequently, it's now safe to assume that any Flash Player update you come across is malware.

https://www.adobe.com/uk/products/flashplayer/end-of-life.html

Improve this answer
-2

Try either Onyx (Free) or Cocktail ($) that will, among a myriad of things, will also search for malicious known stuff.

Improve this answer
2
  • As will OS X (10.6+) itself once the ProtectX definitions include the malware in question.
    – jaberg
    Jan 29, 2012 at 17:21
  • Thanks for the answer, but I'm really looking for specifics on how to recognize it, not for anti-virus software.
    – daviesgeek
    Jan 29, 2012 at 17:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .