Is my Mac infected with the Flashback trojan?

Question

I own a 2011 model of MacBook Pro with a Core i7 processor and Snow Leopard. I have found out there is a trojan horse which now controls 600,000 Macs.

• How can I find out if my MacBook is being controlled?
• How can I remove the trojan?

Answer 1

You can follow these instructions from F-Secure to uninstall/remove the malware:

1. Run the following command in Terminal:

   defaults read /Applications/Safari.app/Contents/Info LSEnvironment
   

2. Take note of the value, DYLD_INSERT_LIBRARIES

3. Proceed to step 8 if you got the following error message:

   "The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"
   

4. Otherwise, run the following command in Terminal:

   grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step2%
   

5. Take note of the value after "__ldpath__"

6. Run the following commands in Terminal (first make sure there is only one entry, from step 2):

   sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment`
   
   sudo chmod 644 /Applications/Safari.app/Contents/Info.plist`
   

7. Delete the files obtained in steps 2 and 5

8. Run the following command in Terminal:

   defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
   

9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:

   "The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"
   

10. Otherwise, run the following command in Terminal:

    grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step9%
    

11. Take note of the value after "__ldpath__"

12. Run the following commands in Terminal:

    defaults delete ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
    
    launchctl unsetenv DYLD_INSERT_LIBRARIES
    

13. Finally, delete the files obtained in steps 9 and 11.

Update:

Apple has released an official tool for uninstalling the malware. Read about it and download it on this Apple KB page.

F-Secure has also released a removal tool, which you can download here.

Answer 2

Flashback Checker

This is for your relatives and friends that want to avoid using the Terminal.

Download this free app from Github. As referenced in this Macworld article, the single-function app will quickly check your machine for the infection. The app doesn't remove the malware, which will be left up to the user by manually following the instructions from F-secure.

Answer 3

Kaspersky's removal tool

...checks if your Mac is affected and removes the trojan if necessary. You can download it on
http://support.kaspersky.com/downloads/utils/flashfake_removal_tool.zip

Check online using your UUID

You can check if you Mac is affected using your UUID (Universally unique identifier) on http://flashbackcheck.com/

1. Go to:

    /Applications/Utilites/System Information.app
   

   

2. Check the UUID on http://flashbackcheck.com/

Answer 4

Java for Mac OS X 10.6 Update 8

Apple released an official software update that will remove the flashback malware from your computer. Just run software update on your Mac to install it. Here are the details from the Apple support article:

This Java security update removes the most common variants of the Flashback malware.

Java for OS X Lion 2012-003

From the Lion update:

This Java security update removes the most common variants of the Flashback malware.

This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.

Here is an Apple support article about the security content of the Java updates.

Answer 5

Quick one-liner to paste into Terminal.app:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment &> /dev/null && echo "You seem to have Type 1"; defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES &> /dev/null && echo "You seem to have Type 2"

Unless this outputs anything, you're clean (at least of the known types). If it does say something, go clean up.