1. 2012-04-05, 07:12 PM #1
    Tyrianth
    Tyrianth is offline
    Scarab Lord
    10+ Year Old Account
    Join Date
    Dec 2009
    Location
    Toronto, Ontario
    Posts
    4,664

    More than 600,000 Macs infected with Flashback botnet

    http://news.cnet.com/8301-1009_3-574.../?tag=mncol;1n

    When the trojan executes it checks your system for these directories:

    • /Library/Little Snitch
    • /Developer/Applications/Xcode.app/Contents/MacOS/Xcode
    • /Applications/VirusBarrier X6.app
    • /Applications/iAntiVirus/iAntiVirus.app
    • /Applications/avast!.app
    • /Applications/ClamXav.app
    • /Applications/HTTPScoop.app
    • /Applications/Packet Peeper.app

    If any one of those are found it commits suicide. If you don't have any of those directories it's easy to see if you've been infected or not.

    Simply run this command in terminal:

    Code:
    defaults read /Applications/Safari.app/Contents/Info LSEnvironment
    You should get this error:

    Code:
    The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist
    Then run this command:

    Code:
    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
    You should get this error:

    Code:
    The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist
    If you get both of those errors than you're Flashback free! If you don't get those errors then removal can be found here
    Last edited by Tyrianth; 2012-04-05 at 07:19 PM.
    (This signature was removed for violation of the Avatar & Signature Guidelines)
    Reply With Quote Reply With Quote
  2. 2012-04-05, 07:16 PM #2
    sophiemj
    sophiemj is offline
    Field Marshal sophiemj's Avatar
    10+ Year Old Account
    Join Date
    May 2010
    Location
    Athens Greece
    Posts
    60
    Send a message via AIM to sophiemj
    thank u I will check it !
    Reply With Quote Reply With Quote
  3. 2012-04-05, 07:58 PM #3
    Misen
    Misen is offline
    High Overlord Misen's Avatar
    10+ Year Old Account
    Join Date
    Jun 2010
    Location
    Austin, TX
    Posts
    199
    Our junior sys admin is having a great day today
    (he's patching around 350 macs out in the field)
    Reply With Quote Reply With Quote
  4. 2012-04-05, 09:25 PM #4
    Tyrianth
    Tyrianth is offline
    Scarab Lord
    10+ Year Old Account
    Join Date
    Dec 2009
    Location
    Toronto, Ontario
    Posts
    4,664
    Quote Originally Posted by Misen View Post
    Our junior sys admin is having a great day today
    (he's patching around 350 macs out in the field)
    that should be an exciting day for him.
    (This signature was removed for violation of the Avatar & Signature Guidelines)
    Reply With Quote Reply With Quote
  5. 2012-04-05, 10:48 PM #5
    Myrrar
    Myrrar is offline
    Over 9000! Myrrar's Avatar
    10+ Year Old Account
    Join Date
    Mar 2010
    Location
    Rapture
    Posts
    9,479
    They missed the firefox one. You need to do all 3 of these to check:

    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
    defaults read /Applications/Safari.app/Contents/Info LSEnvironment
    defaults read /Applications/Firefox.app/Contents/Info LSEnvironment
    Reply With Quote Reply With Quote
  6. 2012-04-06, 07:32 AM #6
    sophiemj
    sophiemj is offline
    Field Marshal sophiemj's Avatar
    10+ Year Old Account
    Join Date
    May 2010
    Location
    Athens Greece
    Posts
    60
    Send a message via AIM to sophiemj
    phew safe
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Social Media

Services

My Account

Support

Advertise

Resources

Terms of Service

Privacy Policy

Our Communities

© 2023 Magic Find, Inc. All rights reserved.