Remove Mac Flashback Trojan: Java Exploit

What it does: Trojan-Downloader:OSX/Flashback.I connects to a remote site to download its payload; on successful infection, the malware modifies targeted webpages displayed in the web browser.

Removal:

Caution: Manual disinfection is a risky process; it is recommended only for advanced users. Otherwise, please seek professional technical assistance.

 

Manual Removal Instructions

  • 1. Run the following command in Terminal:defaults read /Applications/Safari.app/Contents/Info LSEnvironment
  • 2. Take note of the value, DYLD_INSERT_LIBRARIES
  • 3. Proceed to step 8 if you got the following error message: “The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist”
  • 4. Otherwise, run the following command in Terminal:grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step2%
  • 5. Take note of the value after “__ldpath__
  • 6. Run the following commands in Terminal (first make sure there is only one entry, from step 2):sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment

    sudo chmod 644 /Applications/Safari.app/Contents/Info.plist

  • 7. Delete the files obtained in steps 2 and 5
  • 8. Run the following command in Terminal:defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
  • 9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following: “The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist”
  • 10. Otherwise, run the following command in Terminal:grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step9%
  • 11. Take note of the value after “__ldpath__
  • 12. Run the following commands in Terminal:defaults delete ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

    launchctl unsetenv DYLD_INSERT_LIBRARIES

  • 13. Finally, delete the files obtained in steps 9 and 11.

VIA : [F-Secure]

Tagged with: , , , , , , , , , ,
Posted in Macintosh
One comment on “Remove Mac Flashback Trojan: Java Exploit
  1. matsfunk says:

    [self-help] detect and remove mac flashback trojan: http://t.co/7WRahPph

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Enter your email address to follow this site and receive notifications of new posts by email.

Join 196 other followers

Categories
Flickr Photos
Archives
Colophon
wordpress com stats plugin
%d bloggers like this: