Geek Posted April 5, 2012 Posted April 5, 2012 <div class="KonaBody"><p><img src="http://osxdaily.com/wp-content/uploads/2012/04/check-flashback-trojan.jpg" alt="Check for Flashback Trojan" title="check-flashback-trojan" width="620" height="145" class="aligncenter size-full wp-image-29148" /></p> <p>Trojans and viruses are generally something Mac users don’t have to worry about, but there’s a lot of hubub about the so-called <a href="http://news.drweb.com/show/?i=2341">Flashback trojan</a> that has apparently infected a several hundred thousand Macs worldwide. The trojan takes advantage of a vulnerability in an older version of Java that allows it to download malware which then “<em>modifies targeted webpages displayed in the web browser.</em>” As <a href="https://twitter.com/osxdaily/status/187294728008638464">we mentioned yesterday on Twitter</a>, the vulnerability has already been patched by Apple and if you haven’t downloaded the latest version of Java for OS X yet you should do so now. Go to Software Update and install the Java for OS X Lion 2012-001 or Java for Mac OS X 10.6 Update 7, depending on your version of Mac OS. That will prevent future infections from occurring, but you’ll also want to review if a Mac is infected.</p> <p>We haven’t heard of or seen a single case of the Flashback infection on a Mac, but for the sake of optimal security we’re going to cover how to quickly check if a Mac is afflicted by Flashback trojan:</p> <ul> <li>Launch Terminal (found in /Applications/Utilities/) and enter the following commands:</li> <p><code>defaults read /Applications/Safari.app/Contents/Info LSEnvironment </code></p> <li>If you see a message like “<em>The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist</em>” proceed to the next defaults write command:</li> <p><code>defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES </code></p> <li>If you see a message similar to “<em>The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist</em>” then <strong>the Mac is NOT infected</strong>.</li> </ul> <p>What if you see something different in the Terminal? If the defaults read commands show actual values, you may have the trojan though this does seem to be very rare. In the event you run into a Mac with the problem <a href="http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml">follow the guide on f-secure to remove the Flashback trojan</a>, it’s just a matter of copying and pasting a few commands into the Terminal. </p> <p>All in all this is nothing to freak out about, but it does serve as another reminder as to why it’s important to update system software as part of <a href="http://osxdaily.com/2012/03/04/mac-maintenance-tips/">a general maintenance routine</a>.</p> </div> <p><a href="http://feedads.g.doubleclick.net/~a/co2txeGUCVV4Xc_XB_jMHaZg8FA/0/da"><img src="http://feedads.g.doubleclick.net/~a/co2txeGUCVV4Xc_XB_jMHaZg8FA/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/co2txeGUCVV4Xc_XB_jMHaZg8FA/1/da"><img src="http://feedads.g.doubleclick.net/~a/co2txeGUCVV4Xc_XB_jMHaZg8FA/1/di" border="0" ismap="true"></img></a></p><div class="feedflare"> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=Th-xmIKcsqc:IRXP6Jhik9s:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/osxdaily?d=yIl2AUoC8zA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=Th-xmIKcsqc:IRXP6Jhik9s:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/osxdaily?i=Th-xmIKcsqc:IRXP6Jhik9s:V_sGLiPBpWU" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=Th-xmIKcsqc:IRXP6Jhik9s:D7DqB2pKExk"><img src="http://feeds.feedburner.com/~ff/osxdaily?i=Th-xmIKcsqc:IRXP6Jhik9s:D7DqB2pKExk" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=Th-xmIKcsqc:IRXP6Jhik9s:7Q72WNTAKBA"><img src="http://feeds.feedburner.com/~ff/osxdaily?d=7Q72WNTAKBA" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/osxdaily?a=Th-xmIKcsqc:IRXP6Jhik9s:qj6IDK7rITs"><img src="http://feeds.feedburner.com/~ff/osxdaily?d=qj6IDK7rITs" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/osxdaily/~4/Th-xmIKcsqc" height="1" width="1"/> View the full article
Recommended Posts