ClioSport.net

Register a free account today to become a member!
Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox!

  • When you purchase through links on our site, we may earn an affiliate commission. Read more here.

Mac Trojan/virus



dk

  911 GTS Cab
gaming_apple.jpg
© Apple


Apple Mac computers worldwide have been infected with the Flashback Trojan.

Russian anti-virus vendor Dr Web has warned that up to 600,000 machines have been hit by the malware, leaving them at risk of being used as a 'botnet'.

The creators of the Flashback Trojan exploited weaknesses in Java code to enable the rogue software to install itself on computers without permission. It then sends out a message to the hacker granting them access to the system's contents.

More than half of the infected Macs are thought to be US-based, with 274 located in Apple's home city of Cupertino, California.

Java developer Oracle released a patch earlier this year to correct the vulnerability issue, but the update was not compatible with Apple machines.

Apple released its own security update this week to protect users against the malware. It can be downloaded by selecting 'software update' under system preferences.

Internet security firm F-Secure has provided instructions explaining how to test whether a machine is infected, and remove the malware manually.

Just checked mine using the f-secure method and I don't have it, have updated my software though, was a java update.
 

dk

  911 GTS Cab
Open terminal and paste

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

Then enter

Then

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

Then enter

If both come back as Does not exist, you are ok.
 
  Megane 225 F1
Sweet. Noting here.


I swear my mum told me she saw this on the news a few months back.
 

seb

ClioSport Club Member
  Clio trophy
Open terminal and paste

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

Then enter

Then

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

Then enter

If both come back as Does not exist, you are ok.


Cheers David.

All clear my end!
 
  Clio 172
Thats because Apple manage their own updates of Java products rather than Oracle doing it - Apple's fault.

I'm clean :) and literally just did the update.
 

dk

  911 GTS Cab
If anyone has it on here i'll eat my own head.

Now that id pay to see :)

we could do a PPV youtube event or something? let me know what you think. I think id even be willing to seek out the virus to see if i could get it ;)
 
  Clio 182
I can't even work out how to check, but on reading this bit I think I'd best not even try!
Caution: Manual disinfection is a risky process; it is recommended only for advanced users. Otherwise, please seek professional technical assistance.
 

Tom

ClioSport Club Member
  EV (s)
Now that id pay to see :)

we could do a PPV youtube event or something? let me know what you think. I think id even be willing to seek out the virus to see if i could get it ;)

Sure, go for it..
 

ChrisR

ClioSport Club Member
Funny reading how the malware works, if you've got MS Office installed and you're not dumb enough to just stick your admin password in when asked willy nilly you're actually in a safer place than if you don't have Office installed, makes a change :p

The malware checks for certain office versions and if present it skips the rest of it's stuff and deletes anything it's stuck on the machine already.

Pretty neat though if it can still infect a machine when you don't stick your credentials in, most Mac malware in the past has relied on that to work.
 

dk

  911 GTS Cab
ah cool, wonder why the mac product is free, the windows product isn't, we sell it at work, and we use it at work. not sure whether i want to slow my machine down though with this, its not like there are many outbreaks on mac, although its only going to get more common as the user base grows.
 

Tom

ClioSport Club Member
  EV (s)
Probably building a userbase, if/when it becomes more widespread. Then move to charging.
 
I think it's also kinda 'sold' as stopping you from passing on Windows threats. You can harbour a Windows virus without it affecting your system.
 
  S3, Polo
I used DK's technique for identifying an infection mentioned on the first page and got 'does not exist' on both counts.

Just installed the latest software update from Apple and it identified and removed Flashback from my system. Oh.

What could it have done?
 


Top