Digital Hero

Click on the Apple logo in the top left corner of your Mac, then click "Software Update" and the process will look like this:

Then you'll see:

Click on "Show Details" and you'll get this:

Click "Install X Items" (you may have 1, 2, or more items to install). Let the process run:

Once the update has been installed (note that your Mac may or may not need to reboot, depending upon what other updates you have in the list) you'll see something like this:

Step #2a: Disable Java in Safari:

Start Safari, click on "Safari", then "Preferences", then "Security" to get here and UNCHECK "Enable Java":

Step #2b: Disable Java in Firefox:

Start Firefox, click on "Tools", then "Add-ons", then "Plugins" and in the list you are looking for this (the version number may be different):

Over on the right side of this Plugin bar click "Disable" to change it to this:

***WARNING*** I'm going to walk you through entering commands into the Terminal program that directly and immediately affects your Mac's operating system. Entering the wrong command may damage your Mac. I have already run these commands on my Macs, but if you don't feel comfortable proceeding, contact your I.T. guy or gal and have them do this for you.

Click on Spotlight (the magnifying glass in the top right corner of your Mac) and type "terminal". In the search results under "Applications", click "Terminal". I'll show you the command that you can copy then paste into Terminal, the screen capture of each step and its result before proceeding to the next step... there are only three items to check:

The first command to copy is:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

The images below will extend into the sidebar to the right so they occupy the maximum width making them easier to see.

Paste that into Terminal so it looks like this (the name of your account and your Mac will appear where my name is):

Press the RETURN key.
GOOD: If you get "does not exist" as the result then the infection has NOT happened through Safari.
BAD: If instead of "does not exist" you get a path to the malware file, then your Mac IS infected through Safari.

Proceed by copying the second command into Terminal:

defaults read /Applications/Firefox.app/Contents/Info LSEnvironment

Press the RETURN key.
GOOD: If you get "does not exist" as the result then the infection has NOT happened through Firefox.
BAD: If instead of "does not exist" you get a path to the malware file, then your Mac IS infected through Firefox.

Proceed by copying the final command into Terminal:

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

Press the RETURN key.
GOOD: If you get "does not exist" as the result AND you got that for the previous 2 results, then your Mac is NOT infected.
BAD: If any one of the 3 results returned a path to the malware, then your Mac IS infected.

In Terminal, type "exit" and press RETURN, then quit the Terminal program:

Get yourself into some Mac anti-virus software since now that Flashback has proven Macs CAN be infected, you know there's going to be more of this in the future. Here are a couple of my favourites: Kaspersky and Intego's Virus Barrier family of products.

Once you have your anti-virus software installed let it do a full scan of your Mac... this will take time... be patient and let it finish.

At the time of publishing this blog item, there are no automatic removal tools available, so...

***WARNING*** Use the following manual removal steps at your own risk. If you don't feel comfortable proceeding, contact your I.T. guy or gal and have them do this for you.

The organization F-Secure has developed a manual method for removing Flashback which I'm also posting as a PDF if you'd like to download and print to make it easier to follow the steps:

OSX-Flashback-Removal.pdf

Once you've got your Mac cleaned up, I'd strongly recommend getting an anti-virus progarm for it... see Step #4, above.