FlashBack Checker

[Dan Millar]

Hey Guys and Gals,

It's here. it's real, and I'm not gonna say I told you so.

Use this tool first to see if you've been compromised:

https://github.com/jils/FlashbackChecker/downloads

If your test comes back clear, you're like 99% of us - no infection.

If you're running 10.6 or 10.7, immediately check for software updates via the -menu/Software Updates mechanism. Apple has patched the vulnerability and you will have nothing to worry about - for now.

If you're running 10.5.x or less, turn Java off in your Safari preferences - it's under the security tab.

If your test comes back positive, i.e. you're infected, try Intego's free AV software download/trial, it apparently has the smarts to remove the nasty bits causing the problem. You can get Intego's software here:

http://www.intego.com/virusbarrier

At this point, it appears that Intego, F-Secure and ClamXav all have the ability to block this trojan/virus if they're kept up to date.

I recommend you do NOT use the virus checker that Kaspersky Labs has posted, the one that asks you to enter your UUID. This confidential info is being collected in an insecure manner - just use the checker given above.

I still highly recommend ClamXav, it's free, it works, and it has the definitions to stop this virus in it's tracks, though it cannot remove it. The process to manually remove this virus involves a complete scrub of your hard disk, and either a restore from backup or completely new installation of the OS, etc. - not too horrible if you use Time Machine and all your stuff is backed up, otherwise it's a very Windows-like experience for Mac users, i.e. no fun at all. Check out the Intego website if you suspect that your machine needs "scrubbing", and you don't want to go through the nightmare of rebuilding your system and data.

Good luck and...

Happy, Healthy Mac'ing!

Dan

[GNV]

Thanks for the help.  Very reassuring!

[Dan Millar]

Hey Mac Gang,

Apple has released a "fix" for Flashback infections, and here's a link to the description if you haven't seen it elsewhere:

http://support.apple.com/kb/HT5242

This patch is available via Software Update, and only applicable to OS X 10.7 Lion - for everyone else, both F-Secure and Kaspersky have also released "scrubbers" that will remove Flashback if it is detected on your machine. Here are those links:

Flashflake tool from Kaspersky: https://www.securelist.com/en/blog/208193454/Flashfake_Removal_Tool_and_online_checking_site

F-Secure Flashback removal tool: http://www.f-secure.com/weblog/archives/00002346.html

I sincerely hope no one needs to use these tools - any infections out there? I think the "600,00" macs, plus "287 in Cupertino" is hyperbole at best... I personaly haven't heard of a single instance in the wild, bit I stand to be corrected!

Happy Mac'ing!

Dan

[ben schmidt]

Apple's detection & zremoval Tool:
http://support.apple.com/kb/HT5246

Commentary:
http://arstechnica.com/apple/news/2012/04/apple-updates-java-for-a-third-time-this-time-with-flashback-malware-removal.ars

http://www.cultofmac.com/160766/apple-releases-new-flashback-trojan-removal-tool-for-lion-users-without-java/

http://arstechnica.com/apple/news/2012/04/flashback-malware-removal-tool-for-java-less-mac-users.ars