I appreciate the input, but if my ISP can detect a device has it, it must be generating a log on the firewall that would identify them, if I only knew what to look for. Remember, these are not devices we own, or lease, or exert any central control over.
Ask your ISP exactly what they detected, then check your logs for the same thing.
I suggest doing some reading on the Flashback malware: what its attack modes are, what the vulnerabilities are, and what the effects are. There are plenty of articles around the web on it, even though some of them have conflicting information (e.g. one says it's only a fake installer, while another says it's a fake installer or a simple drive-by download).
AFAIK, the current attack vector is always a Java vulnerability in a web browser. So that leaves out any iOS device, since they have no Java on them. Also AFAIK, it was an open vulnerability only in Mac OS X Java, so any device with Java but not running Mac OS X is unlikely to be a victim. Furthermore, if Java is disabled in the browser (Safari > Preferences > Security > Eisable Java off) then the attack is completely thwarted, again AFAIK.
NOTE: It's a
Java vulnerability,
not JavaScript. Java is a completely different language and product than JavaScript. Java is to JavaScript as ham is to hamster, i.e. same initial letters, completely different otherwise.
After being infected, the malware contacts some command-and-control servers to obtain additional instructions or code. The researchers who found it also determined what the DNS names of those servers is, and proceeded to register the domains for themselves. So an infected machine is effectively telling the researchers it's infected.
Later, it was found the malware would also use Twitter to search for certain patterns that signalled a command. I don't know how far that research has gone in identifying the patterns.
Apple enlisted the aid of ISPs to identify or shutdown the routing of requests that go to the command-and-control servers. That's probably what your ISP detected: an attempt to contact one of those servers. But exactly which server I don't know. The domain names might be listed in one of the articles describing Flashback, on one of the security sites tracking it. Or it might not.
If your ISP knows what server names it's looking for, then ask them what they are. That seems the easiest approach to me.
The only other approach I can think of is to dig into the articles about exactly what servers the malware is contacting, and ferret out that information yourself.
The above is simply what I've gathered by reading a few articles on Ars Technica, and following a few of their links to the web pages of security firms tracking the malware. I haven't done any significant digging into it, nor ferreting out of server information.
