Infected with Flashback: Please Help

Discussion in 'macOS' started by Jeff.N, Apr 9, 2012.

  1. Jeff.N macrumors newbie

    Joined:
    Dec 30, 2006
    #1
    I'm infected with the flashback trojan. It's been at least a couple days. I've been following the instructions at f-secure, but I'm getting stuck at the final steps.

    Here's an outline of what I've done so far:

    I ran:
    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

    And I got:

    Users/myname/Library/Application Support/.AdvancedMpWma.tmp​

    So I followed the f-secure instructions to remove that file, but when I got to step step 14, and entered

    ls -lA ~/Library/LaunchAgents/​
    terminal returned the following, which seemed suspicious:

    -rw-r--r-- 1 root staff 695 10 Feb 16:09 com.divx.agent.postinstall.plist​
    -rw-r--r--@ 1 myname staff 479 28 Mar 15:28 null.plist​

    The instructions at f-secure say not to proceed unless there's only one output, so I decided to come here. I'd be very grateful if anyone can help. FWIW, when I now enter

    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES​

    it returns that it is empty, so I think I've made some progress, but clearly there is still something wrong with my machine. What are the effects of the flashback trojan? Should I be worried about my personal info?
     
  2. Mal macrumors 603

    Mal

    Joined:
    Jan 6, 2002
    Location:
    Orlando
    #2
    What that is telling you is that there are three files in ~/Library/LaunchAgents/. Two seem legitimate (the first two), but I would delete the third. You can simply enter this in Terminal, since you seem comfortable doing so:
    Code:
    rm ~/Library/LaunchAgents/null.plist
    That will delete that file. Again, the first two should not be problems. They were not only placed there before the Flashback trojan was released, but appear to be known sources. If you're still unconvinced, then it won't harm anything to delete them, except something related to MobileMe and the Divx player may need to be set up again (although perhaps not). If you want to save some steps and just delete all three quickly, enter this instead of the command above:
    Code:
    rm ~/Library/LaunchAgents/*
    That will delete all three items in that folder.

    jW
     
  3. Jeff.N thread starter macrumors newbie

    Joined:
    Dec 30, 2006
    #3
    I've deleted everything in the folder. Thanks for your help, Mal.
     
  4. Mal macrumors 603

    Mal

    Joined:
    Jan 6, 2002
    Location:
    Orlando
    #4
    Sure, glad to help!

    jW
     

Share This Page