New To Mac-Forums?

Welcome to our community! Join the discussion today by registering your FREE account. If you have any problems with the registration process, please contact us!

Get your questions answered by community gurus Advice and insight from world-class Apple enthusiasts Exclusive access to members-only contests, giveaways and deals

Join today!

 
Start a Discussion
 

Mac-Forums Brief

Subscribe to Mac-Forums Brief to receive special offers from Mac-Forums partners and sponsors

Join the conversation RSS
OS X - Operating System General OS operation information and support

Flashback.C trojan infected my system - false alarm


Post Reply New Thread Subscribe

 
Thread Tools
Fisico60

 
Member Since: Oct 13, 2011
Posts: 10
Fisico60 is on a distinguished road

Fisico60 is offline
Hello,

the other day, sitting at my Mac, a window popped up asking me to update Adobe Flash Player. I downloaded the file and run the installer, everything was looking like a REAL Flash updater, but.....

Actually it was not a Flash update, it was a trojan horse infecting my Mac. It is called flashback.C and I found good info about it at This Page

1) IMPORTANT Do not update Adobe Flash because of a pop-up window IMPORTANT
2)Does anybody knows a simple disinfection procedure? What is reported in the above page is too technical for me.

Thanks

Fisico60
QUOTE Thanks
gsahli

 
Member Since: Dec 11, 2010
Posts: 1,048
gsahli is a jewel in the roughgsahli is a jewel in the roughgsahli is a jewel in the rough

gsahli is offline
I don't think I could come up with a simpler procedure than what they list. Maybe someone will come up with a corrective script.

What site were you visiting when the popup occurred?
QUOTE Thanks
Fisico60

 
Member Since: Oct 13, 2011
Posts: 10
Fisico60 is on a distinguished road

Fisico60 is offline
Quote:
Originally Posted by gsahli View Post
I don't think I could come up with a simpler procedure than what they list. Maybe someone will come up with a corrective script.

What site were you visiting when the popup occurred?
They are listing a somewhat simpler procedure now, I can try...

It was too late when I realized it, I could not trace it back to the site, sorry.
QUOTE Thanks
harryb2448

 
harryb2448's Avatar
 
Member Since: Nov 28, 2007
Location: Nambucca Heads Australia
Posts: 17,301
harryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond repute
Mac Specs: iMac i5 2.7GHz OS X.9.4 and OS X.10

harryb2448 is offline
OP if you are using Safari, have you deselected the 'Open safe files' option in Safari > Preferences > General?

Hang on to those original install discs like grim death! Using OS X.7 or later make a bootable USB thumb drive before running Installer!
QUOTE Thanks
Fisico60

 
Member Since: Oct 13, 2011
Posts: 10
Fisico60 is on a distinguished road

Fisico60 is offline
Quote:
Originally Posted by harryb2448 View Post
OP if you are using Safari, have you deselected the 'Open safe files' option in Safari > Preferences > General?
I do use Safari as web browser AND that option IS checked
QUOTE Thanks
Fisico60

 
Member Since: Oct 13, 2011
Posts: 10
Fisico60 is on a distinguished road

Fisico60 is offline
It's getting complicated. I need to restore /usr/libexec/XProtectUpdater

I have a Time Machine disk, but how can I restore an invisible file ???????
QUOTE Thanks
harryb2448

 
harryb2448's Avatar
 
Member Since: Nov 28, 2007
Location: Nambucca Heads Australia
Posts: 17,301
harryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond repute
Mac Specs: iMac i5 2.7GHz OS X.9.4 and OS X.10

harryb2448 is offline
Uncheck that option asap!

Hang on to those original install discs like grim death! Using OS X.7 or later make a bootable USB thumb drive before running Installer!
QUOTE Thanks
Fisico60

 
Member Since: Oct 13, 2011
Posts: 10
Fisico60 is on a distinguished road

Fisico60 is offline
Quote:
Originally Posted by harryb2448 View Post
Uncheck that option asap!
Unchecked, now.
QUOTE Thanks
pendlewitch

 
Member Since: Sep 10, 2011
Location: Nelson,UK
Posts: 1,739
pendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of light
Mac Specs: iMac 27" Mid 2010, 3.2GHz Intel Core i3,4GB 1333 MHz DDR3, ATI Radeon HD5670 512MB, Mavericks 10.9.4

pendlewitch is offline
Quote:
Originally Posted by Fisico60 View Post
Hello,

the other day, sitting at my Mac, a window popped up asking me to update Adobe Flash Player. I downloaded the file and run the installer, everything was looking like a REAL Flash updater, but.....

Actually it was not a Flash update, it was a trojan horse infecting my Mac. It is called flashback.C and I found good info about it at This Page

1) IMPORTANT Do not update Adobe Flash because of a pop-up window IMPORTANT
2)Does anybody knows a simple disinfection procedure? What is reported in the above page is too technical for me.

Thanks

Fisico60
Hi, how did you know it was flashback.C ?

iMac 27-inch Mid 2010 (wow....that old...eeeks!), WD My Book 1TB Firewire,WD My Passport Air 500GB, Magic Mouse,Magic Trackpad,
iPhone 5C, iPod Nano 4GB 3rd Gen, ATV2.
MOTM October 2012. These days normally happy with an occasional grumble.
QUOTE Thanks
Fisico60

 
Member Since: Oct 13, 2011
Posts: 10
Fisico60 is on a distinguished road

Fisico60 is offline
Quote:
Originally Posted by pendlewitch View Post
Hi, how did you know it was flashback.C ?
Actually, it was not! Because of your question I started thinking about it and:
1) I checked the date and time of the "suspected" installer file against the latest one from adobe.com and they match
2) flashback.C inserts the following line into: "/Applications/Safari.app/Contents/Info.plist":

<key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key>
<string>/Applications/Safari.app/Contents/Resources/%payload_filename%</string></dict>

So, I tried to remember some unix, opened "terminal" and searched through Info.plist and I did not find any recurrence of "LSE" or "DYLD_INSERT_LIBRARIES"

HAPPILY!
---------------

I am sorry with the community for this false alarm and thankful to pendlewitch for his question.

I just happened to download what now seems a legitimate Flash update, then read the day after about a trojan inserted in a fake Flash update.

Sorry again,

Fisico60
QUOTE Thanks
pendlewitch

 
Member Since: Sep 10, 2011
Location: Nelson,UK
Posts: 1,739
pendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of lightpendlewitch is a glorious beacon of light
Mac Specs: iMac 27" Mid 2010, 3.2GHz Intel Core i3,4GB 1333 MHz DDR3, ATI Radeon HD5670 512MB, Mavericks 10.9.4

pendlewitch is offline
Quote:
Originally Posted by Fisico60 View Post
Actually, it was not! Because of your question I started thinking about it and:
1) I checked the date and time of the "suspected" installer file against the latest one from adobe.com and they match
2) flashback.C inserts the following line into: "/Applications/Safari.app/Contents/Info.plist":

<key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key>
<string>/Applications/Safari.app/Contents/Resources/%payload_filename%</string></dict>

So, I tried to remember some unix, opened "terminal" and searched through Info.plist and I did not find any recurrence of "LSE" or "DYLD_INSERT_LIBRARIES"

HAPPILY!
---------------

I am sorry with the community for this false alarm and thankful to pendlewitch for his question.

I just happened to download what now seems a legitimate Flash update, then read the day after about a trojan inserted in a fake Flash update.

Sorry again,

Fisico60
Not a problem Fisico60, I guess all I wanted was a simple way of finding out as to whether I have it or not, because I too have just done a Flash Player update just like you.
I'm still not sure TBH as to how I can check the preference list because Lion appears to have removed the Library folder from my Home folder and I don't use Terminal.
Perhaps we should only use the Adobe site manually for updates.

iMac 27-inch Mid 2010 (wow....that old...eeeks!), WD My Book 1TB Firewire,WD My Passport Air 500GB, Magic Mouse,Magic Trackpad,
iPhone 5C, iPod Nano 4GB 3rd Gen, ATV2.
MOTM October 2012. These days normally happy with an occasional grumble.
QUOTE Thanks
harryb2448

 
harryb2448's Avatar
 
Member Since: Nov 28, 2007
Location: Nambucca Heads Australia
Posts: 17,301
harryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond reputeharryb2448 has a reputation beyond repute
Mac Specs: iMac i5 2.7GHz OS X.9.4 and OS X.10

harryb2448 is offline
To install the genuine Flashback Player update, it is necessary to download the software from Adiobe. The trojan, from published information, just pops up and requests install with no downloads involved. That would be the key.

Hang on to those original install discs like grim death! Using OS X.7 or later make a bootable USB thumb drive before running Installer!
QUOTE Thanks

Post Reply New Thread Subscribe


« Freezing mice | mac to mac network »
Thread Tools

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off
Forum Jump

Similar Threads
Thread
Thread Starter
Forum
Replies
Last Post
Four Mac OS X upgrades in three years... too much? Murlyn Apple Rumors and Reports 73 01-08-2014 02:18 PM
Car like alarm system for your MacBook iMaciforums OS X - Apps and Games 0 01-16-2007 10:48 PM
Seagate 7200.10 incompatible? Detailed benchmarks! otheronenorehto Apple Desktops 5 01-15-2007 04:38 AM
Version code names? EchoBeach OS X - Operating System 8 10-13-2005 03:00 PM

All times are GMT -4. The time now is 10:16 PM.

Powered by vBulletin
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
X

Welcome to Mac-Forums.com

Create your username to jump into the discussion!

New members like you have made this community the ultimate source for your Mac since 2003!


(4 digit year)

Already a member?