Forums
New posts
Articles
Product Reviews
Policies
FAQ
Log in
Register
What's new
Search
Search
Search titles only
By:
New posts
Menu
Log in
Register
Install the app
Install
Forums
Apple Computing Products:
macOS - Operating System
Flashback.C trojan infected my system - false alarm
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Reply to thread
Message
<blockquote data-quote="Fisico60" data-source="post: 1317434" data-attributes="member: 218115"><p><img src="/mac_images/images/smilies/Oops.png" class="smilie" loading="lazy" alt=":Oops:" title="Oops :Oops:" data-shortname=":Oops:" /> Actually, it was not! Because of your question I started thinking about it and:</p><p>1) I checked the date and time of the "suspected" installer file against the latest one from adobe.com and they match</p><p>2) flashback.C inserts the following line into: "/Applications/Safari.app/Contents/Info.plist":</p><p></p><p><key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key></p><p><string>/Applications/Safari.app/Contents/Resources/%payload_filename%</string></dict></p><p></p><p>So, I tried to remember some unix, opened "terminal" and searched through Info.plist and I did not find any recurrence of "LSE" or "DYLD_INSERT_LIBRARIES"</p><p></p><p>HAPPILY!</p><p>---------------</p><p></p><p>I am sorry with the community for this false alarm and thankful to pendlewitch for his question.</p><p></p><p>I just happened to download what now seems a legitimate Flash update, then read the day after about a trojan inserted in a fake Flash update.</p><p></p><p>Sorry again,</p><p></p><p>Fisico60</p></blockquote><p></p>
[QUOTE="Fisico60, post: 1317434, member: 218115"] :Oops: Actually, it was not! Because of your question I started thinking about it and: 1) I checked the date and time of the "suspected" installer file against the latest one from adobe.com and they match 2) flashback.C inserts the following line into: "/Applications/Safari.app/Contents/Info.plist": <key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key> <string>/Applications/Safari.app/Contents/Resources/%payload_filename%</string></dict> So, I tried to remember some unix, opened "terminal" and searched through Info.plist and I did not find any recurrence of "LSE" or "DYLD_INSERT_LIBRARIES" HAPPILY! --------------- I am sorry with the community for this false alarm and thankful to pendlewitch for his question. I just happened to download what now seems a legitimate Flash update, then read the day after about a trojan inserted in a fake Flash update. Sorry again, Fisico60 [/QUOTE]
Verification
Post reply
Forums
Apple Computing Products:
macOS - Operating System
Flashback.C trojan infected my system - false alarm
Top