How to be sure you do not have the "Flashback Trojan"

root's picture

As you may already know, there was some crappy Trojan circling around, named Flashback Trojan. I am not getting too much into this, if you want more information just follow that link.

In this aticle I will just show you how to check if you have it or not. So, open the terminal and run the commands below (what is written in green):

MacBook-Pro:~ florian$ [color=green]defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES[/color]
2012-04-13 12:54:59.597 defaults[19850:707] 
The domain/default pair of (/Users/florian/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist
MacBook-Pro:~ florian$ [color=green]defaults read /Applications/Safari.app/Contents/Info LSEnvironment[/color]
2012-04-13 12:54:51.447 defaults[19841:707] 
The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist
MacBook-Pro:~ florian$ [color=green]defaults read /Applications/Firefox.app/Contents/Info LSEnvironment[/color]
2012-04-13 13:09:30.227 defaults[20814:707] 
The domain/default pair of (/Applications/Firefox.app/Contents/Info, LSEnvironment) does not exist

If your applications are in different places, you can search for them, using find or mdfind. By the way, mdfind is using spotlight and it's insanely faster.

MacBook-Pro:~ florian$ mdfind -onlyin / ' (kMDItemCFBundleIdentifier == "com.apple.Safari") || (kMDItemCFBundleIdentifier == "com.google.Chrome") || (kMDItemCFBundleIdentifier == "org.mozilla.firefox") '
/Applications/Internet/Firefox.app
/Applications/Google Chrome.app
/Applications/Safari.app
MacBook-Pro:~ florian$ find / -xdev \( -iname "google chrome.app" -o -iname "safari.app" -o -iname "firefox.app" \) -print 2>/dev/null
/Applications/Google Chrome.app
/Applications/Internet/Firefox.app
/Applications/Safari.app

IF you get for all the output similar like on the examples above (with "does not exists"), you are ok.
If not, please read now to get rid of it here.

Thou shalt not steal!

If you want to use this information on your own website, please remember: by doing copy/paste entirely it is always stealing and you should be ashamed of yourself! Have at least the decency to create your own text and comments and run the commands on your own servers and provide your output, not what I did!

Or at least link back to this website.

Recent content