How does it get installed?

Flash is most commonly used to view online video such as YouTube, and play some online games. Flashback pretends to be the latest version of Adobe Flash, and prompts the user to install it, and many users just go ahead and type their administrator password. Once you’ve provided your password, the fake version of Flash uses a Java security hole to install the actual Trojan.

How do I know if I have it?

There are a couple of ways to check for infection. In fact you can use the Terminal app (/Applications/Utilities/) to check with just a few lines of code.

Launch Terminal and enter the following:
(Copy and past the following code into terminal and hit enter)

If receive a message like “The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist” Then proceed to:

If you see “The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist”, then the Mac is NOT infected.

If you receive a different message other than “does not exist”, you’re more than likely infected. If you don’t feel comfortable running lines of code in terminal, or don’t know how, you’re in luck. PixelCreek can provide these services for you, no appointment necessary. If you’d like to go it alone there are also a few anti-virus programs that may be able to find and remove Flashback.

Am I still vulnerable?

Apple has pushed several updates to fix the Java vulnerability that allows Flashback to install itself, as well as remove the most basic variations of the Trojan (So, if you are a 10.6 or 10.7 user and you’ve stayed up to date you’re fine). Anyone using 10.5 OS or below is no longer supported by Apple. In order to further protect yourself you can disable Java in your web browser. If you’re on an older operating system (10.5 or below) I would also recommend disabling Flash and Java altogether to prevent future infection.

If you have confirmed signs of the Trojan on your Mac or think you might have been infected, give us a call or send us an e-mail at: info@pixelcreek.com and we’ll help you get on your way.

While other shops have to send your computer away for repair, PixelCreek performs the majority of Apple repairs right here at our South Bend facility. If a unit requires shipment to Apple, PixelCreek will work hard to get the quickest turnaround possible.