Flashback Trojan on Mac OSX

Apple makes some marvelous products. In this case, I’m talking about Apple Remote Desktop. With ARD I was able to scan every single one of my client Macs to check to see if any of them were infected with the Flashback Trojan Horse. Before my scan I would have sworn on whatever-you-like that none of my systems that I manage here at WMU were infected. Turns out I was right.

Macs really aren’t susceptible to viruses and the biggest threat comes from Trojan Horses. To scan a mac for infection you just open up Terminal and run these two commands:

  • defaults read /Applications/Safari.app/Contents/Info LSEnvironment
  • defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

If you get an error from both of those commands, you are in the clear. It’s quite easy to do, mostly just opening up Terminal and copying and pasting and getting the errors and being satisfied. The removal instructions are straightforward to follow, so even removal of an active infection should be a snap.

If you try these commands and don’t get errors, don’t panic. Just let me know and I’ll find a way to help you out.