Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.apps > #9072

Re: Flashback Infection Mechanism?

Show all headers | View raw

On Sat, 07 Apr 2012 17:20:37 +0000, Patty Winter wrote:

> f I understand the situation correctly, in order to suspect that their
> computer has been compromised, someone would have to either remember
> seeing a request for an admin password at an unexpected time or have
> seen a news article about the malware.
> 
> Then to actually check for an infection, they would have to run the
> suggested command-line arguments in Terminal--which is going to flummox
> many people right there.
> 
> The screen shots that have been posted on tech websites will help people
> turn off Java to prevent future infections, but there could be plenty of
> people with infected computers now who don't realize it, right?

Since the virus makes contact with an outside site, something like Little 
Snitch sounds appropriate.  Though if you already have Little Snitch, 
Xcode or certain other products installed, the virus *in its present 
form* will delete itself:

<http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml>

--- start quote ---
nstallation

On execution, the malware checks if the following path exists in the 
system:

    /Library/Little Snitch
    /Developer/Applications/Xcode.app/Contents/MacOS/Xcode
    /Applications/VirusBarrier X6.app
    /Applications/iAntiVirus/iAntiVirus.app
    /Applications/avast!.app
    /Applications/ClamXav.app
    /Applications/HTTPScoop.app
    /Applications/Packet Peeper.app

If any of these are found, the malware will skip the rest of its routine 
and proceed to delete itself.

--- end quote ---

-- 
Paul Sture

Back to comp.sys.mac.apps | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Flashback Infection Mechanism? Fred Moore <fmoore@gcfn.org> - 2012-04-06 12:16 -0400
  Re: Flashback Infection Mechanism? dempson@actrix.gen.nz (David Empson) - 2012-04-07 12:28 +1200
    Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-06 18:54 -0700
      Re: Flashback Infection Mechanism? Ant <ant@zimage.comANT> - 2012-04-07 09:51 -0700
        Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 10:00 -0700
          Re: Flashback Infection Mechanism? *Hemidactylus* <ecphoric@hotmail.com> - 2012-04-07 23:47 -0400
    Re: Flashback Infection Mechanism? dorayme <dorayme@optusnet.com.au> - 2012-04-07 12:39 +1000
    Re: Flashback Infection Mechanism? Patty Winter <patty1@wintertime.com> - 2012-04-07 17:03 +0000
      Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 10:06 -0700
        Re: Flashback Infection Mechanism? Patty Winter <patty1@wintertime.com> - 2012-04-07 17:20 +0000
          Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 10:30 -0700
            Re: Flashback Infection Mechanism? Patty Winter <patty1@wintertime.com> - 2012-04-07 17:37 +0000
              Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 10:46 -0700
                Re: Flashback Infection Mechanism? Patty Winter <patty1@wintertime.com> - 2012-04-07 18:02 +0000
                Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 17:38 -0700
                Re: Flashback Infection Mechanism? Paul Sture <paul@sture.ch> - 2012-04-08 13:30 +0200
                Re: Flashback Infection Mechanism? Paul Sture <paul@sture.ch> - 2012-04-08 13:25 +0200
              Re: Flashback Infection Mechanism? *Hemidactylus* <ecphoric@hotmail.com> - 2012-04-08 00:02 -0400
            Re: Flashback Infection Mechanism? Fred Moore <fmoore@gcfn.org> - 2012-04-08 13:06 -0400
              Re: Flashback Infection Mechanism? Jolly Roger <jollyroger@pobox.com> - 2012-04-08 10:54 -0700
              Re: Flashback Infection Mechanism? Patty Winter <patty1@wintertime.com> - 2012-04-08 23:50 +0000
                Re: Flashback Infection Mechanism? dempson@actrix.gen.nz (David Empson) - 2012-04-09 14:08 +1200
          Re: Flashback Infection Mechanism? Barry Margolin <barmar@alum.mit.edu> - 2012-04-07 13:58 -0400
          Re: Flashback Infection Mechanism? Paul Sture <paul@sture.ch> - 2012-04-08 13:22 +0200
      Re: Flashback Infection Mechanism? *Hemidactylus* <ecphoric@hotmail.com> - 2012-04-07 23:48 -0400

csiph-web