Flashback malware on Snow Leopard
My Mac OSX Snow Leopard got exploited by the Flashback malware. There's a summary by F-Secure that I'm trying to follow in order to remove it. This link is similar, and provides a little more detail.
The first step is to type the following:
bash-3.2$ defaults read /Applications/Safari.app/Contents/Info LSEnvironment
{
"DYLD_INSERT_LIBRARIES" = "/Applications/Safari.app/Contents/Resources/.NeroLite \[email protected]";
}
This shows the malware. The next step is to do the following:
bash-3.2$ grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLite \[email protected]
grep: /Applications/Safari.app/Contents/Resources/.NeroLite: No such file or directory
grep: [email protected]: No such file or directory
As you can see the file path includes .NeroLite \[email protected]
and the space backslash combination has got me confused, and the system can't find the file. Anyone how I can locate this file? What is the \022@
trying to do? How to complete the next step?
UPDATE1
I've tried the following:
bash-3.2$ grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLite\ \\[email protected]
grep: /Applications/Safari.app/Contents/Resources/.NeroLite \[email protected]: No such file or directory
bash-3.2$ grep -a -o '__ldpath__[ -~]*' "/Applications/Safari.app/Contents/Resources/.NeroLite \[email protected]"
grep: /Applications/Safari.app/Contents/Resources/.NeroLite \[email protected]: No such file or directory
bash-3.2$ ls /Applications/Safari.app/Contents/Resources/.Nero*
ls: /Applications/Safari.app/Contents/Resources/.Nero*: No such file or directory
bash-3.2$ grep -a -o '__ldpath__[ -~]*' /Applications/Safari.app/Contents/Resources/.NeroLit*
grep: /Applications/Safari.app/Contents/Resources/.NeroLit*: No such file or directory
UPDATE2
I executed the following commands:
# sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment
# sudo chmod 644 /Applications/Safari.app/Contents/Info.plist
# defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
2012-04-01 21:42:40.706 defaults[891:903]
The domain/default pair of (/Users/myuser/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist
Which is good, according to the first link above.
THEN I REBOOTED THE SYSTEM. However, when I then try to start Safari, it won't start, but instead gives me the same old error:
Safari cannot be opened because of a problem.
Process: Safari [882]
Path: /Applications/Safari.app/Contents/MacOS/Safari
Identifier: com.apple.Safari
Version: ??? (???)
Build Info: WebBrowser-75345503~2
Code Type: X86-64 (Native)
Parent Process: launchd [110]
Date/Time: 2012-04-01 21:41:24.286 -0700
OS Version: Mac OS X 10.6.8 (10K549)
Report Version: 6
Interval Since Last Report: 501264 sec
Crashes Since Last Report: 11
Per-App Crashes Since Last Report: 11
Anonymous UUID: <removed>
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000002, 0x0000000000000000
Crashed Thread: 0
Dyld Error Message:
could not load inserted library: /Applications/Safari.app/Contents/Resources/.NeroLite @.xsl
Binary Images:
0x7fff5fc00000 - 0x7fff5fc3bdef dyld 132.1 (???) <removed> /usr/lib/dyld
<...lists installed hardware...>
The safest way to ensure removal of live malware is to (re)boot from external media and to then re-install the OS and all your apps and executables.