Apple Mac Flashback Trojan virus: Checker and Removal

Apple Mac OS which was previously thought to be less prone to Malwares, Trojans, Viruses when compared to Microsoft Windows. But Apple Mac Flashback Trojan virus has alarmed the red lights for Mac user too. Mac Flashback Trojan has been reported to infect a several hundred thousand Mac Computers worldwide and a more widespread outbreak is being feared.

The new Mac Flashback Trojan, that has reportedly infected 600,000 Apple Mac PCs, is written in some unknown language. Flashback virus, unlike the Mac Trojan appeared in year 2011 which required Mac user to type their password at least, is even cunning enough to infect the Apple Mac computers with requiring the password to compromise Mac security.


Apple Mac Flashback Trojan, the original malware last year, for the fact that it was a BackDoor Trojan molded into Flash player given rise to the name FlashBack. Flashback was first discovered in September 2011 by the security firm Intego. Since then over a dozen variants have sprung up. "Flashback.K" or "BackDoor.Flashback.39" the new version of Apple Mac Flashback Trojan virus appears to be present almost everywhere in the world. USA, Australia, Argentina, Brazil, Canada, France, Japan, Italy and Spain are among the countries that have more infected computers. As per Russian computer security firm, "Dr. Web", most of the systems infected with this Trojan are located in the U.S. (56.6%), and others include Canada (19.8%), Britain (12.8%) and Australia (6.1%)

Some Anti-virus websites are offering tools to check and Remove FlashBack Trojan for Mac OS. Apple has released a patch to fix flashback vulnerability and to remove the Apple Mac Flashback Trojan virus.

How does Flashback Trojan Virus infects Apple Mac OS X

The current variants, Apple Mac Flashback Trojan 39, exploit two security vulnerabilities in the Mac OS X Java platform. Apple Mac Flashback Trojan infection is activated by simply visiting a malicious website. Apple Mac Flashback Trojan virus pretends to be an app created by Apple, asks users to enter their administrative password. It even shows a fake Apple certificate. Now if you did not give it your password, Flashback malware is capable of infecting your Mac PC. When a Mac user download install "Java for OS X" (on latest Mac OS X Lion, or otherwise the older OS X versions like Snow Leopard came pre-installed with java). The java program, normally harmless, allows web browsers like Safari to run more sophisticated codes/programs, this also allowed Mac Flashback Trojan to perform sophisticated attacks on Macs as well.

Symptoms and Actions of Apple Mac Flashback Trojan virus

Apple Mac Flashback Trojan, originally distributed with Flash Player Installer was intended to hijack the traffic from search and direct Internet users to its own server, full of advertisements and promotion. Apple Mac Flashback virus snips your passwords and personal data. It also steals your Google searches data, visits to their banking sites and so on. Mac machines infected with Flashback Trojan may makeup a botnet network that can be accessed by Flashback backdoor server to organize DDoS-attacks or send spam. Mac Flashback Trojan may cause the stable applications like Safari browser to crash often once after infection.

Apple Mac Flashback Trojan Virus Checker

Dr. Web, who originally reported the number of Mac users infected with the virus, has an Online Apple Mac Flashback Trojan Virus Checker tool to scan your Mac for Flashback variants. Flashback Checker is another program by GitHub to check for the Flashback. Here are the instructions of how to manually check your Apple Mac for Flashback Trojan virus:

1. First, open Terminal from your Utilities folder.
2. Run the following command in Terminal:
   defaults read /Applications/Safari.app/Contents/Info LSEnvironment
3. Take note of the value, DYLD_INSERT_LIBRARIES
4. Proceed to next check if you got the following error message:
   The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist

If you are unable to get the above stated error message, your Apple Mac is infected with Flashback Trojan. If you get the above does not exist message, perform this second check to make sure you really don't have Flashback Trojan on your Mac:

1. Run the following command in Terminal:
   defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
2. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:
   The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist

How to Remove Apple Mac Flashback Trojan Virus

If your Mac appears to be infected with BackDoor.Flashback.39, be calm and use If you use the anti-virus program VirusBarrier, it should be able to check and remove the Trojan horse. There is also a very effective Apple Mac Flashback Trojan Virus Removal Guide provided by the Finnish security company F-Secure.