While Macs are known for being very secure, sometimes a bit of malware or the occasional virus slips through the cracks. Recently the virus dubbed “Flashback” was discovered. So far, this virus has infected an estimated 600,000 Mac users. While Apple has released an update patching the security flaw, it may still be lurking on your Mac.
If you’re worried that you may be infected, look no further. In this quick tutorial, we will be showing you how to detect the Flashback virus using a few Terminal commands.
Detecting The Flashback Trojan
1. To start, launch the Terminal application on your Mac. Once it has completely launched, type this command into your terminal window “defaults read /Applications/Safari.app/Contents/Info LSEnvironment“ and press the Return key on your keyboard. If you get this error message back, move onto the next step. This error message should read ”The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist”.
2. Now, type this command into the open Terminal window “defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES“. Your system is clean if you get the following error message back “The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist”.
If your machine is clean, congratulations! Make sure you update your Mac via Software Update to patch the security hole. If you are infected, F-Secure has written an in-depth instructional guide on how to remove it.