English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Flashfake Removal Tool and online-checking site

Aleks
Kaspersky Lab Expert
Posted April 09, 22:08  GMT
Tags: Botnets, Apple, Flashfake
0.8
 

After intercepting one of the domain names used by the Flashback/Flashfake Mac Trojan and setting up a special sinkhole server last Friday, we managed to gather stats on the scale and geographic distribution of the related botnet. We published information on this in our previous blog entry.

We continued to intercept domain names after setting up the sinkhole server and we are currently still monitoring how big the botnet is. We have now recorded a total of 670,000 unique bots. Over the weekend (7-8 April) we saw a significant fall in the number of connected bots:

This doesn’t mean, however, that the botnet is shrinking rapidly – these are merely the numbers for the weekend.

Over the last few days our server has registered all the data sent by bots from the infected computers and recorded their UUIDs in a dedicated database. Based on this information we have set up an online resource where all users of Mac OS X can check if their computer has been infected by Flashback.

To find out if your computer is infected and what to do if it is, visit: flashbackcheck.com

Also users can check if they’re infected with Flashfake by using Kaspersky Lab’s free removal tool.


2 comments

Al Varnell

2012 Apr 12, 02:12
0
 

Kaspersky Lab Removal Tool Fails

Please see this discussion where the user was locked out of his account after running the tool https://discussions.apple.com/message/18102609#18102609 . I believe the tool may fail to fix ~/.MacOSX/environment.plist, when present, to remove the DYLD_INSERT_LIBRARIES entry.

If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog