For the convenience of forum members who may be unfamiliar/uncomfortable with the terminal, I've written a simple Flashback trojan detector. Launch Script Editor (in the AppleScript folder in Applications), copy/paste this code into the window, and press run. This is nothing more than a detector; it won't resolve any problems. No warranties, use at your own risk, yada, yada.

set checkOne to offset of "LSEnvironment" in (read file ((path to applications folder from system domain as string) & "Safari.app:Contents:Info.plist")

try
	set checkTwo to offset of "DYLD_INSERT_LIBRARIES" in read file ((path to home folder as string) & ".MacOSX:environment.plist"
on error
	set checkTwo to 0
end try

if checkOne is 0 and checkTwo is 0 then
	display dialog "No trojan detected."
else
	display dialog "You in danger, girl."
end if

Both of the stupid smilies should be close parentheses... )

---

Le poète doit vivre beaucoup, vivre dans tous les sens. - Verlaine



Edited 1 time(s). Last edit at 04/09/2012 10:47AM by Marc Anthony.

I saved the Script on Dropbox

[dl.dropbox.com]

Quote
Marc Anthony
For the convenience of forum members who may be unfamiliar/uncomfortable with the terminal, I've written a simple Flashback trojan detector. Launch Script Editor (in the AppleScript folder in Applications), copy/paste this code into the window, and press run. This is nothing more than a detector; it won't resolve any problems. No warranties, use at your own risk, yada, yada.

set checkOne to offset of "LSEnvironment" in (read file ((path to applications folder from system domain as string) & "Safari.app:Contents:Info.plist" ))

try
	set checkTwo to offset of "DYLD_INSERT_LIBRARIES" in read file ((path to home folder as string) & ".MacOSX:environment.plist" )
on error
	set checkTwo to 0
end try

if checkOne is 0 and checkTwo is 0 then
	display dialog "No trojan detected."
else
	display dialog "You in danger, girl."
end if

Both of the stupid smilies should be close parentheses... )

what smilies?

Missing the check for users of Firefox that one of the original postings of the commands included. Same would need to be done for most other browsers except Chrome. As the Trojan can be specific to a single user account, if there are more than one user account used on a Mac all need to be checked.

Quote
space-time
what smilies?

But won't adding those spaces mess up the script? Just checking you did it right before I run the script you put on drop-box.

I don't think those extra spaces have any effect on the script. I first run it in the original form (no extra space, that's what I put in the dropbox), then I added the extra spaces and it run the same way.

... And, there's an app for that: [arstechnica.com]

if checkOne is 0 and checkTwo is 0 then
	display dialog "No trojan detected."
else
	display dialog "You in danger, girl."
end if

strictly speaking, if no Trojan is detected, then the Girl is in danger.

Quote
space-time

if checkOne is 0 and checkTwo is 0 then
	display dialog "No trojan detected."
else
	display dialog "You in danger, girl."
end if

strictly speaking, if no Trojan is detected, then the Girl is in danger.

And the Boy, once the Dad finds out.

LOL! Thanks!

Quote
mikebw

Quote
space-time

if checkOne is 0 and checkTwo is 0 then
	display dialog "No trojan detected."
else
	display dialog "You in danger, girl."
end if

strictly speaking, if no Trojan is detected, then the Girl is in danger.

And the Boy, once the Dad finds out.

Seriously, reading this script I'm laughing and kicking myself and angry at the technology journalism community covering Flashback. This script (or one like it) is what should be posted on all those websites talking about what to do in the terminal, with the instructions to open AppleScript Editor, paste this, and run.

g=

Is the script in the original post above safe to use?

Quote
h linamen
Is the script in the original post above safe to use?

only if you can deal with Dad

of course it is safe, why would you think otherwise?

All the above script does is read a couple files (which may not even exist unless you have the trojan) and display a dialog. About as harmless as they can get...

Now, if you've got the trojan and dad catches you trying to use it, that might be unsafe!
g=