Computer showing all symptoms of flashback trojan, but none of the removers are working.

aprowell

I've been having trouble with my MacBook Pro for the past few days now. I'll be on Safari, and generally after about 30-45 minutes up to an hour, it will "quit unexpectedly" due to a .NationalBiologicalCorp.png plug-in. I know for a fact that I have the flashback trojan, and everyone gives me the same advice: to come here, use your Flashback removal tool, update my system, and disable Java.

 

The only problem is that I have updated my system with the new Java security update (yet it never told me any malware was removed), I've ran F-Secure's Flashback removal took and every time I do the only thing that pops up is that "the application has exited with a non-zero status", and I've also disabled Java on my computer.

 

I'm running on Mac's OS X system, version 10.6.8.

 

Please help!

blkadd_er

Hi aprowell,

 

Would you be able to provide the log files (RemoveFlashback.log) the removal tool saves to the Desktop after each run?

 

You can just paste them here, or if you want to submit it directly to the Labs, you can do it  via the SAS  and give the case ID number here (note: you'd need to create an account so that the submission would get a case ID) .

Rusli

Hmm... did you try the command base which F-Secure recommended  and type all the command in the terminal???

 

There are alternative methods...

 

Did you try the Dr Web Light for Mac???

 

http://www.freedrweb.com/drweb+mac+light/

 

Download that and do a full scan.

 

 

 

Rusli

Hi

 

Before I proceed further there are infact many variant of Flashback viruses in the wild.

 

 

 

Alot of the Mac OS X users in the forum are using these methods.

 

The one that I was mentioning is the methods stated below which F-Secure instructed to do.

 

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_k.shtml

 

and

 

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

 

And you have to do it via Terminal.

 

The removal too is via this site:-

 

http://www.f-secure.com/weblog/archives/FlashbackRemoval.zip

 

Which F-Secure Weblog stated http://www.f-secure.com/weblog/

 

 

 

 

If you have updated the Java, Apple is using the MRT tool methods to remove the Flashback.

 

http://reviews.cnet.com/8301-13727_7-57413354-263/a-look-at-apples-flashback-removal-tool/?tag=txt;title