Remove Flashback

Rusli · April 2012

See the link for methods below:-

http://community.f-secure.com/t5/Protection/Flashback-Mac-OS-X-Remover/td-p/10887

http://reviews.cnet.com/8301-13727_7-57410096-263/how-to-remove-the-flashback-malware-from-os-x/?tag=txt;title

Rusli · April 2012

Flashback K and I

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_k.shtml

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

Flashback A,B, C ...

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_a.shtml

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_b.shtml

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_c.shtml

fsecurerdr · April 2012

There are files in some variants not mentioned in the removal procedures. One version is placing a Launchagent called com.adobe.reader.plist in the user's Launchagents folder and an executable in the home folder called .rserv (~/.rserv). Users should check all Launchagent .plist files in ~/Library/Launchagents to see what executable they launch and also check activity monitor to see if any processes start with a dot e.g .rserv and quit those processes.

Is it possible for someone to clarify what each variant is doing and what suspicious behaviour to be on the lookout for?