Mac IT Support Desk

Flashback Malware Removal

Doug Tomlinson Apr 05 • Tips & Tricks

We are writing this KB article due to the recent breakout of the Flashback Malware on nearly 600,000 Macs.

Manual removal is possible by carefully following the instructions below.  If you are not familiar and comfortable with Terminal and the command line, we would suggest that you contact us or another trained professional for help in removing the malware from your computer.

Here are the instructions for manual removal as posted by F-Secure:

 

Disinfection

Manual Removal

Caution: Manual disinfection is a risky process; it is recommended only for advanced users. Otherwise, please seek professional technical assistance. F-Secure customers may also contact our Support.


Manual Removal Instructions

  • 1. Run the following command in Terminal: 

    defaults read /Applications/Safari.app/Contents/Info LSEnvironment 

  • 2. Take note of the value, DYLD_INSERT_LIBRARIES
  • 3. Proceed to step 8 if you got the following error message:

    "The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist" 

  • 4. Otherwise, run the following command in Terminal: 

    grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step2% 

  • 5. Take note of the value after "__ldpath__"
  • 6. Run the following commands in Terminal (first make sure there is only one entry, from step 2): 

    sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment 

    sudo chmod 644 /Applications/Safari.app/Contents/Info.plist 

  • 7. Delete the files obtained in steps 2 and 5
  • 8. Run the following command in Terminal: 

    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES 

  • 9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following: 

    "The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist" 

  • 10. Otherwise, run the following command in Terminal: 

    grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step9% 

  • 11. Take note of the value after "__ldpath__"
  • 12. Run the following commands in Terminal: 

    defaults delete ~/.MacOSX/environment DYLD_INSERT_LIBRARIES 

    launchctl unsetenv DYLD_INSERT_LIBRARIES 

  • 13. Finally, delete the files obtained in steps 9 and 11.

Note:

Some Flashback variants include additional components, which require additional steps to remove. Please refer to ourTrojan-Downloader:OSX/Flashback.K description for additional information and removal instructions.

10.6.8 Printer Issues

Doug Tomlinson June 28, 2011 • Tips & Tricks

After OS X 10.6.8 was released last Thursday, a number of people found that their printers were no longer printing, where the system would show the printers in a paused state and no print jobs would work. This problem seems to behave differently for different setups, but overall appears to be a bug with how CUPS handles its backend processes.

The back end in the CUPS system is the interface for various transmission protocols for both networking and direct connections to the printer. While some people may benefit from the aforementioned fixes of running general maintenance, resetting the print system, and reapplying the latest "Combo" updater, it appears a true workaround until Apple addresses the problem is to replace the transmission protocol file you are using with the one from OS X 10.6.7.

In order to do this, you will need your Time Machine backups or another Mac running OS X 10.6.7 and then run the following procedure:

Go to Folder

Use the Finder's "Go to Folder" option to open the hidden "backend" folder

  1. In the Finder's "Go" menu select "Go to Folder"

  2. Type "/usr/libexec/cups/backend" in the field and press enter to go to the hidden "backend" folder.

  3. Open the "Console" utility to see what backend file is being used. When your print job fails you should see a message similar to the following (in this case it is the "lpd" backend):

    printer-state-message="/usr/libexec/cups/backend/lpd failed

  4. In the Finder with the "backend" folder window open, invoke Time Machine and then go back to before you updated OS X (sometime on June 23 should work) and restore the file, replacing the one in the "backend" folder. If you do not have Time Machine, you can copy the file from the same location on another Mac.

  5. Close the Finder window and then perform a Permissions Fix on the boot drive using Disk Utility.

  6. Go to the "Print & Fax" system preferences, right-click the printer list and reset the print system, and then set up your printers again.


Ratings & Reviews on Apple's Consultants Locator Site

Doug Tomlinson May 12, 2011 • Announcements

Hello Friends of Mac IT Solutions,

First, I want to thank you for your business.  Because of you, we have continued to grow even during some difficult times for small business.  In an effort of continued growth I ask that you please read on...I rarely (if ever) ask for anything like this from our customers, but this is VERY important to us!!

Apple has just implemented a "Ratings & Reviews" section on the Consultants Locator page of their site just like the rest of Apple's site (iTunes, etc). This is a long awaited feature that we are very excited about but we need your help!!!  

Given that customer service has always been our highest priority, it is very important that this new "ratings and reviews" feature reflect that for new customers that are searching for our services.

Please, please, please take 5 minutes from your busy day and visit consultants.apple.com (our page) and submit a review.  This only requires an Apple ID to write a review (as you would use for iTunes, your iPad, or iPhone) so most everyone should already have one...if not, signing up for one only takes a moment.  The whole process works just like leaving a review for an iPhone app or iTunes song.

To write a review on Apple's website for Mac IT Solutions, please browse to:  http://macit.co/lICLn2 and click on the Write a Review button.  

We feel that it is important to give details as to your type of business (if applicable) and/or how Mac IT Solutions has helped you, either in the past or how we continue to help you every day!

If for some reason the previous link doesn't work, go to http://consultants.apple.com and search by your zip code.  You should see Mac IT Solutions and be able to click on "Write a Review" from there.  Just a quick note...anyone can leave a review.  If you work for someone else, you can still leave a review based on the service you experienced.  (ie: 10 people from ABC Company can all leave individual reviews)

Thank you SO much in advance for taking time to submit a review to ensure that Mac IT Solutions stands out on Apple's Consultant Locator page.

Again, thank you!!!

Doug Tomlinson
Mac IT Solutions


Mac IT Solutions Helpdesk is Online!

Doug Tomlinson March 22, 2011 • Announcements

We're pleased to announce our new helpdesk.  Customers may support service requests by clicking Submit a Request at the top of this page or by emailing support@macitsolutions.com

Thanks,

Mac IT Solutions