Flashfake Removal Tool and online-checking site<p> After intercepting one of the domain names used by the Flashback/Flashfake Mac Trojan and setting up a special sinkhole server last Friday, we managed to gather stats on the scale and geographic distribution of the related botnet. We published information on this in our <a href=http://www.securelist.com/en/blog/208193441/Flashfake_Mac_OS_X_botnet_confirmed>previous blog</a> entry.</p> <p> We continued to intercept domain names after setting up the sinkhole server and we are currently still monitoring how big the botnet is. We have now recorded a total of 670,000 unique bots. Over the weekend (7-8 April) we saw a significant fall in the number of connected bots: </p> <p class=c><img src="images/pictures/klblog/208193455.png" border="1" alt="" title=""></p> <p> This doesn’t mean, however, that the botnet is shrinking rapidly - these are merely the numbers for the weekend. </p> <p> Over the last few days our server has registered all the data sent by bots from the infected computers and recorded their UUIDs in a dedicated database. Based on this information we have set up an online resource where all users of Mac OS X can check if their computer has been infected by Flashback.</p> <p> To find out if your computer is infected and what to do if it is, visit: <a href=http://flashbackcheck.com>flashbackcheck.com</a></p> <p> Also users can check if they’re infected with Flashfake by using Kaspersky Lab’s <a href=http://support.kaspersky.com/downloads/utils/flashfake_removal_tool.zip>free removal tool</a>. <p class=c><img src="images/pictures/klblog/208193458.png" border="1" alt="" title=""></p>
Source:
Flashfake Removal Tool and online-checking site
