How do I tell if I have it?
Right now the easiest way to tell if your computer has been infected is to run some commands in Terminal, a piece of software you’ll find in the Utilities folder in your Mac’s Applications folder. If you want to find it without digging, just do a Spotlight search for “Terminal.”
Once there, copy and paste each one of the code strings below into the terminal window. The command will run automatically:
defaults read /Applications/Safari.app/Contents/Info LSEnvironment
defaults read /Applications/Firefox.app/Contents/Info LSEnvironment
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
If your system is clean, the commands will tell you that those domain/default pairs “does not exist.” If you’re infected, it will spit up the patch for where that malware has installed itself on your system.
Read the CNET blog post in full:
“Mac Flashback malware: What it is and how to get rid of it (FAQ)” by Josh Lowensohn, Staff Writer (@Josh), CNET News Apple Talk, Thursday, April 5th, 2012