A few questions to end my flashback confusion...

Question

Does the Java update for 10.6.8 give you a dialog box saying it found malware or is that only for Lion (the support article doesn't say)? If so, would the dialog box close automatically and I missed it? When I did the update, it all went by so quickly I don't remember being notified of any malware found. Interestingly, Sophos AV found Flash Player installer (flashback trojan) on my mac in Downloads and cleaned it up after I did the Java update. Also, I have Little Snitch installed, but rarely have it running. Would the malware have deleted itself simply because I had Little Snitch installed?

Answer 1

dreamtiger wrote:
Does the Java update for 10.6.8 give you a dialog box saying it found malware or is that only for Lion (the support article doesn't say)? If so, would the dialog box close automatically and I missed it? When I did the update, it all went by so quickly I don't remember being notified of any malware found.
According to this document from Apple, it does give you a dialog and I've never seen them close automatically, so I doubt that it could have.
Java
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7.3, OS X Lion Server v10.7.3
Impact:  A Flashback malware removal tool will be run
Description:  This update runs a malware removal tool that will
remove the most common variants of the Flashback malware. If the
Flashback malware is found, it presents a dialog notifying the user
that malware was removed. There is no indication to the user if
malware is not found.
Interestingly, Sophos AV found Flash Player installer (flashback trojan) on my mac in Downloads and cleaned it up after I did the Java update.
That was one of the earlier variants, probably from last year, so I'll take your report as a data point. Note that Apple claims to "remove the most common variants" but doesn't say which ones.
Also, I have Little Snitch installed, but rarely have it running. Would the malware have deleted itself simply because I had Little Snitch installed?
It would depend on the variant. According to F-Secure's description of the "i" variant
On execution, the malware checks if the following path exists in the system:
/Library/Little Snitch...
which says to me that it does not need to be running, however that's not the variant we've been dealing with over the last two weeks which is described in this document http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_k.shtml and doesn't mention anything about it. In fact, the first sign of this "K" variant came from Little Snitch (LS) users who were alerted to a strange hidden process in their home folder attempting to contact several gibberish sites. Clearly this new variant's first stage was not checking for LS at all. By using LS to deny access to what we eventually found out was 50-60 Flashback Command & Control Servers, those users were never fully infected. I don't really know whether the final installation stages of this variant check for LS or not, but suspect it does. Most of the media stories on the current threat are mistakenly based on the "i" variant, so don't take them as gospel.