Flashback Trojan - I still think I have it.

Question

I realised I had the flashback trojan today as when I right-clicked the desktop, some numbers came up instead of the actual options (like N169.3 or something) and so I set off to try and remove it myself. And I am really bad at this stuff.
I managed to delete the enivronment.plist file (or at least I believe I did), and after restarting my computer the numbers went away and when I right-clicked it was normal. However, I was still feeling uneasy about it, so I went to terminal and typed in ls /Users/Shared.*.so and /Users/Shared.MailWashervXX.so came up.
I'm supposing that's a bad thing and I don't really know what to do now. Help?

Answer 1

Probably is.  I don't recognize the name.  But you deleted the environment.plist so it cannot be tracked back for sure.
One thing about anything in /Users/Shared though.  If something is there torjan or valid app put it there.  And it won't be too serious if you delete it.  A valid app (properly written) will put it back if it needs it.  Otherwise, who cares.  Just trash it.
As for whehter you extracted all of the trojan code or not, well, here's a quote of the current recommendations on how to handle this (which I am quoting from other posts on this subject):
Courtesy of Linc Davis:
You installed a variant of what’s commonly called the “Flashback” malware, although the name is obsolete.
If you’re absolutely sure you know when that happened, and you back up with Time Machine or something similar, you can save yourself a lot of time by restoring your whole system from the most recent snapshot taken before it was infected. Then take Steps 7, 8, and 10 below.
How can you tell when the infection took place? All you can be sure of is that you were infected some time before the problems started. You may have visited a blog that prompted you to install some kind of software, or a “certificate.” If you remember doing that recently, mention it in a reply, but don’t post a link.
If you don’t know when you were infected, there's no easy, reliable way to remove the malware, because it's constantly changing. I suggest you take the following steps immediately:
1. Back up all data to at least two different devices, if you haven't already done so.
2. Boot from your recovery partition (if running Mac OS X 10.7 or later) or your installation disc (if running an earlier version of the Mac OS), launch Disk Utility, and erase the startup drive. This action will destroy all data on the drive, so you must be sure of your backups.
3. Install the Mac OS.
4. Reboot and go through the initial setup process to create an account with the same name as your old one. Don’t import anything from your backups at this stage.
5. If running Mac OS X 10.6.x or earlier, run Software Update. You may have to run it more than once to fully update your system.
6. Restore the contents of the top-level subfolders of your home folder except “Library” from the most recent backup. The Library folder may contain components of the malware. It’s best not to restore anything from there. If you must do so, restore only files, not folders, and only if they’re visible in the Finder, and then only if you’re absolutely sure you know what they are and they haven’t been altered. Don’t restore anything in the home subfolder Library/LaunchAgents, if it exists, or any hidden files or folders, no matter where they are.
7. Launch Safari and select Safari ▹ Preferences… ▹ Security from the menu bar. Uncheck the box labeled Enable Java. Because of recurring security issues, the Java web plugin must be considered unsafe to use. (Note: I’m not referring to JavaScript, which is unrelated to Java, despite the similar names.) Very few websites have legitimate Java content nowadays. If you encounter one that does, and you think you can trust it, enable Java temporarily. Do this only if you know how to check for a malware infection immediately afterwards. If you’re not sure whether you know how to check, you don’t know how. Don’t rely on any kind of “anti-virus” software for protection.
8. Change every Internet password you have, starting with banking passwords. Check all financial accounts for unauthorized transactions. Take this step only after you’ve secured your system in the preceding steps, not before.
9. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated.
10. If you use any third-party web browsers, disable Java in their preferences, as you did with Safari in step 7.
More information about Flashback can be found by searching this site, or the Web.