How to remove OSX.Flashback-8?

Question

I have been infected with a OSX.Flashback-8 based on ClamXav. I need help removing it. I am not a Unix user, so I am having trouble finding and removing files from another user account. Please help.
Here is a summary of what has happened in order:
1- Skype would give an error "Skype quit unexpectedly".
2- Then I noticed Office gave the same error.
3- I joined the Skype quit discussion: https://discussions.apple.com/thread/3080937?start=15&tstart=0
4- Disk utility also found and repaired disk permissions. (see more on this on the previous thread)
5- Based on advice I received from folks on that site; I installed ClamXav. (Sophos wasn't finding anything).
6- Then using Terminal I did:
bash-3.2$ ls -a /Users/Shared
.                       .libgmalloc.dylib       SC Info
..                      .localized
.DS_Store               CV-CoverLetter
bash-3.2$ ls -a ~/
.CFUserTextEncoding
.DS_Store
.MacOSX
.Trash
.Xauthority
.anyconnect
.bash_history
.dropbox
.fontconfig
.null
.serverauth.982
.swt
Desktop
Documents
Downloads
Dropbox
...followed-by all my personal folders in this location.
7- I found out "This is almost a sure sign of infection by the Flashback Trojan. "
8- ClamXav found a "heuristics.phishing.email.spoofeddomain" in an 1469.emlx IMAP email account.
9-  Current day:
My problem got worse. I moved /Users/Shared/.libgmalloc.dylib into another directory.
bash-3.2$ cd /Users/Shared
bash-3.2$ mv .libgmalloc.dylib ~/Documents/Quarantine
It locked me and I couldn't do anything else. Got these messages.
dyld: could not load inserted library: /Users/Shared/.libgmalloc.dylib
Trace/BPT trap
bash-3.2$ ls -a /Documents/Quarantine
dyld: could not load inserted library: /Users/Shared/.libgmalloc.dylib
Trace/BPT trap
bash-3.2$ ls -a ~/
dyld: could not load inserted library: /Users/Shared/.libgmalloc.dylib
I tried rebooting. Now I can't even log in anymore. I created another admin account and am trying to change users on Unix shell to log in as the initial user and try to move back the .libgmalloc.dylib.
10- I am running ClamXav on the second admin user account I created. It found: OSX.Flashback-8
Now, I really need help figuring out how to remove this, and access my first admin account.
I am very new to Unix. Have been trying "su username" but it doesn't accept my password. Can you possibly send me a short script to get me to:
1- switch users to the old user account, so I can access the files
2- view and move the .libgmalloc.dylib file into the old location.
3- tell me the way to remove OSX.Flashback-8?
My plan is to log in to the old account, delete all files.
Alternatively, can you tell me how to:
- Remove this user completely.
- OR go back to the original factory settings and start all over.
I am not worried about losing data. All was backed-up.
Please help. I really want to be done with this issue once and for all.
Thanks much

Answer 1

You installed a variant of what’s commonly called the “Flashback” malware, although the name is obsolete.
If you’re certain you know when that happened, and you back up with Time Machine or something similar, you can save yourself a lot of time by restoring your whole system from the most recent snapshot taken before it was infected. Then take Steps 7, 8, and 10 below.
How can you tell when the infection took place? All you can be sure of is that you were infected some time before the problems started. You may have visited a blog that prompted you to install some kind of software, or a “certificate.” If you remember doing that recently, mention it in a reply, but don’t post a link.
If you don’t know when you were infected, there's no easy, reliable way to remove the malware, because it's constantly changing. There are differences of opinion on this site as to the best of course of action, so you should do your own research before deciding how to proceed.
I suggest you take the following steps:
1. Back up all data to at least two different devices, if you haven't already done so.
2. Boot from your recovery partition (if running Mac OS X 10.7 or later) or your installation disc (if running an earlier version of the Mac OS), launch Disk Utility, and erase the startup volume. This action will destroy all data on the volume, so you must be sure of your backups.
3. Install the Mac OS.
4. Reboot and go through the initial setup process to create an account with the same name as your old one. Don’t import anything from your backups at this stage.
5. If running Mac OS X 10.6.x or earlier, run Software Update. You may have to run it more than once to fully update your system.
6. Restore the contents of the top-level subfolders of your home folder except “Library” from the most recent backup. The Library folder may contain components of the malware. It’s best not to restore anything from there. If you must do so, restore only files, not folders, and only if (a) they’re visible in the Finder, and (b) you know what they are, and (c) they haven’t been altered. Don’t restore anything in the home subfolder Library/LaunchAgents, if it exists, or any hidden files or folders, no matter where they are.
7. If you’re running Mac OS X 10.5.8 or earlier, launch Safari and select Safari ▹ Preferences… ▹ Security from the menu bar. Uncheck the box labeled Enable Java. Because of known bugs, Java in those OS versions is unsafe to use on the Internet. (Note: I’m not referring to JavaScript, which is unrelated to Java, despite the similar names.) If you’re running Mac OS 10.6.8 or later, you should still disable the Java web plugin unless you really need it. Few websites have legitimate Java content nowadays. If you encounter one that does, enable Java temporarily.
8. Change every Internet password you have, starting with banking passwords. Check all financial accounts for unauthorized transactions. Take this step only after you’ve secured your system in the preceding steps, not before.
9. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated.
10. If you use any third-party web browsers, disable Java in their preferences. As with step 7, this step is mandatory if you’re running any version of Mac OS X older than 10.6. Otherwise it’s optional, but recommended.