Non-Apple Software No Longer Works

The instructions I gave above are the only way to remove the malware with complete certainty of success. If you want a shortcut, you can just delete the items ~/.MacOSX, ~/Library/LaunchAgents, and /Users/Shared/.libgmalloc.dylib, then log out and log back in. That procedure may inactivate some variants the malware, but I don't know that it will. That's wouldn't be good enough for me, if I were in your place, so it's not good enough for me to advise others to do. I don't believe in shortcuts when it comes to security.

There are a couple of new developments since I last posted to this thread. First, Apple has announced that it's developing a tool to remove Flashback:

About Flashback malware

There's no indication of when this tool will be released. Second, a well-known developer, Kaspersky, has released its own "Flashfake Removal Tool:"

Virus-fighting utilities

I have no way of testing that tool, but I did read the code, and it seems to me more likely to work than any other such attempt that I've seen. It's not a scam, and it doesn't do anything harmful.

Finally, there are reports that the only function of the malware is to engage in "click fraud," which is not critically damaging to the host system. I can't verify those reports.

In the light of that information, one might reasonably choose to try the Kaspersky tool (not the commercial Kaspersky product, which I don't recommend) and see whether there's any improvement.

In that case, you should go ahead with the original plan. Here's a revised version of step 6:

Restore the contents of the top-level subfolders of your home folder except “Library” from the most recent backup. The Library folder may contain components of the malware. This is where restoring becomes difficult, and I can only give general guidelines.

Of the top-level subfolders of Library that are visible in the Finder, I think it’s safe to restore the following, which contain most of the data you’d want to keep:

Audio

Calendars

ColorSync

Colors

Favorites

FontCollections

Fonts

Images

Keychains

Mail (except Mail/Bundles)

Safari (except Safari/Extensions)

The following are not safe to restore, at least not in full:

Application Support

Internet Plug-Ins

LaunchAgents

Preferences

If you have Time Machine snapshots of these folders that you’re sure are older than the infection, you can restore from one of those snapshots.

Folders not mentioned above may or may not be safe. If in doubt, don’t restore them. Don’t restore any hidden files or folders, no matter where they are. Hidden files should be considered suspicious.

Linc Davis wrote:

a well-known developer, Kaspersky, has released its own "Flashfake Removal Tool:"

Virus-fighting utilities

I have no way of testing that tool, but I did read the code, and it seems to me more likely to work than any other such attempt that I've seen. It's not a scam, and it doesn't do anything harmful.

I also read through the code as I was asked if it scans all users, and agree that it does not appear to do anything harmful. I even ran the script (but not the entire app) with expected results. Told me "No infection has been detected." but did not tell me to reboot?

Finally, there are reports that the only function of the malware is to engage in "click fraud," which is not critically damaging to the host system. I can't verify those reports.

I listed to this Shawn King interview with Rich Mogull (wrote MacWorld & TidBITS articles on the subject) and agreed with everything said, except how easy it is to remove (Just a couple of lines of Terminal code). Rich mentioned that he had been informed of an instance of fraudulant credit card activity immediately after he was infected.

That's the only case I have heard of. Intego seems convinced that information is being harvested and Tweeted out, but I haven't seen any confirmation of that in this Forum (unless it's the root cause of the iTunes store issues). There are many reports of being re-directed to advertising sites, but I can't imagine that would raise enough money to make their effort worthwhile.

Just a comment that it sounds to me as if you have a ~/.MacOSX/environment.plist in the original user account that needs to be removed. Kaspersky must have gotten the dylib and missed the trigger. If so, that's fixable.

Should I eject the hard drive used by Time Machine before proceeding?

That's not necessary. Just make sure you don't erase it by mistake.

Based on the OP's experience, I will no longer suggest the Kaspersky tool. It's just another fail.

According to f-secure, the Flashback trojan checks for older versions of Office and deletes itself without infection if it detects any of them (unless you gave it your admin password). This check may have been a new addition to avoid the problems mentioned in this thread. Not helpful information for anyone who's Mac is infected but I thought I'd mention it. The link below is an interesting read on the installation process of Flashback, if you are interested in that kind of thing.

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

You only need the drive to restore. You can detach it until you're ready to do that.