I updated Java, but I do I know that I'm flashback free?

New one, maybe.

https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X_Backdoor_Java_Explo its_Targeted_Attacks_and_Possible_APT_link

That page includes:

We detect the Java exploit used in the dropper as Exploit.Java.CVE-2012-0507.bf.

That looks like the same Java vulnerability that Flashback-K used and that Apple has now patched, so at least there shouldn't be many new infections.

WZZZ wrote:

New one, maybe.

https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X_Backdoor_Java_Explo its_Targeted_Attacks_and_Possible_APT_link

FUD. Old one. MS Word exploit patched in June 2009.

http://www.zdnet.com/blog/security/new-version-of-mac-os-x-trojan-exploits-word- not-java/11566

The first part no longer applies. Updating or uninstalling Java will not do you any good. Instead, you’ll need to update Microsoft Office 2004 for Mac and Microsoft Office 2008 for Mac. Thankfully, this security vulnerability is from June 2009, so if you keep your Microsoft software patched, you should be good to go. The last parts still apply.

No can do. Microsoft dropped support for Office 2004 a few months ago. One just needs to be careful opening any Word docs from an untrusted or unfamiliar source.

With all the caveats and limitations inherent in any AV, I am getting closer by the day to running Sophos with scanning always on. At least, just to see if at first it slows things down or is disruptive.

WZZZ wrote:

With all the caveats and limitations inherent in any AV, I am getting closer by the day to running Sophos with scanning always on. At least, just to see if at first it slows things down or is disruptive.

It is so shocking to hear that from you that I think I'm going to faint! 😁

But please don't tell anyone. This will be so embarrassing if it gets out. Actually, I've never been one of the knee jerk anti-AVers. Just wary.