2 Replies Latest reply: Jul 22, 2012 1:50 PM by MadMacs0
kvellon Level 1 Level 1 (0 points)

My safari has been crashing non stop for the past couple of days. When I click on the safari icon it goes to my homepage like normal but after about 10 seconds it quits and a box comes up telling me the safari quit unexpectedly. At first it said that the problem may have been caused by the .SecurityAdministratorv.tmp plug-in. But now it went back to saying that it just quit unexpectedly. HELP!!!

MacBook, Mac OS X (10.5.8)
  • Linc Davis Level 10 Level 10 (177,805 points)

    You’ve been infected with the “Flashback” malware. See this Apple support document:


    Flashback Removal Security Update


    Back up all data, if you haven't already done so.


    Select Software Update to install the Flashback malware removal tool, as well as any other available updates. Installing that item should clear the infection in most cases. You must update to OS X 10.5.8 before you can install the removal tool.


    The removal tool runs automatically in the background and is then deleted. Don’t look for something to click. If the malware is removed, you’ll be notified.


    After you’ve secured your system — not before — change every Internet password you have, starting with banking passwords, and check all financial accounts for unauthorized transactions.


    The update will disable Java (not JavaScript) in all your web browsers. Leave it disabled as long as you're running 10.5. Your version of Java has bugs that make it unsafe to use on the Internet, and those bugs will probably never be fixed.


    If the update fails to remove the malware, you may be able to clear it by running the removal tool developed by a third party:


    Flashback Removal Tool - F-Secure

  • MadMacs0 Level 5 Level 5 (4,680 points)

    kvellon wrote:


    My safari has been crashing non stop for the past couple of days. ...At first it said that the problem may have been caused by the .SecurityAdministratorv.tmp plug-in.

    I'm sure I'm too late to obtain a sample of that file, but I would like to ask you some questions about your setup to try and determine how this could have happend.


    There haven't been any new infections of Flashback for several weeks now, so I'm wondering if the malware developers have something new out there or if this is some sort of isolated instance.


    Was your OS X 10.5.8 fully up-to-date at the time this started (i.e. Software Update said there was nothing to install).  In particular, had you installed Flashback Removal Security Update and Leopard Security Update 2012-003? If you don't know or don't recall whether Software Update installed them or not you can check by Selecting  -> System Preferences -> Software Update -> Installed Updates to see if they are listed. If you installed them manually, you should be able to find them listed in /Library/Receipts/boms.


    Did you have Java (not JavaScript) disabled in Safari Preferences -> Security?


    Do you recall seeing something like this New Flashback Variant... or to approve a certificate like this Flashback Mac Trojan Horse...?


    And just to confirm, the crashing only started around July 20?