Somewhere around 600,000 Mac users have this Trojan written in an unknown language. It gets on your OSX without a password.

What it does (per F-secure):

“Trojan-Downloader:OSX/Flashback.I connects to a remote site to download its payload; on successful infection, the malware modifies targeted webpages displayed in the web browser.”

How to discover if it’s there and disinfect (per F-Secure):

Manual Removal

Caution: Manual disinfection is a risky process; it is recommended only for advanced users. Otherwise, please seek professional technical assistance.

Manual Removal Instructions

• 1. Run the following command in Terminal:
  defaults read /Applications/Safari.app/Contents/Info LSEnvironment
• 2. Take note of the value, DYLD_INSERT_LIBRARIES
• 3. Proceed to step 8 if you got the following error message:
  "The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"
• 4. Otherwise, run the following command in Terminal:
  grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step2%
• 5. Take note of the value after "__ldpath__"
• 6. Run the following commands in Terminal (first make sure there is only one entry, from step 2):
  sudo defaults delete /Applications/Safari.app/Contents/Info LSEnvironment
  sudo chmod 644 /Applications/Safari.app/Contents/Info.plist
• 7. Delete the files obtained in steps 2 and 5
• 8. Run the following command in Terminal:
  defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
• 9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:
  "The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"
• 10. Otherwise, run the following command in Terminal:
  grep -a -o '__ldpath__[ -~]*' %path_obtained_in_step9%
• 11. Take note of the value after "__ldpath__"
• 12. Run the following commands in Terminal:
  defaults delete ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
  launchctl unsetenv DYLD_INSERT_LIBRARIES
• 13. Finally, delete the files obtained in steps 9 and 11.

Now, there are some variants of this Trojan, and some have additional components. The disinfect method is detailed here:  http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_k.shtml

Hope none of our Mac users are affected by this Trojan… but if you are, F-Secure has the steps described above and the additional steps as above. You can find them and the links to the additional steps here:

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml