after all the media coverage of the recent flashback malware on os x, apple released another java update yesterday that includes a “removal tool.”

there wasn’t much mention of what the removal tool does in the release notes. how do you use it? what does it do?

on two test machines, running 10.6.8 and 10.7.3, respectively, i installed the latest java update. the receipts db shows that a pkg with id com.apple.pkg.JavaSecurity was installed. checking the flat package contents, it’s part of the payload.

here’s what’s installed:

great. let’s check out /usr/libexec/MRT to see what that does. hey, it’s not there… i checked the paths specified in the payload, but none of it was to be found.

hmmm…

both test machines showed the same behavior: installed the pkg but left no trace of the binaries.

the launchagent installed calls the MRTAgent.app under CoreServices.

similarly, the launchdaemon calls /usr/libexec/MRT.

the pkg postflight looks sort of crude:

so it unloads, then loads the launchd jobs. fine so far, i guess.

a very unscientific scan through the MRT binary with strings provides some idea of what it’s looking for, at least. it has some reference to at least two variants of flashback; appears to check safari, chrome, and firefox (but not other browsers); and looks through system and user homedirs.

since it apparently removed itself on my systems, i rsynced the files into place, reloaded the daemon and agent, and tried manually running MRT. as soon as i did that, all the components were gone. so this is the intended behavior?

i’m guessing that on infected machines, it will do some type of removal before removing these components. it seems that apple assumes you’ve installed the java update, so the vulnerability is fixed, and there’s no need for the removal tools any more.

if that’s the case, apple should clarify this is the intended behavior in the release notes. i know some people have been looking to this update to provide some type of useful malware removal and prevention utility, which doesn’t appear to be the case.

am i missing something here? have any of you seen different results?