CRON kernel panic?

Question

Level 2

265 points

CRON kernel panic?

OK I got the screen of death and console is giving me this message EVERY second
26/05/2009 11:57:00 com.apple.launchd[1] (0x10d410.cron[246]) Could not setup Mach task special port 9: (os/kern) no access
Does anyone know what this is and is it linked to my kernel panic and can i resolve it
I'm on 10.5.5, 1 GH Powerbook
Peter

G4, Mac OS X (10.5.5)

Posted on May 26, 2009 4:08 AM

Reply

Answer 1

V.K.

Level 9

56,192 points

May 26, 2009 7:27 AM in response to peter stephen

did you set up any cron jobs yourself?
run the following terminal commands

crontab -l

and

sudo crontab -l

you'll have to enter your admin password (which you won't see) after the second command. that's normal. post back the output if it's not empty.

Reply

Answer 2

peter stephen Author

Level 2

265 points

May 26, 2009 12:54 PM in response to V.K.

Thank you for the response
I'm afraid i dont know what a cron job is??? It's the same story with another user but my three other macs dont suffer from this whatever it is.
I'm out of my office at the moment but I'l try those commands
Peter

Reply

Answer 3

May 26, 2009 1:20 PM in response to peter stephen

Did you recently install some sort of MacCinema ?

http://www.f-secure.com/weblog/archives/00001640.html

http://forums.macrumors.com/showthread.php?t=701259

Reply

Answer 4

V.K.

Level 9

56,192 points

May 26, 2009 2:05 PM in response to Alberto Ravasio

it might not be MacCinema but it certainly looks suspicious. there are a few trojans that install crontabs which generate such log entries.

Reply

Answer 5

peter stephen Author

Level 2

265 points

May 26, 2009 2:30 PM in response to Alberto Ravasio

I had MacCinema a long time ago over a year or more but dumped it. I have also seen references to Flash updates being responsible and I do have Flash and also always update my flash player.
I followed the advice in the link you posted to deny access to a range of IP addresses and I'm still getting the console messages.
Peter

Reply

Answer 6

V.K.

Level 9

56,192 points

May 26, 2009 2:41 PM in response to peter stephen

please post the results of the terminal commands I gave you.

Reply

Answer 7

peter stephen Author

Level 2

265 points

May 26, 2009 4:01 PM in response to V.K.

Hi, sorry I've been trawling links to this issue, it seems to be common.
The first command gave me this
crontab -l
crontab: no crontab for fatboy
fatboys-PowerBook:~ fatboy$

second command gave me this
* * * * * "/Library/Internet Plug-Ins/QuickTime.xpt">/dev/null 2>&1
fatboys-PowerBook:~ fatboy$
Thank you for taking the time
peter

Reply

Answer 8

V.K.

Level 9

56,192 points

May 26, 2009 4:25 PM in response to peter stephen

you have a trojan on your computer, probably a DNS changer. usually you get them by installing software from some shady websites.

first run the following terminal command

sudo crontab -r

then go into /Library/Internet Plug-Ins and trash Quicktime.xpt. empty trash and restart. that should do it but you might want to check that your DNS is back to normal. see this links for details on that.
http://www.macworld.com/article/60823/2007/10/trojanhorse.html

Reply

Answer 9

peter stephen Author

Level 2

265 points

May 27, 2009 2:23 AM in response to V.K.

Thanks, I followed your advice and the instructions in that link and it seems to be cured. Very grateful for your time. i have had one other tip seriously advising me to erase and instal my laptop, do you think i need to go this far?
Peter

Reply

Answer 10

peter stephen Author

Level 2

265 points

May 27, 2009 2:26 AM in response to peter stephen

very grateful for the professional advice

Reply