Could not setup Mach task special port 9: (os/kern) no access

Question

Could not setup Mach task special port 9: (os/kern) no access

I'm getting a LOT of these messages in my Console log. Anyone know what they mean and if they are of concern and I should do something?

7/26/09 10:39:00 AM com.apple.launchd[1] (0x10bb20.cron[19450]) Could not setup Mach task special port 9: (os/kern) no access

Thanks,
Steven

Mac Pro 2 x 3.0 GHz Quad-Core, 4GB RAM, Mac OS X (10.5.7), 30" HP LP3065 Monitor & 22" Cinema Display

Posted on Jul 26, 2009 11:10 AM

Reply

Answer 1

Aug 4, 2009 9:43 AM in response to V.K.

is this what you are looking for?

* */5 * * * "/Library/Internet Plug-Ins/AdobeFlash" vx 1>/dev/null 2>&1
steven-shmerlers-mac-pro:~ shmerls$

I saw this in one of the posts as being the problem I think?

Reply

Answer 2

V.K.

Level 9

56,186 points

Aug 4, 2009 9:55 AM in response to Steven Shmerler

yes, that's what we are looking for. this is highly suspect and does look like a trojan (masquerading as a flash plugin) as i said. first delete the cron job. run

sudo crontab -r

next, go to /Library/Internet plugins and delete that AdobeFlash thing.

also, since we don't know what this trojan does I would check your DNS server as described on this page
http://www.macworld.com/article/60823/2007/10/trojanhorse.html

when you are done deleting that stuff restart the computer. you should be clean after that.

Reply

Answer 3

Aug 4, 2009 10:59 AM in response to V.K.

Ok... using Terminal I entered your code and my pw. didn't get any feedback that antyhing happened, but when I tried to run it again I got: crontab:

no crontab for root

Assume, I got it right the first time?

Went to library/Internet Plugins folder, did search

Name Contains= AdobeFlash
File visibility= visible or invisible

but no file shows. Even if I click "This Mac" instead of "Internet Plug-ins" I don't see the file

But here's what's visible just opening the folder:

AdobePDFViewer.plugin
QuickTime Plugin.plugin
JavaPluginCocoa.bundle
Flash Player.plugin
nsIQTScriptablePlugin.xpt
flashplayer.xpt
eMusicRemote.plugin
Mozillaplug.plugin
RealPlayer Plugin.plugin
Flip4Mac WMV Plugin.webplugin
Flip4Mac WMV Plugin.plugin
QuickTime Plugin.webplugin
Quartz Composer.webplugin
VerifiedDownloadPlugin.plugin
iPhotoPhotocast.plugin
NP-PPC-Dir-Shockwave
NPSVG3Carbon
NPSVG3.zip
NPSVG3ReadMe.html

Do I have the wrong name?

Reply

Answer 4

Aug 4, 2009 11:20 AM in response to Steven Shmerler

When I opened my Sys prefs > Networks I got:

http://www.sasnet.com/files/newinterfacedetected.jpg

and then when I followed the directions in your link to go to the DNS tab the left entry was grayed out and there is a right box which the article doesn't discuss with the entry: rr.com, also grayed out:

http://www.sasnet.com/files/searchdomains.jpg

Also, I ran MacScan yesterday twice and found no trojans and ClamXav the other day and didn't find any.

Am I getting closer?

Reply

Answer 5

V.K.

Level 9

56,186 points

Aug 4, 2009 12:05 PM in response to Steven Shmerler

Steven Shmerler wrote:
Ok... using Terminal I entered your code and my pw. didn't get any feedback that antyhing happened, but when I tried to run it again I got: crontab:

no crontab for root

Assume, I got it right the first time?

yes.

Went to library/Internet Plugins folder, did search

Name Contains= AdobeFlash
File visibility= visible or invisible

but no file shows. Even if I click "This Mac" instead of "Internet Plug-ins" I don't see the file

most likely that file was removed when you ran Mac scan the very first time.
I think you are fine now. when you looking for your DNS make sure you select your internet connection in the left tab first. it looks to be ethernet 2. then you'll see your current IP address and the DNS address in the DNS pane should be very similar to it.

But here's what's visible just opening the folder:

AdobePDFViewer.plugin
QuickTime Plugin.plugin
JavaPluginCocoa.bundle
Flash Player.plugin
nsIQTScriptablePlugin.xpt
flashplayer.xpt
eMusicRemote.plugin
Mozillaplug.plugin
RealPlayer Plugin.plugin
Flip4Mac WMV Plugin.webplugin
Flip4Mac WMV Plugin.plugin
QuickTime Plugin.webplugin
Quartz Composer.webplugin
VerifiedDownloadPlugin.plugin
iPhotoPhotocast.plugin
NP-PPC-Dir-Shockwave
NPSVG3Carbon
NPSVG3.zip
NPSVG3ReadMe.html

Do I have the wrong name?

Reply

Answer 6

Aug 4, 2009 9:50 PM in response to V.K.

Hopefully we haven't relaxed too soon. Is this another one? It seems associated with Adobe Reader:

8/4/09 8:40:54 PM [0x0-0x20020].com.apple.systemuiserver[231] Opening Database
8/4/09 8:40:54 PM SystemUIServer[231] Normally QDMenuExtra would not have been loaded as a Menu Extra.
8/4/09 8:41:27 PM kernel WLC E_COUNTRY_CODECHANGED
8/4/09 8:41:27 PM kernel en2: 802.11d country code set to 'US'.
8/4/09 8:41:27 PM kernel en2: Supported channels 1 2 3 4 5 6 7 8 9 10 11 5 6 7 8 9 10 11 1 2 3 4 5 6 7 36 40 44 48 52 56 60 64 149 153 157 161 165 40 48 56 64 153 161 36 44 52 60 149 157
8/4/09 8:51:30 PM kernel REPORT_KEY failed : SENSE_KEY = 0x05, ASC = 0x6f, ASCQ = 0x01
8/4/09 8:52:17 PM kernel REPORT_KEY failed : SENSE_KEY = 0x05, ASC = 0x6f, ASCQ = 0x01
8/4/09 8:54:01 PM com.apple.launchd[164] (0x10c9d0.Locum[426]) Exited: Terminated
8/4/09 8:55:07 PM com.apple.launchd[164] (0x10d1c0.Locum[444]) Exited: Terminated
8/4/09 9:00:24 PM kernel SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x03, ASC = 0x11, ASCQ = 0x00
8/4/09 9:00:24 PM kernel SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x03, ASC = 0x11, ASCQ = 0x00
8/4/09 9:00:25 PM kernel SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x03, ASC = 0x11, ASCQ = 0x00
8/4/09 9:00:26 PM kernel SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x03, ASC = 0x11, ASCQ = 0x00
8/4/09 9:00:26 PM kernel SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x03, ASC = 0x11, ASCQ = 0x00
8/4/09 9:00:27 PM kernel SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x03, ASC = 0x11, ASCQ = 0x00
8/4/09 9:01:40 PM [0x0-0x2a02a].org.mozilla.firefox[459] Debugger() was called!
8/4/09 9:02:10 PM [0x0-0x2a02a].org.mozilla.firefox[459] Debugger() was called!
8/4/09 9:06:23 PM kernel REPORT_KEY failed : SENSE_KEY = 0x05, ASC = 0x6f, ASCQ = 0x01

8/4/09 9:14:16 PM AdobeReader[722] Error loading /Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM: dlopen(/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM, 262): no suitable image found. Did find:
/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM: unknown file type, first eight bytes: 0x4A 0x6F 0x79 0x21 0x70 0x65 0x66 0x66

8/4/09 9:14:16 PM AdobeReader[722] Cannot find function pointer MyCMPluginFactory for factory EB982613-2188-11D6-BE4F-000A27E36620 in CFBundle/CFPlugIn 0x15bccab0 </Library/Contextual Menu Items/DocumentsToGoXCM.plugin> (not loaded)

8/4/09 9:14:16 PM AdobeReader[722] Error loading /Library/Contextual Menu Items/GrabNGo.plugin/Contents/MacOS/GrabNGo: dlopen(/Library/Contextual Menu Items/GrabNGo.plugin/Contents/MacOS/GrabNGo, 262): no suitable image found. Did find:
/Library/Contextual Menu Items/GrabNGo.plugin/Contents/MacOS/GrabNGo: mach-o, but wrong architecture

8/4/09 9:14:16 PM AdobeReader[722] Cannot find function pointer GrabNGoFactory for factory 3487BB5A-3E66-11D5-A64E-003065B300BC in CFBundle/CFPlugIn 0x18a1c0 </Library/Contextual Menu Items/GrabNGo.plugin> (bundle, not loaded)

8/4/09 9:14:32 PM kernel USBF: 2093.933 [0x6df0800] The IOUSBFamily is having trouble enumerating a USB device that has been plugged in. It will keep retrying. (Port 1 of hub @ location: 0x3d200000)

8/4/09 9:14:35 PM kernel USBF: 2097.637 [0x6df0800] The IOUSBFamily was not able to enumerate a device.

8/4/09 9:14:36 PM kernel USBF: 2098.476 [0x6df0800] The IOUSBFamily is having trouble enumerating a USB device that has been plugged in. It will keep retrying. (Port 1 of hub @ location: 0x3d200000)

8/4/09 9:14:41 PM kernel USBF: 2103.379 [0x6df0800] The IOUSBFamily was not able to enumerate a device.

8/4/09 9:14:42 PM kernel USBF: 2104.236 [0x6df0800] The IOUSBFamily is having trouble enumerating a USB device that has been plugged in. It will keep retrying. (Port 1 of hub @ location: 0x3d200000)
8/4/09 9:14:48 PM kernel USBF: 2110.339 [0x6df0800] The IOUSBFamily was not able to enumerate a device.
---

These last two keep repeating every couple minutes 😟

Reply

Answer 7

V.K.

Level 9

56,186 points

Aug 5, 2009 6:04 AM in response to Steven Shmerler

I can't make much of anything out of these messages but they don't look like trojans to me.

Reply

Answer 8

Aug 5, 2009 6:34 AM in response to Steven Shmerler

These all appear to me to be fairly normal log entries.

Steven Shmerler wrote:
Hopefully we haven't relaxed too soon. Is this another one? It seems associated with Adobe Reader:

8/4/09 8:40:54 PM [0x0-0x20020].com.apple.systemuiserver[231] Opening Database
8/4/09 8:40:54 PM SystemUIServer[231] Normally QDMenuExtra would not have been loaded as a Menu Extra.

Just a notification about a menu extra that's loading in the menu bar on the right side of the screen.

8/4/09 8:41:27 PM kernel WLC E_COUNTRY_CODECHANGED
8/4/09 8:41:27 PM kernel en2: 802.11d country code set to 'US'.
8/4/09 8:41:27 PM kernel en2: Supported channels 1 2 3 4 5 6 7 8 9 10 11 5 6 7 8 9 10 11 1 2 3 4 5 6 7 36 40 44 48 52 56 60 64 149 153 157 161 165 40 48 56 64 153 161 36 44 52 60 149 157

Informational messages about the wireless interface.

8/4/09 8:51:30 PM kernel REPORT_KEY failed : SENSE_KEY = 0x05, ASC = 0x6f, ASCQ = 0x01

This and the similar ones below it are from a CD that has errors.

8/4/09 8:54:01 PM com.apple.launchd[164] (0x10c9d0.Locum[426]) Exited: Terminated
8/4/09 8:55:07 PM com.apple.launchd[164] (0x10d1c0.Locum[444]) Exited: Terminated

Not sure what this is, but I see it often enough that I think it's harmless.

8/4/09 9:01:40 PM [0x0-0x2a02a].org.mozilla.firefox[459] Debugger() was called!
8/4/09 9:02:10 PM [0x0-0x2a02a].org.mozilla.firefox[459] Debugger() was called!

Just some kind of debugging code left in Firefox. Probably as they were writing it they wanted to see if something got called, so they put in a debug statement that prints to the log. It got left in for some reason in the release version.

8/4/09 9:14:16 PM AdobeReader[722] Error loading /Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM: dlopen(/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM, 262): no suitable image found. Did find:
/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM: unknown file type, first eight bytes: 0x4A 0x6F 0x79 0x21 0x70 0x65 0x66 0x66

It's just a guess, but I suspect that this might be a PowerPC plugin that Reader is trying to load. What do you get for the output of this Terminal command?

file "/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM"

8/4/09 9:14:16 PM AdobeReader[722] Cannot find function pointer MyCMPluginFactory for factory EB982613-2188-11D6-BE4F-000A27E36620 in CFBundle/CFPlugIn 0x15bccab0 </Library/Contextual Menu Items/DocumentsToGoXCM.plugin> (not loaded)

Error because the plugin didn't load.

8/4/09 9:14:16 PM AdobeReader[722] Error loading /Library/Contextual Menu Items/GrabNGo.plugin/Contents/MacOS/GrabNGo: dlopen(/Library/Contextual Menu Items/GrabNGo.plugin/Contents/MacOS/GrabNGo, 262): no suitable image found. Did find:
/Library/Contextual Menu Items/GrabNGo.plugin/Contents/MacOS/GrabNGo: mach-o, but wrong architecture

8/4/09 9:14:16 PM AdobeReader[722] Cannot find function pointer GrabNGoFactory for factory 3487BB5A-3E66-11D5-A64E-003065B300BC in CFBundle/CFPlugIn 0x18a1c0 </Library/Contextual Menu Items/GrabNGo.plugin> (bundle, not loaded)

Another contextual menu that's PPC only, so it also wouldn't load.

8/4/09 9:14:32 PM kernel USBF: 2093.933 [0x6df0800] The IOUSBFamily is having trouble enumerating a USB device that has been plugged in. It will keep retrying. (Port 1 of hub @ location: 0x3d200000)

8/4/09 9:14:35 PM kernel USBF: 2097.637 [0x6df0800] The IOUSBFamily was not able to enumerate a device.

8/4/09 9:14:36 PM kernel USBF: 2098.476 [0x6df0800] The IOUSBFamily is having trouble enumerating a USB device that has been plugged in. It will keep retrying. (Port 1 of hub @ location: 0x3d200000)

8/4/09 9:14:41 PM kernel USBF: 2103.379 [0x6df0800] The IOUSBFamily was not able to enumerate a device.

8/4/09 9:14:42 PM kernel USBF: 2104.236 [0x6df0800] The IOUSBFamily is having trouble enumerating a USB device that has been plugged in. It will keep retrying. (Port 1 of hub @ location: 0x3d200000)
8/4/09 9:14:48 PM kernel USBF: 2110.339 [0x6df0800] The IOUSBFamily was not able to enumerate a device.
---

These last two keep repeating every couple minutes 😟

You have something plugged into your USB bus that the OS can't figure out. Disconnect everything but your keyboard and mouse and see if the messages stop. If they do, then re-connect your USB devices one by one until you find the one that's causing the messages.

charlie

Reply

Answer 9

Aug 5, 2009 8:55 AM in response to Charles Minow

Thanks Charlie, I'll do the USB testing tonight. What do you mean by this one:

It's just a guess, but I suspect that this might be a PowerPC plugin that Reader is trying to load. What do you get for the output of this Terminal command?

file "/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM"

What do I put in Terminal to elicit what you are asking?
Thanks,
Steven

Reply

Answer 10

Aug 5, 2009 9:16 AM in response to Steven Shmerler

Steven Shmerler wrote:
What do I put in Terminal to elicit what you are asking?

Just copy and paste it in, then hit the "enter" key:

file "/Library/Contextual Menu Items/DocumentsToGoXCM.plugin/Contents/MacOS/DocumentsToGoXCM"

The quotation marks are necessary in this example because of the space in the file name.

The " file" command is to determine file types. For example, if you look at iTunes:

file "/Applications/iTunes.app/Contents/MacOS/iTunes"

You'll get:

/Applications/iTunes.app/Contents/MacOS/iTunes: Mach-O universal binary with 2 architectures
/Applications/iTunes.app/Contents/MacOS/iTunes (for architecture ppc): Mach-O executable ppc
/Applications/iTunes.app/Contents/MacOS/iTunes (for architecture i386): Mach-O executable i386

But if it's not a universal binary, you'll get a result with just one architecture. (I included quotation marks in the command, but they're not really necessary in this case, since there are no spaces).

You can also search for the plugin and do a "Get Info" in the Finder to see what architecture is in the file. In this case, though, search for the "DocumentsToGoXCM.plugin" part of the file name, not the part from "Contents" on, since that's in the bundle.

Applications can't load plugins across architectures. In other words, if you have an application running as native Intel code, it can't load any plugins that have only PowerPC code.

However, if the application is a universal binary, with both PowerPC and Intel code, you can force it to run the PowerPC code, and it can then load PowerPC plugins.

charlie

Reply