Freehand not opening - Rosetta installed?

You should find the receipt here,

/private/var/db/receipts/com.apple.pkg.Rosetta.bom

From File>Go>Go to Folder, enter /private/var/db/receipts

Scroll down to find it.

Beneath that, you should also find Rosetta.plist

If Rosetta is currently being used by a PPC app, you should see it in Activity Monitor.

Do you have any other PPC apps to test with? Open System Profiler (About this Mac), go to Applications and look for what other PPC apps you have listed there.

I couldn't get Adobe's fix to work either, even though I had version 11, the last one. I also don't use it anymore, but I was just trying to figure out how to get it working for people here who have the same issue.

Assuming your license is for Freehand MX, version 11.x, you can do this.

1) Remove all traces of Freehand from your hard drive. Including the registration file in the Application Support folder from the fix.

2) Go to Adobe's site and then the Downloads section. Select Freehand MX from the drop down menu and click Go.

3) You'll be asked to enter your Adobe ID and password before you can get the download.

4) Once you do that, you'll be able to download the Freehand MX 11.0.2 "demo". Change the drop down menu by that to English | Mac | 41.6MB and click Download.

5) Install the downloaded version of Freehand MX 11.0.2. Do this even if what you have on disk is 11.0.2. Don't know what's different about the installer you can get from Adobe, but the fix works with that one.

6) Now replace the registration file in the HD/Application Support/Macromedia folder with the one from the fix. Freehand MX should work.

The download is actually the full version of Freehand MX, but will time out without the "fix" registration file. Once you put the fix on the hard drive, it turns the license into a never expiring copy of Freehand MX. So in reality, Adobe is giving Freehand MX away to anyone who downloads the demo and applies the fix.

Sorry, forgot to tell you it's in the .hqx compression format. You first need the free Stuffit Expander. Which can obtained at:

http://www.stuffit.com/mac-expander.html

When you double click the .hqx file, OS X initially should extract a Stuffit .sit archive. You then need the Expander to open that. Which finally gets you the Freehand installer and Using Freehand MX PDF file.

Just if you'd like to try it again.

Otherwise, glad you got it running! 🙂

I am having trouble with my MAC. 10.6.8 and Rosetta. Processor 3.06 Intel Core 2 Duo.

First, how do I know Rosetta is running?

Second, I need to get my Freehand MX back running - quick. I'll try anything - buying new/old computer, anything.

All my powerPc programs have stopped opening, and when I try to reinstall Freehand MX (from disc) or download from Adobe (Freehand MX specifically) I get an error message - Freehand MX quit un-expectantly. This is the same message for all Microsoft Office X programs as well.

I have been trying to fix this for 2 days. No luck. I rebooted from my disc 10.6.2 (I think I did this correctly) then added upgrade from Apple to 10.6.8. Restarted and had no problem with system start-up.

I went back into the disc and added "Rosetta", but I am not sure if it worked.

I have Carbonite, but am not sure if it backs up programs - if that is important...

Anything you can do to put me back on track.

I have been using freehand as an illustrator for 20+ years. I have an extensive library.

Thank you,

Matt Foster

fujikawarunner wrote:

First, how do I know Rosetta is running?

In Terminal,

$ sysctl kern.exec.archhandler.powerpc

If the answer is,

/usr/libexec/oah/translate

then Rosetta is installed and rarin' to go.

All my powerPc programs have stopped opening

Are you sure about this? If yes, try, in Terminal,

$ defaults read ~/.MacOSX/environment

If the reply is,

Domain /Users/[your_user_name]/.MacOSX/environment does not exist

then the problem is elsewhere. If it's anything else, copy it and post it here.

(Btw, $ represents your prompt in Terminal—you do not type it or paste it.)

Thanks for the response.

Here's what I got out of Terminal (first time user)

It seems Rosetta is running, but the second message is different then what you expected...

Matt

Last login: Wed Mar 28 18:33:44 on ttys000

[Macintosh:~] mattfoster% sysctl kern.exec.archhandler.powerpc

kern.exec.archhandler.powerpc: /usr/libexec/oah/translate

[Macintosh:~] mattfoster% defaults read ~/.MacOSX/environment

{

"DYLD_INSERT_LIBRARIES" = "/Users/Shared/.libgmalloc.dylib";

}

[Macintosh:~] mattfoster%

Yikes!

I put in that line of "code" and came up with a malware link explaining my exact symptoms.

The question now is...

Can a regular user fix this? I have never used Terminal before today. Or should I bring my documented findings along with my infected machine to local MAC service center?

Thank you,

Matt Foster

http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

fujikawarunner wrote:

{

"DYLD_INSERT_LIBRARIES" = "/Users/Shared/.libgmalloc.dylib";

}

Yes. You've been infected by a version of the Flashback Trojan. And you've already found a article about it.

The immediate and temporary fix is to edit/delete/rename the environment.plist file and other files, as described in the reference you cited. Afterwards, your PPC apps should be working again. However, I stress, this is not a solution, because you don't know, (a) what other malicious code has been installed on your machine, and, (b) what confidential information may already have been compromised.

IMHO, the proper solution is, first, to back up your documents (documents only, no apps or configuration files), re-format the drive, re-install the OS and applications, and restore your docs from backup. (This is drastic, and I should not recommend it as a rule, but in this case I do, because this Trojan Horse seems to have so many different strains that I don't believe anyone can tell for sure precisely what code was installed and where and how to find it.) Once everything is back up, disable or uninstall Java (do not confuse Java with JavaScript, they're very different animals).

The second, no less important, step is to review all sites and passwords (especially related to money matters) you'v been using since this has been happening, and change them all ASAP. To be on the safe side, I'd go back a month or two, although that might be overkill. Basically, anything of yours that you would not want a bad guy to have access to must be changed.

I hope MadMacs0 will also have a look at this thread, because he's been watching this thing very closely and knows more than I do on the topic.

fujikawarunner wrote:

Yikes!

Can a regular user fix this? I have never used Terminal before today. Or should I bring my documented findings along with my infected machine to local MAC service center?

Admittedly, it will be difficult for some users if they either don't follow the instructions exactly or don't fully understand the instructions given. That's why most of us always recommend the backup, hard drive reformat, reinstall OS X and applications from source, and restore only data files from backup approach.

One other possibility if you can establish the date of infection is to use a TimeMachine backup and go back to just before infection for restoration.

The other thing I would tell you is that the Apple Store technicians have been cautioned not to attempt malware removal. A few users who took their computers in (probably not mentioning the malware) were given a new OS installation and nothing else.

I will do as suggested. Back-up with external drive - Reformat myself - then add back critical programs. I will stay away from my local Mac shop for this. It's just a baby-sitting job anyway.

My wife is worried her laptop being on the same wireless (airport) network has been infected. Any thing to that?

Future use of my "work" computer will be without internet access...

I appreciate your help along with the famous fane_j. ;-)

fujikawarunner wrote:

My wife is worried her laptop being on the same wireless (airport) network has been infected. Any thing to that?

No. This is not a virus or a worm; it is not self-replicating and it does not spread through the network. If your wife hasn't visited infected sites (I understand that Wordpress blogs are the primary vector) and if she hasn't been fooled into authorising a fake installer to run on her machine, then there's no reason to worry.

Btw, don't give me too much credit. It was a collaborative effort—Brian Stroud, jsd2, MadMacs0, and X423424X—in that other thread you looked at that ferreted this thing out.

fujikawarunner wrote:

My wife is worried her laptop being on the same wireless (airport) network has been infected. Any thing to that?

Viruses can be spread from computer to computer in a number of ways, but this isn't a virus, it's a Trojan, meaning that the user must be tricked into installing it on their computer. The only source of infection that we know about is a poisoned web site. Most recent versions have come from WordPress blog sites (thousands according to reports) that are serving both Mac and Windows versions of this thing.

Here are some suggestions on how to prevent this from happening in the future, courtesy of magmatic.com:

Mitigation 1: Disable "Open Safe Files.." In Safari->Preferences->General.

Mitigation 2: ONLY DOWNLOAD FLASH FROM http://get.adobe.com/flashplayer/otherversions/

Mitigation 3: Disable Java or manage the Preferences. http://www.magmatic.com/apple-security-muse/2012/2/23/java-hardening-tips.html

Mitigation 4: Update your OSX to the latest version.

And one more from me. Only use your admin account when you must. Do all of your normal computing using a non-admin account.

One last thing for you to do after your computer is back to normal operation. Intego has discovered that the Trojan attempts to sniff out usernames and passwords that you enter into many popular sites (like banking sites, Google, PayPal, and others), presumably so that the malfeasants behind the software can exploit that information in other nefarious ways, and sends them back via Twitter. You should assume that happened and change the passwords for all such accounts that you have visited since being infected along with any other accounts that use the same password.