Finder shows strange letter and number strings, programs "quit unexpectedly"

I seem to have this problem. I get the weird numbers in Finder, and Skype crashes whenever I try to open it. However, Safari works fine, except for the occasional re-direct to the fake search engine. I downloaded Clamxav and tried to run it, but it doesn't work. Whenever it opens, it says I need to update, but then says that it cannot connect. I'm almost certain that cause is the trojan.

As for how I got the trojan, I actually got a link via e-mail (my mom sent it to me, but told me it was a virus afterwards). The link displayed a blank screen, and a little while after I got this error message to reboot my computer. I do not know if this was my computer or the trojan. I cannot back up my files because I do not have enough space and enough money to buy everything over again. Do you guys have any tips?

TheBrickGuy wrote:

I seem to have this problem. I get the weird numbers in Finder, and Skype crashes whenever I try to open it. However, Safari works fine, except for the occasional re-direct to the fake search engine.

So there are at least a couple of possibilites, but let's start with the worst case.

Open the Terminal application (in /Applications/Utilities/), copy and paste the following command into a terminal window and press return.

defaults read ~/.MacOSX/environment

If the file doesn't exist, defaults returns"

Domain /Users/<username>/.MacOSX/environment does not exist

If it does exist, it returns its contents.

The malware entry will look something like this:

{

"DYLD_INSERT_LIBRARIES" = "/Users/Shared/.<dylib_filename>.so";

}

Return with the results, including the name it is showing for .<dylib_filename>.so, if present.

I actually tried that first, and it did show that exact malware entry. However, when I did it just now, it said that the environment does not exist. I guess I still have the trojan. 😝

TheBrickGuy wrote:

I actually tried that first, and it did show that exact malware entry. However, when I did it just now, it said that the environment does not exist. I guess I still have the trojan. 😝

What else did you do? It could not have disappeared by itself. Did you run any "rm" commands in Terminal? If so, which ones?

I know I ran all of the commands that were on page 10, but they don't have the same results as the first time.

TheBrickGuy wrote:

I know I ran all of the commands that were on page 10, but they don't have the same results as the first time.

I don't know how I can help you if you don't know exactly what you have done. About all I can offer is to look for the files one by one and see if they are gone.

Start with:

Select "Go to Folder" from the "Go" menu of the Finder (or type Command-Shift-G).

In the window paste the following:

~/.MacOSX/

and hit return

Check to see if the file environment.plist is present in that folder.

While you are doing that I'll write up the next step.

I went to the folder, and it was empty. Does the file I'm looking for need to be found with an anti-virus program?

TheBrickGuy wrote:

I went to the folder, and it was empty. Does the file I'm looking for need to be found with an anti-virus program?

No, if it's empty then you must have eliminated it. That is the critical file that might have locked you out of your account if it was still there.

ClamXav won't find that one, yet, but I'm working on it.

At this point Iomega's Virus Barrier X6 is the only one I feel comfortable recommending for the version of Flashback being discussed here. You can make a trial run with it and if it doesn't find anything then you can uninstall it after.

The problem with chasing down the other four files is that three of them are invisible. I can talk you through making all files visible, if you are interested in searching for them yourself.

BTW, you profile doesn't say what kind of Mac and version of OS X you are using. I know we're in the MacBook Pro forum, but suspect you didn't find this discussion that way.

Yes, I would love tips on how to find and delete the remaining three files.

I'm using version 10.6.5, or Snow Leopard.

TheBrickGuy wrote:

Yes, I would love tips on how to find and delete the remaining three files.

OK, the first step is to make all files visible. There are several utilities available which can do that for you, if you have one, otherwise following the following steps using the Terminal app.

Copy and paste the following to show hidden files:

defaults write com.apple.finder AppleShowAllFiles -bool true”

Hit enter

Type the following to restart the Finder:

killall Finder

Hit enter

Now look for the file listed in each of these four locations and drag them to the trash:

~/Library/Application Support/.<dylib_filename>.so"

~/Library/Logs/vmlog

/Users/Shared/.<dylib_filename>.so

/Users/Shared/.svcdmp

Notes:

"~" is your home folder at /Users/<yourusername>/

".<dylib_filename>.so>" is a name that was in that environment.plist so I don't know what it is. It will start with a dot then a random file name then another dot and "so". It might also have a .dylib extension, but I can't be certain of that.

Let me know what you find, if anything.

Empty the trash, reboot and let's see where we are.

MadMacs0 wrote:

At this point Iomega's Virus Barrier X6 is the only one I feel comfortable recommending

To my knowledge, Virus Barrier is developed by Intego; but you know more about this field than I do. Has Iomega taken over Intego, or has VB been sold to Iomega? Or is it just a typo?

fane_j wrote:

MadMacs0 wrote:

At this point Iomega's Virus Barrier X6 is the only one I feel comfortable recommending

To my knowledge, Virus Barrier is developed by Intego... is it just a typo?

More like a brain fart. Yes, it is Intego VB.

I got all of the invisible files, but can't find any but the first. I don't know if this helps, but I do not have separate accounts on my Mac. Anyway, I only found the first one. The name is .RCUforSmartServer.so, but I can't seem to delete it. I remember this name coming up in terminal, so I'm pretty sure this is the right one.

TheBrickGuy wrote:

I got all of the invisible files, but can't find any but the first. I don't know if this helps, but I do not have separate accounts on my Mac. Anyway, I only found the first one. The name is .RCUforSmartServer.so, but I can't seem to delete it. I remember this name coming up in terminal, so I'm pretty sure this is the right one.

OK, I don't know what the problem with deleting it could be, but if by the first one you mean the Application Support folder, we should be able to do that by copy and pasting this Terminal Command:

rm -rf "~/Library/Application Support/.RCUforSmartServer.so"

and hit return. The quotation marks need to be there.

I was actually just going to tell you that the Finder menu has returned to normal. I guess I deleted that file after all. But I'll still check for any sign of the trojan and post it here if I find anything. Thanks for the help!