Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

noellle Author

Level 1

5 points

Finder shows strange letter and number strings, programs "quit unexpectedly"

A couple of things have been happening. My finder, on right click, shows strange strings of letters and numbers in place of the words that used to be there. For instance, "Open in" now says "N152." (see link: http://www.insanelymac.com/forum/lofiversion/index.php/t85009.html)

Also, some programs are saying they "quit unexpectedly" when I try to launch them. Excel and My profile reminder for my eye1display2 are the two I have seen do this so far.

Do you have any ideas about what happened and how to fix it?

I have a Macbook Pro, Mac OS X 10.6.8.

Thank you so much!

Kristen

MacBook Pro, Mac OS X (10.6.8)

Posted on Sep 27, 2011 10:05 PM

185 replies

Linc Davis

Level 10

209,547 points

Oct 5, 2011 5:25 PM in response to MadMacs0

I ran the "preinstall" executable in a shell, which was the only functional part of the installer. I don't recall that it deleted the installer, but maybe it would have if I had run it in the usual way.

noellle Author

Level 1

5 points

Oct 5, 2011 5:27 PM in response to MadMacs0

Ok, so ClamXav finished scanning my computer only, and it did find some phising things and a worm. they might be from the folder of my Dad's old username, though, which is still there in a strange way from when he gave me his computer and then I got a new one....I doubt that's significant, but it's worth a mention.

The issue still continued, as you thought it would.

Now, I am looking for the files. I am not sure if you meant to look in my main hard drive Library or my username Library, if that makes sense (not sure of the terminology.)

In my main drive Library, there is no LaunchAgents/com.apple.SystemUI.plist but there is just LaunchAgents/com.google.keystone.agent.plist . In my username Library, there is no Launch Agents folder.

There are both the perflib file and the Preferences.dylib in my username Library/Preferences

there is no Logs/swlog in either place.

I have not done the .macosx one, since I figured I needed to do them all at once. What should I do now?

MadMacs0

Level 5

5,221 points

Oct 5, 2011 5:41 PM in response to noellle

noellle wrote:

Ok, so ClamXav finished scanning my computer only, and it did find some phising things and a worm. they might be from the folder of my Dad's old username, though, which is still there in a strange way from when he gave me his computer and then I got a new one....I doubt that's significant, but it's worth a mention

Remind me and we can deal with that later.

noellle wrote:

Now, I am looking for the files. I am not sure if you meant to look in my main hard drive Library or my username Library, if that makes sense (not sure of the terminology.)

Sorry, we missed telling you that they are all in your user area.

In my username Library, there is no Launch Agents folder.

Sounds like a bug in the Trojan. IIRC it's not there by default, but most users eventually get one.

There are both the perflib file and the Preferences.dylib in my username Library/Preferences

there is no Logs/swlog in either place.

I have not done the .macosx one, since I figured I needed to do them all at once. What should I do now?

Move them all to the trash and empty it. If it doesn't completely empty, don't worry about it.

Reboot your computer and attempt to log in. You probably saw that another user got a blank screen at this point and had to reboot again. As I recall Linc had the same issue, so just restart it a second time and you should be OK. If there was anything left in the trash, empty it again.

noellle Author

Level 1

5 points

Oct 5, 2011 5:57 PM in response to MadMacs0

ok thanks...

well, now I have moved the preferences.dylib to the trash, but it won't let me empty it cause it's "in use!"

I will try again after I quit Safari maybe??????

mudpize

Level 2

155 points

Oct 5, 2011 6:00 PM in response to noellle

Note: The MacOS file is a hidden file. I used Tinker Tool to expose the hidden files. You can then easily find the file and move it to the trash.

MadMacs0

Level 5

5,221 points

Oct 5, 2011 6:03 PM in response to noellle

noellle wrote:

ok thanks...

well, now I have moved the preferences.dylib to the trash, but it won't let me empty it cause it's "in use!"

I will try again after I quit Safari maybe??????

No that won't help, you will have to log out first, but before you do that you MUST put the other files in the trash including removing the invisible one. Otherwise you won't be able to log back in.

noellle Author

Level 1

5 points

Oct 5, 2011 6:04 PM in response to mudpize

thank you, mudpize, because I tried to launch the terminal and it starts to open and just quits. There is no error message box like the other one. It just quits (maybe cause the other two files are in the trash?)

I will download tinker tool and trust that it is a safe download!

thank you!

noellle Author

Level 1

5 points

Oct 5, 2011 6:05 PM in response to MadMacs0

Oh my gosh, madmacs0 - so you are saying that I should put only the two files that I could find, along with the hidden .macosxfile in the trash and then log out.

It doesn't matter that I didn't find the logs/swlogs?

noellle Author

Level 1

5 points

Oct 5, 2011 6:13 PM in response to MadMacs0

Ok, this is not good. I downloaded Tinkertool, right clicked on it to "show in finder," and the trash (where the two suspicious files are) opened up...Interesting.

then, I decided to right click on it to scan it with the ClamXav tool, just in case. ClamXav started to launch and then quit. (no error message, just like terminal, but same thing that the infected aps used to do.)

then, I tried both double clicking on Tinkertool and rightclicking on open and got the little animation like it was going to launch and then nothing.

HELP!

noellle Author

Level 1

5 points

Oct 5, 2011 6:14 PM in response to noellle

If I put the two trashed files back, will the other things behave for a second?

Linc Davis

Level 10

209,547 points

Oct 5, 2011 6:21 PM in response to noellle

Reboot now, log in, and finish the job. The trojan is still running and it will crash any application you try to launch.

MadMacs0

Level 5

5,221 points

Oct 5, 2011 6:21 PM in response to noellle

noellle wrote:

If I put the two trashed files back, will the other things behave for a second?

That's what I'd try and don't worry that you don't have the swlog file, I don't think it has an active role in this.

MadMacs0

Level 5

5,221 points

Oct 5, 2011 6:26 PM in response to MadMacs0

Here's another way to find that file.

In the Finder select "Go To Folder..." from the "Go" menu or type Command-Shift-G.

In the "Go to the folder:" dialog type "~/.MacOSX/" without the quotes.

That will allow you to drag "environment.plist" to the trash.

noellle Author

Level 1

5 points

Oct 5, 2011 6:46 PM in response to MadMacs0

I put the two trashed files back, launched the Terminal (it worked!) and then dragged the command or whatever it's called over there and pressed enter.

logged out, got blank screen, rebooted, everything is looking GREAT!!!!

Yet, the thing in still in the trash. I will keep trying to empty it and will update.

Thank you!!!!

noellle Author

Level 1

5 points

Oct 5, 2011 6:49 PM in response to MadMacs0

Oh, well that was easy. it just emptied this time...so I guess that's gone now?

You all ROCK! So amazing. I am so very thankful!!!

Okay, now I am supposed to remind MadMacs0 about:

noellle wrote:

Ok, so ClamXav finished scanning my computer only, and it did find some phising things and a worm. they might be from the folder of my Dad's old username, though, which is still there in a strange way from when he gave me his computer and then I got a new one....I doubt that's significant, but it's worth a mention

I will hold off scanning my other drives until we deal with that, I guess?

Finder shows strange letter and number strings, programs "quit unexpectedly"