Q: Finder shows strange letter and number strings, programs "quit unexpectedly"

If you are able to log in, then yes you would be able to delete the files we know about. While we're on that subject, I'm not certain you have the latest list, depending on when you were infected. You may need to open the ~/.MacOSX/environment.plist with a text editor to discover the names of a couple of the files. Have you done this already?  If not open the Terminal application (in /Applications/Utilities/), copy and paste the following command into a terminal window and press return.

          defaults read ~/.MacOSX/environment

If the file doesn't exist, defaults returns "Domain /Users/<username>/.MacOSX/environment does not exist"

If it does exist, it returns its contents.

The malware entry will look something like this:

{

    "DYLD_INSERT_LIBRARIES" = "/Users/Shared/.<dylib_filename>.so";

}

It will be easier to delete those other two files if you know what .<dylib_filename>.so is.

There could well be things we don't fully know about this, so there could be other files (Iomega has said that code is injected into several network apps, but in the last few days we've heard that it may not harm the files on your hard drive). The safest thing woud be to replace these apps from source, but nobody has produced a complete list (they have mentioned only Safari and Skype by name).

I mention this only so you can judge what would be the safest and easiest approach for you. Even if you resort to your TimeCapsule restore, there is still one more step, so let us know when you have your hard drive clean and working to your satisfaction.

Ok I will try when I get home from work. Thank you so much for your help!! I will let you know how it goes

MadMacs0 wrote:

 

You may need to open the ~/.MacOSX/environment.plist with a text editor […]  If not open the Terminal application

(1) For those uncomfortable with a text editor or Terminal, a possible alternative is RCEnvironment

<http://www.rubicode.com/Software/RCEnvironment/>

a free prefpane designed specifically to edit environment.plist and compatible with SL.

(2) I'm curious if anyone has tried MadMacs0's suggestion to hold down shift at login (login, not startup). In previous OS versions this disables the startup of login items, but I'm not sure if it does so in SL. As he said, there's a chance it also by-passes environment.plist. Apple's docs do not mention any way of preventing login window from parsing environment.plist, but it would have been prudent to build something like that in the login process.

(3) I'm rather uneasy at the stress laid on finding and deleting specific files or apps. The problem is that, AFAICT, no-one has a very good idea of exactly what this malware installs and where. So, IMHO, erasing and re-installing, however drastic, is the only safe way to proceed. Keep in mind that there other ways of setting paths to dynamic libraries than environment.plist.

fane_j wrote:

 

(1) For those uncomfortable with a text editor or Terminal, a possible alternative is RCEnvironment

 

<http://www.rubicode.com/Software/RCEnvironment/>

 

a free prefpane designed specifically to edit environment.plist and compatible with SL.

Actually, that's what I use, but have hesitated to recommend it as I wasn't certain of the compatibiity.

(2) I'm curious if anyone has tried MadMacs0's suggestion to hold down shift at login (login, not startup). In previous OS versions this disables the startup of login items, but I'm not sure if it does so in SL. As he said, there's a chance it also by-passes environment.plist. Apple's docs do not mention any way of preventing login window from parsing environment.plist, but it would have been prudent to build something like that in the login process.

Just to be clear I recommended booting into Safe mode first and then loging in with shift key down.

(3) I'm rather uneasy at the stress laid on finding and deleting specific files or apps. The problem is that, AFAICT, no-one has a very good idea of exactly what this malware installs and where. So, IMHO, erasing and re-installing, however drastic, is the only safe way to proceed. Keep in mind that there other ways of setting paths to dynamic libraries than environment.plist.

All good advise, in fact I'm pretty certain that the envoronment.plist was not used for at least one intermediate version, but they seem to have gone back to it. When pressed, I too continue to recommend erase and re-install, but there have been increasing numbers of infected users who opted not to. It's pretty clear that deleting files does remove all the known symptoms of this thing (alpha-numeric menus, crashing Skype and/or Safari and possibly Google redirects), but has it really shut down harvesting and reporting of username / password pairs? Is there still a backdoor awaiting the next iteration? And what else does it do that hasn't manifested itself.

In the end it's the users choice based on what the Commercial experts have published (Iomega isn't recommending this, but they want you to use their software, so have a vested interest), the expertise here in the forums coupled with their knowledge, time and what they might lose by starting over. Your advise is clearly the safest solution available at this time.

Ok so I had no luck logging in holding shift, just the galaxy blank screen. You mentioned possibly fixing it using my other account?? I did manage to change my password for the compromised account from the other one if that helps

Danish26 wrote:

 

Ok so I had no luck logging in holding shift, just the galaxy blank screen. You mentioned possibly fixing it using my other account?? I did manage to change my password for the compromised account from the other one if that helps

What worked for a friend yesterday was to boot in single user mode by holding down the 's' key when you start your mac. (http://support.apple.com/kb/HT1492)

After a while, you get a terminal prompt and type:

mount -uw /

rm /Users/*/.MacOSX/environment.plist

reboot

Your Mac would be ok after that, providing you're going to delete all the remaining virus files.

That's another point.

Danish26 wrote:

 

Ok so I had no luck logging in holding shift, just the galaxy blank screen.

Alright, it was worth a try.

You mentioned possibly fixing it using my other account?? I did manage to change my password for the compromised account from the other one if that helps

I don't think that will help, but it can't hurt.

So from the other account we need to find out a bit of information before we delete anything. Open the Terminal app (in /Applications/Utilitie/} then type the following into the window, substituting the name of the infected account for <otherusername>:

     sudo defaults read /Users/<otherusername>/.MacOSX/environment

and hit return. Terminal will ask you for the admin password for the account you are logged into. When you type it nothing shows up in the window, just hit return when your finished typing. Copy and paste the results here.

Now we can delete the file by typing:

     sudo rm -rf /Users/<otherusername>/.MacOSX/environment.plist

and hit return. If this is shortly after completing the previous command it won't ask for your password this time, which is normal. It will let you know of any error, but not confirm deletion, so if it simply returns to the prompt you were successful and should be able to log back into the other account where we can complete deletion of the other files.

Philip Barrier wrote:

 

What worked for a friend yesterday was to boot in single user mode by holding down the 's' key when you start your mac. (http://support.apple.com/kb/HT1492)

 

After a while, you get a terminal prompt and type:

 

mount -uw /

rm /Users/*/.MacOSX/environment.plist

reboot

 

Your Mac would be ok after that, providing you're going to delete all the remaining virus files.

Which is going to be more difficult if we don't know the names of the files we're looking for, which is why I said we need him to show us the contents of "enviroment.plist" first.

No needs, I gave him a command to delete all environment.plist files from ALL users.

There's a huge bug in Mac OS X that drives the login issue when a DYLD_INSERT_LIBRARY points to a non existant library.

Please never delete the .so file in /Users/Shared before having removed the environment.plist file.

What you can  do is to boot on a install DVD, and use the Terminal Application in the Installer Menu to remove the bad files.

Philip Barrier wrote:

 

No needs, I gave him a command to delete all environment.plist files from ALL users.

Yes, I saw that you had jumped in and were asking him to delete it before we knew the names of the other files. It's much easier to do when you have that information. If you will look back I cautioned yesterday that we would need that info.

I'm having the same issues as everyone else on this page, however, I've been trying to follow all of the suggestions, and can't seem to find any life from the malware. Finally, I just erased everything and reinstalled OSX, using the disc. Unforntunately, when I began surfing the apple website ( I want to upgrade my software to snow leopard, since I'm using OSX leopard) it crashed again! Is there anywhere else I could begin to look, or was this just a coincidence? I am such a noob with computers and any help would greatly be appreciated.

Process:         Safari [297]

Path:            /Applications/Safari.app/Contents/MacOS/Safari

Identifier:      com.apple.Safari

Version:         3.0.4 (5523.15)

Build Info:      WebBrowser-55231500~5

Code Type:       X86 (Native)

Parent Process:  launchd [248]

Date/Time:       2012-03-05 13:21:24.532 -0600

OS Version:      Mac OS X 10.5.2 (9C2028)

Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)

Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000040

Crashed Thread:  0

Thread 0 Crashed:

0   com.apple.WebCore                  0x9388c31b WebCore::LayoutState::LayoutState(WebCore::LayoutState*, WebCore::RenderBox*, WebCore::IntSize const&) + 427

1   com.apple.WebCore                  0x9356acc6 WebCore::RenderContainer::layout() + 342

2   com.apple.WebCore              0x9356abdb WebCore::RenderContainer::layout() + 107

3   com.apple.WebCore                  0x93566862 WebCore::RenderTable::layout() + 674

4   com.apple.WebCore                  0x934cd84b WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 2075

5   com.apple.WebCore                  0x934c9693 WebCore::RenderBlock::layoutBlock(bool) + 723

6   com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

7   com.apple.WebCore                  0x934d678f WebCore::RenderBlock::insertFloatingObject(WebCore::RenderObject*) + 127

8   com.apple.WebCore                  0x934cb7b7 WebCore::RenderBlock::handleFloatingChild(WebCore::RenderObject*, WebCore::RenderBlock::MarginInfo const&, bool&) + 39

9   com.apple.WebCore                  0x934cb6fa WebCore::RenderBlock::handleSpecialChild(WebCore::RenderObject*, WebCore::RenderBlock::MarginInfo const&, WebCore::RenderBlock::CompactInfo&, bool&) + 106

10  com.apple.WebCore                  0x934cad11 WebCore::RenderBlock::layoutBlockChildren(bool) + 385

11  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

12  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

13  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

14  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

15  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

16  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

17  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

18  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

19  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

20  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

21  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

22  com.apple.WebCore                  0x934d678f WebCore::RenderBlock::insertFloatingObject(WebCore::RenderObject*) + 127

23  com.apple.WebCore                  0x934cb7b7 WebCore::RenderBlock::handleFloatingChild(WebCore::RenderObject*, WebCore::RenderBlock::MarginInfo const&, bool&) + 39

24  com.apple.WebCore                  0x934cb6fa WebCore::RenderBlock::handleSpecialChild(WebCore::RenderObject*, WebCore::RenderBlock::MarginInfo const&, WebCore::RenderBlock::CompactInfo&, bool&) + 106

25  com.apple.WebCore                  0x934cad11 WebCore::RenderBlock::layoutBlockChildren(bool) + 385

26  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

27  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

28  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

29  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

30  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

31  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

32  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

33  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

34  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

35  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

36  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

37  com.apple.WebCore                  0x934caebe WebCore::RenderBlock::layoutBlockChildren(bool) + 814

38  com.apple.WebCore                  0x934c9ba2 WebCore::RenderBlock::layoutBlock(bool) + 2018

39  com.apple.WebCore              0x934c9388 WebCore::RenderBlock::layout() + 40

40  com.apple.WebCore                  0x934c92a8 WebCore::RenderView::layout() + 200

41  com.apple.WebCore                  0x934c8047 WebCore::FrameView::layout(bool) + 471

42  com.apple.WebCore              0x934f4b00 WebCore::Document::updateLayout() + 112

43  com.apple.WebCore                  0x9352f138 WebCore::Document::updateLayoutIgnorePendingStylesheets() + 104

44  com.apple.WebCore                  0x93747a26 WebCore::createMarkup(WebCore::Node const*, WebCore::EChildrenOnly, ***::Vector<WebCore::Node*, 0ul>*, WebCore::EAnnotateForInterchange) + 150

45  com.apple.WebCore              0x9357a7f9 WebCore::HTMLElement::innerHTML() const + 57

46  com.apple.WebCore                  0x9350dff6 WebCore::JSHTMLElement::getValueProperty(KJS::ExecState*, int) const + 646

47  com.apple.JavaScriptCore           0x93fdc26a KJS::DotAccessorNode::evaluate(KJS::ExecState*) + 250

48  com.apple.JavaScriptCore           0x93fe3241 KJS::EqualNode::evaluate(KJS::ExecState*) + 33

49  com.apple.JavaScriptCore           0x93fe9645 KJS::IfNode::execute(KJS::ExecState*) + 69

50  com.apple.JavaScriptCore           0x93fdaf27 KJS::SourceElementsNode::execute(KJS::ExecState*) + 423

51  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

52  com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

53  com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

54  com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

55  com.apple.JavaScriptCore           0x93fe597e KJS::AssignDotNode::evaluate(KJS::ExecState*) + 286

56  com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

57  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

58  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

59  com.apple.JavaScriptCore           0x93fe96ed KJS::IfNode::execute(KJS::ExecState*) + 237

60  com.apple.JavaScriptCore           0x93fdaf27 KJS::SourceElementsNode::execute(KJS::ExecState*) + 423

61  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

62  com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

63  com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

64  com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

65  com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

66  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

67  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

68  com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

69  com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

70  com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

71  com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

72  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

73  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

74  com.apple.JavaScriptCore           0x93fe9797 KJS::IfNode::execute(KJS::ExecState*) + 407

75  com.apple.JavaScriptCore           0x93fdaf27 KJS::SourceElementsNode::execute(KJS::ExecState*) + 423

76  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

77  com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

78  com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

79  com.apple.JavaScriptCore           0x93ff41c8 KJS::FunctionProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 1848

80  com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

81  com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

82  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

83  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

84  com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

85  com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

86  com.apple.JavaScriptCore           0x93ff2d20 KJS::ArrayProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 19248

87  com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

88  com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

89  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

90  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

91  com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

92  com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

93  com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

94  com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

95  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

96  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

97  com.apple.JavaScriptCore           0x93fe96ed KJS::IfNode::execute(KJS::ExecState*) + 237

98  com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

99  com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

100 com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

101 com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

102 com.apple.JavaScriptCore           0x93ff4380 KJS::FunctionProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 2288

103 com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

104 com.apple.JavaScriptCore           0x93fe8f45 KJS::ReturnNode::execute(KJS::ExecState*) + 133

105 com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

106 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

107 com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

108 com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

109 com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

110 com.apple.JavaScriptCore           0x93feba6a KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 154

111 com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

112 com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

113 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

114 com.apple.JavaScriptCore           0x93fe9797 KJS::IfNode::execute(KJS::ExecState*) + 407

115 com.apple.JavaScriptCore           0x93fdaf27 KJS::SourceElementsNode::execute(KJS::ExecState*) + 423

116 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

117 com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

118 com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

119 com.apple.JavaScriptCore           0x93fdca13 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 915

120 com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

121 com.apple.JavaScriptCore           0x93fdaf27 KJS::SourceElementsNode::execute(KJS::ExecState*) + 423

122 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

123 com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

124 com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

125 com.apple.JavaScriptCore           0x93fec819 KJS::FunctionCallValueNode::evaluate(KJS::ExecState*) + 777

126 com.apple.JavaScriptCore           0x93fe5735 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69

127 com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

128 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

129 com.apple.JavaScriptCore           0x94019568 KJS::WhileNode::execute(KJS::ExecState*) + 232

130 com.apple.JavaScriptCore           0x93fdae0b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139

131 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

132 com.apple.JavaScriptCore           0x93fe9797 KJS::IfNode::execute(KJS::ExecState*) + 407

133 com.apple.JavaScriptCore           0x93fdaf27 KJS::SourceElementsNode::execute(KJS::ExecState*) + 423

134 com.apple.JavaScriptCore           0x93fda601 KJS::BlockNode::execute(KJS::ExecState*) + 49

135 com.apple.JavaScriptCore           0x93fe657c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28

136 com.apple.JavaScriptCore           0x93fe5f8f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 559

137 com.apple.JavaScriptCore           0x94011127 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 135

138 com.apple.WebCore                  0x935106f2 WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 1074

139 com.apple.WebCore                  0x93472466 WebCore::Document::handleWindowEvent(WebCore::Event*, bool) + 166

140 com.apple.WebCore                  0x934721b0 WebCore::EventTargetNode::dispatchWindowEvent(WebCore::AtomicString const&, bool, bool) + 192

141 com.apple.WebCore                  0x934602dc WebCore::Document::implicitClose() + 252

142 com.apple.WebCore              0x934219d4 WebCore::FrameLoader::checkCallImplicitClose() + 308

143 com.apple.WebCore                  0x9342181b WebCore::FrameLoader::checkCompleted() + 187

144 com.apple.WebCore              0x93492fa7 WebCore::Loader::didFinishLoading(WebCore::SubresourceLoader*) + 327

145 com.apple.WebCore                  0x9348fb61 WebCore::SubresourceLoader::didFinishLoading() + 49

146 com.apple.WebCore                  0x9348dd98 -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 72

147 com.apple.Foundation               0x90fb68b7 -[NSURLConnection(NSURLConnectionReallyInternal) sendDidFinishLoading] + 87

148 com.apple.Foundation               0x90fb6844 _NSURLConnectionDidFinishLoading + 68

149 com.apple.CFNetwork            0x961837f3 sendDidFinishLoadingCallback + 148

150 com.apple.CFNetwork                0x96180920 _CFURLConnectionSendCallbacks + 1994

151 com.apple.CFNetwork                0x961800d9 muxerSourcePerform + 283

152 com.apple.CoreFoundation           0x93ad362e CFRunLoopRunSpecific + 3166

153 com.apple.CoreFoundation           0x93ad3d18 CFRunLoopRunInMode + 88

154 com.apple.HIToolbox                0x94eab6a0 RunCurrentEventLoopInMode + 283

155 com.apple.HIToolbox                0x94eab4b9 ReceiveNextEventCommon + 374

156 com.apple.HIToolbox                0x94eab32d BlockUntilNextEventMatchingListInMode + 106

157 com.apple.AppKit               0x916d27d9 _DPSNextEvent + 657

158 com.apple.AppKit               0x916d208e -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128

159 com.apple.Safari                   0x0000997e 0x1000 + 35198

160 com.apple.AppKit                   0x916cb0c5 -[NSApplication run] + 795

161 com.apple.AppKit                   0x9169830a NSApplicationMain + 574

162 com.apple.Safari                   0x00002456 0x1000 + 5206

Thread 1:

0   libSystem.B.dylib                  0x90cc6bce __semwait_signal + 10

1   libSystem.B.dylib                  0x90cf18cd pthread_cond_wait$UNIX2003 + 73

2   com.apple.WebCore                  0x9340bdef WebCore::IconDatabase::syncThreadMainLoop() + 239

3   com.apple.WebCore                  0x934073e5 WebCore::IconDatabase::iconDatabaseSyncThread() + 181

4   libSystem.B.dylib                  0x90cf0c55 _pthread_start + 321

5   libSystem.B.dylib                  0x90cf0b12 thread_start + 34

Thread 2:

0   libSystem.B.dylib                  0x90cbf9e6 mach_msg_trap + 10

1   libSystem.B.dylib                  0x90cc71dc mach_msg + 72

2   com.apple.CoreFoundation           0x93ad30de CFRunLoopRunSpecific + 1806

3   com.apple.CoreFoundation           0x93ad3d18 CFRunLoopRunInMode + 88

4   com.apple.CFNetwork                0x9617b6cc CFURLCacheWorkerThread(void*) + 396

5   libSystem.B.dylib              0x90cf0c55 _pthread_start + 321

6   libSystem.B.dylib              0x90cf0b12 thread_start + 34

Thread 3:

0   libSystem.B.dylib                  0x90cbf9e6 mach_msg_trap + 10

1   libSystem.B.dylib                  0x90cc71dc mach_msg + 72

2   com.apple.CoreFoundation           0x93ad30de CFRunLoopRunSpecific + 1806

3   com.apple.CoreFoundation           0x93ad3d18 CFRunLoopRunInMode + 88

4   com.apple.Foundation               0x90fb4ac0 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 320

5   com.apple.Foundation               0x90f515ad -[NSThread main] + 45

6   com.apple.Foundation               0x90f51154 __NSThread__main__ + 308

7   libSystem.B.dylib                  0x90cf0c55 _pthread_start + 321

8   libSystem.B.dylib                  0x90cf0b12 thread_start + 34

Thread 4:

0   libSystem.B.dylib                  0x90d0fb3a select$DARWIN_EXTSN + 10

1   libSystem.B.dylib                  0x90cf0c55 _pthread_start + 321

2   libSystem.B.dylib                  0x90cf0b12 thread_start + 34

Thread 5:

0   libSystem.B.dylib                  0x90cc6bce __semwait_signal + 10

1   libSystem.B.dylib                  0x90cf18cd pthread_cond_wait$UNIX2003 + 73

2   com.apple.ColorSync                0x94332460 pthreadSemaphoreWait(t_pthreadSemaphore*) + 42

3   com.apple.ColorSync                0x94344d92 CMMConvTask(void*) + 54

4   libSystem.B.dylib                  0x90cf0c55 _pthread_start + 321

5   libSystem.B.dylib                  0x90cf0b12 thread_start + 34

Thread 0 crashed with X86 Thread State (32-bit):

  eax: 0x00000000  ebx: 0x935665cb  ecx: 0x1c1f336c  edx: 0x1fa0ea28

  edi: 0x000000a7  esi: 0x00000000  ebp: 0xbfffa628  esp: 0xbfffa5c0

   ss: 0x0000001f  efl: 0x00010206  eip: 0x9388c31b   cs: 0x00000017

   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037

  cr2: 0x00000040

Message was edited by: kma5136

kma5136 wrote:

 

I'm having the same issues as everyone else on this page, however, I've been trying to follow all of the suggestions, and can't seem to find any life from the malware.

 

I don't think you are. Do you see letters and numbers in your menus? Are you being redirected away from Google searches? Or are you just experiencing Safari crashes? If it's just Safari crashing, there could be many reasons, so please start a new thread if that is true.

If you were infected then you would be the first Leopard user I have found to have been infected by Flashback.

Originally I was! But only in the trash can, the N39 or whatever. Also, when I was backing up my files to an external hard drive there were error messages that I couldn't make out. Google searches worked, microsoft word would crash right away, and safari would crash after awhile. Also, any other application would run slowly, and eventually crash after 10 minutes or so.

Message was edited by: kma5136  Spelling!

kma5136 wrote:

 

Originally I was! But only in the trash can, the N39 or whatever. Also, when I was backing up my files to an external hard drive there were error messages that I couldn't make out. Google searches worked, microsoft word would crash right away, and safari would crash after awhile. Also, any other application would run slowly, and eventually crash after 10 minutes or so.

OK, well there is nothing in your crash report to indicate you are currently infected and Word is not one of the apps previously involved. If you have used the Terminal app as I outlined at the top of this page (10) and did not find the environment.plist, then please start a new thread.

Thanks, I think the last few crashes were a coincidence, I installed some leftover software updates and everything worked normally again.