noellle
Level 1 (4 points)
Desktops

Q: Finder shows strange letter and number strings, programs "quit unexpectedly"

A couple of things have been happening. My finder, on right click, shows strange strings of letters and numbers in place of the words that used to be there. For instance, "Open in" now says "N152." (see link: http://www.insanelymac.com/forum/lofiversion/index.php/t85009.html)

 

Also, some programs are saying they "quit unexpectedly" when I try to launch them. Excel and My profile reminder for my eye1display2 are the two I have seen do this so far.

 

Do you have any ideas about what happened and how to fix it?

 

I have a Macbook Pro, Mac OS X 10.6.8.

 

Thank you so much!

Kristen

MacBook Pro, Mac OS X (10.6.8)

Posted on Sep 27, 2011 10:05 PM

by MadMacs0,Solvedanswer
MadMacs0 MadMacs0
Level 5 (4,801 points)
A:

noellle wrote:

 

Ok, so ClamXav finished scanning my computer only, and it did find some phising things and a worm. they might be from the folder of my Dad's old username, though, which is still there in a strange way from when he gave me his computer and then I got a new one....I doubt that's significant, but it's worth a mention

Remind me and we can deal with that later.

noellle wrote:

 

Now, I am looking for the files. I am not sure if you meant to look in my main hard drive Library or my username Library, if that makes sense (not sure of the terminology.)

Sorry, we missed telling you that they are all in your user area.

In my username Library, there is no Launch Agents folder.

Sounds like a bug in the Trojan. IIRC it's not there by default, but most users eventually get one.

There are both the perflib file and the Preferences.dylib in my username Library/Preferences

 

there is no Logs/swlog in either place.

 

I have not done the .macosx one, since I figured I needed to do them all at once. What should I do now?

Move them all to the trash and empty it. If it doesn't completely empty, don't worry about it.

 

Reboot your computer and attempt to log in. You probably saw that another user got a blank screen at this point and had to reboot again. As I recall Linc had the same issue, so just restart it a second time and you should be OK. If there was anything left in the trash, empty it again.

Posted on Oct 5, 2011 5:41 PM

Close
noellle

Q: Finder shows strange letter and number strings, programs "quit unexpectedly"

  • All replies
  • Helpful answers

first Previous Page 3 of 13 last Next

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 5, 2011 5:20 PM in response to Linc Davis
    Level 5 (4,801 points)
    Oct 5, 2011 5:20 PM in response to Linc Davis

    Linc Davis wrote:

     

    Unfortunately ClamXav will only detect the installer which destroys itself after installation of the above files.

     

    That's news to me.

    News that it only detects the installer or that it destroys itself. Did your's not disappear?

    I'm afraid I don't, but I downloaded the installer from a link posted on Mailinator which I think you also had.

    Yes, I posted the link, but it would not let me download the file, possibly because I'm running Leopard on a PPC.

  • by Linc Davis,

    Linc Davis Linc Davis Oct 5, 2011 5:25 PM in response to MadMacs0
    Level 10 (208,037 points)
    Applications
    Oct 5, 2011 5:25 PM in response to MadMacs0

    I ran the "preinstall" executable in a shell, which was the only functional part of the installer. I don't recall that it deleted the installer, but maybe it would have if I had run it in the usual way.

  • by noellle,

    noellle noellle Oct 5, 2011 5:27 PM in response to MadMacs0
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 5:27 PM in response to MadMacs0

    Ok, so ClamXav finished scanning my computer only, and it did find some phising things and a worm. they might be from the folder of my Dad's old username, though, which is still there in a strange way from when he gave me his computer and then I got a new one....I doubt that's significant, but it's worth a mention.

     

    The issue still continued, as you thought it would.

     

    Now, I am looking for the files. I am not sure if you meant to look in my main hard drive Library or my username Library, if that makes sense (not sure of the terminology.)

     

    In my main drive Library, there is no LaunchAgents/com.apple.SystemUI.plist but there is just LaunchAgents/com.google.keystone.agent.plist . In my username Library, there is no Launch Agents folder.

     

    There are both the perflib file and the Preferences.dylib in my username Library/Preferences

     

    there is no Logs/swlog in either place.

     

    I have not done the .macosx one, since I figured I needed to do them all at once. What should I do now?

  • by MadMacs0,Solvedanswer

    MadMacs0 MadMacs0 Oct 5, 2011 5:41 PM in response to noellle
    Level 5 (4,801 points)
    Oct 5, 2011 5:41 PM in response to noellle

    noellle wrote:

     

    Ok, so ClamXav finished scanning my computer only, and it did find some phising things and a worm. they might be from the folder of my Dad's old username, though, which is still there in a strange way from when he gave me his computer and then I got a new one....I doubt that's significant, but it's worth a mention

    Remind me and we can deal with that later.

    noellle wrote:

     

    Now, I am looking for the files. I am not sure if you meant to look in my main hard drive Library or my username Library, if that makes sense (not sure of the terminology.)

    Sorry, we missed telling you that they are all in your user area.

    In my username Library, there is no Launch Agents folder.

    Sounds like a bug in the Trojan. IIRC it's not there by default, but most users eventually get one.

    There are both the perflib file and the Preferences.dylib in my username Library/Preferences

     

    there is no Logs/swlog in either place.

     

    I have not done the .macosx one, since I figured I needed to do them all at once. What should I do now?

    Move them all to the trash and empty it. If it doesn't completely empty, don't worry about it.

     

    Reboot your computer and attempt to log in. You probably saw that another user got a blank screen at this point and had to reboot again. As I recall Linc had the same issue, so just restart it a second time and you should be OK. If there was anything left in the trash, empty it again.

  • by noellle,

    noellle noellle Oct 5, 2011 5:57 PM in response to MadMacs0
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 5:57 PM in response to MadMacs0

    ok thanks...

     

    well, now I have moved the preferences.dylib to the trash, but it won't let me empty it cause it's "in use!"

     

    I will try again after I quit Safari maybe??????

  • by mudpize,

    mudpize mudpize Oct 5, 2011 6:00 PM in response to noellle
    Level 2 (155 points)
    Oct 5, 2011 6:00 PM in response to noellle

    Note: The MacOS file is a hidden file. I used Tinker Tool to expose the hidden files. You can then easily find the file and move it to the trash.

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 5, 2011 6:03 PM in response to noellle
    Level 5 (4,801 points)
    Oct 5, 2011 6:03 PM in response to noellle

    noellle wrote:

     

    ok thanks...

     

    well, now I have moved the preferences.dylib to the trash, but it won't let me empty it cause it's "in use!"

     

    I will try again after I quit Safari maybe??????

    No that won't help, you will have to log out first, but before you do that you MUST put the other files in the trash including removing the invisible one.  Otherwise you won't be able to log back in.

  • by noellle,

    noellle noellle Oct 5, 2011 6:04 PM in response to mudpize
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 6:04 PM in response to mudpize

    thank you, mudpize, because I tried to launch the terminal and it starts to open and just quits. There is no error message box like the other one. It just quits (maybe cause the other two files are in the trash?)

     

    I will download tinker tool and trust that it is a safe download!

     

    thank you!

  • by noellle,

    noellle noellle Oct 5, 2011 6:05 PM in response to MadMacs0
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 6:05 PM in response to MadMacs0

    Oh my gosh, madmacs0 - so you are saying that I should put only the two files that I could find, along with the hidden .macosxfile in the trash and then log out.

     

    It doesn't matter that I didn't find the logs/swlogs?

  • by noellle,

    noellle noellle Oct 5, 2011 6:13 PM in response to MadMacs0
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 6:13 PM in response to MadMacs0

    Ok, this is not good. I downloaded Tinkertool, right clicked on it to "show in finder," and the trash (where the two suspicious files are) opened up...Interesting.

     

    then, I decided to right click on it to scan it with the ClamXav tool, just in case. ClamXav started to launch and then quit. (no error message, just like terminal, but same thing that the infected aps used to do.)

     

    then, I tried both double clicking on Tinkertool and rightclicking on open and got the little animation like it was going to launch and then nothing.

     

    HELP!

  • by noellle,

    noellle noellle Oct 5, 2011 6:14 PM in response to noellle
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 6:14 PM in response to noellle

    If I put the two trashed files back, will the other things behave for a second?

  • by Linc Davis,

    Linc Davis Linc Davis Oct 5, 2011 6:21 PM in response to noellle
    Level 10 (208,037 points)
    Applications
    Oct 5, 2011 6:21 PM in response to noellle

    Reboot now, log in, and finish the job. The trojan is still running and it will crash any application you try to launch.

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 5, 2011 6:21 PM in response to noellle
    Level 5 (4,801 points)
    Oct 5, 2011 6:21 PM in response to noellle

    noellle wrote:

     

    If I put the two trashed files back, will the other things behave for a second?

    That's what I'd try and don't worry that you don't have the swlog file, I don't think it has an active role in this.

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 5, 2011 6:26 PM in response to MadMacs0
    Level 5 (4,801 points)
    Oct 5, 2011 6:26 PM in response to MadMacs0

    Here's another way to find that file.

     

    In the Finder select "Go To Folder..." from the "Go" menu or type Command-Shift-G.

     

    In the "Go to the folder:" dialog type "~/.MacOSX/" without the quotes.

     

    That will allow you to drag "environment.plist" to the trash.

  • by noellle,

    noellle noellle Oct 5, 2011 6:46 PM in response to MadMacs0
    Level 1 (4 points)
    Desktops
    Oct 5, 2011 6:46 PM in response to MadMacs0

    I put the two trashed files back, launched the Terminal (it worked!) and then dragged the command or whatever it's called over there and pressed enter.

     

    logged out, got blank screen, rebooted, everything is looking GREAT!!!!

     

    Yet, the thing in still in the trash. I will keep trying to empty it and will update.

     

    Thank you!!!!

first Previous Page 3 of 13 last Next