mudpize

Q: finder corrupt? - Strange characters in menu

I restarted my computer because it felt bogged down. Upon re-start I can no longer open Word, Excel etc...I have 2004 copies. I can re-install or upgrade. But the real strange thing is that my finder how shows items like this in the menu:

 

Under File L1,

 

Edit Menu -  ME13, ME6, ME1 (all with shortcuts like AppleZ)

 

Other menus have the same pecularities...

 

Then on the Dock if I right click on the finder it says: N80, N81, N82, N83, N84

 

Is my Finder corrupted? How do I get rid of this? It doesn't seem to effect anything else but is worrisome. Thanks.

iMac 2.6GHZ Intel, Mac OS X (10.6.7)

Posted on Sep 30, 2011 12:25 PM

Close

Q: finder corrupt? - Strange characters in menu

  • All replies
  • Helpful answers

first Previous Page 3 of 4 last Next
  • by X423424X,

    X423424X X423424X Oct 1, 2011 6:56 PM in response to mudpize
    Level 6 (14,237 points)
    Oct 1, 2011 6:56 PM in response to mudpize

    Remember I did mention that removing stuff like the entire /Preference folder was likely to "break stuff" and that you only want to get into the account long enough to see if the finder menus were showing correctly.  I also recommended you use a backup copy (basically totally expendable) of your "real" disk.  With the backup you could do all the damage you want without sacrificing the original.

  • by Linc Davis,

    Linc Davis Linc Davis Oct 1, 2011 7:02 PM in response to mudpize
    Level 10 (208,037 points)
    Applications
    Oct 1, 2011 7:02 PM in response to mudpize

    You lost nothing. Put back the files you moved, log out, and log back in.

  • by X423424X,

    X423424X X423424X Oct 1, 2011 7:28 PM in response to Linc Davis
    Level 6 (14,237 points)
    Oct 1, 2011 7:28 PM in response to Linc Davis

    I never said he lost anything, only that he could "break" stuff.  Yes you can always put the stuff back.  I was only trying to point out that it's a lot easier just to work with a copy so you don't have to put all the stuff back.

  • by mudpize,

    mudpize mudpize Oct 1, 2011 7:49 PM in response to X423424X
    Level 2 (155 points)
    Oct 1, 2011 7:49 PM in response to X423424X

    Yes you absolutely warrned me! Some files would not let me move them back i.e. Keychains and Preferences. Can I take the .plist that is related to keychain in preferences and move it back? Actually even if I don't get my keychains  back I'm okay. Definitely could have been worse and I restored the main ones for Mail and Cyberduck.

     

    Well I just installed Microsoft Office 2008 and trashed the old copy. It all works and runs good. Remember this was also an issue that occured at the same time I have the numbers in my finder. Well those numbers still persist. But office works.

     

    Any more ideas? Anything in the hidden files? I really appreciate all your help.

  • by X423424X,

    X423424X X423424X Oct 1, 2011 8:24 PM in response to mudpize
    Level 6 (14,237 points)
    Oct 1, 2011 8:24 PM in response to mudpize
    Can I take the .plist that is related to keychain in preferences and move it back?

    If you can get it back in with the same permissions owner and group I don't see why not.

     

    Any more ideas? Anything in the hidden files? I really appreciate all your help.

     

    Whatever happened to replacing the entire ~/Library/Preferences directory?  While there is stuff "above that" in ~/Library as implied by Davis earlier you got to start somewhere. 

  • by mudpize,

    mudpize mudpize Oct 2, 2011 10:00 AM in response to X423424X
    Level 2 (155 points)
    Oct 2, 2011 10:00 AM in response to X423424X

    This sounds similar to my issue and the path I went down. However, I did not install a "haxie." The issue I am experiencing is similar though as the contextual menu is numbers and letters. I'd like to try this copying from my laptop finder and replacing the desktop finder where the issue occurs. How do I see the file to copy? Even with Tinker Tool I cannot see the Finder.app -or- what is the command to copy from Terminal?

     

    http://www.viesign.com/blog/apple/95-finder-context-menu-messed-up

  • by X423424X,

    X423424X X423424X Oct 2, 2011 12:01 PM in response to mudpize
    Level 6 (14,237 points)
    Oct 2, 2011 12:01 PM in response to mudpize

    The fact that you say only your specific account has the problem and no others tells me the finder is fine.  But if insist on playing around with system components I'll reiterate again, have a backup.

     

    The finder must be where that article you reference says it is,

     

    /System/Library/CoreServices/Finder.app

     

    All you have to do in terminal is the following to confirm that:

     

    ls -ld /System/Library/CoreServices/Finder.app

     

    The command to copy it from some other volume would be,

     

    sudo cp -rp /Volumes/volumename/System/Library/CoreServices/Finder.app /System/Library/CoreServices/

     

    where volumename is the name of the source volume.  Sudo will cause a prompt for your admin password.

  • by mudpize,

    mudpize mudpize Oct 2, 2011 7:30 PM in response to X423424X
    Level 2 (155 points)
    Oct 2, 2011 7:30 PM in response to X423424X

    Thanks for the info. I am probably not going to attempt this right now as I am too busy. I am leaving in a couple days for a few weeks. Won't be touching this desktop while gone. I will definitely backup before I attempt this and if I resolve the situation I'll post back with the solution. If anyone else has ideas or has come upon this same issue I would appreciate input. In the meantime, Thank you X423424X & LINC for the incredible help you have given on this very perplexing issue!

  • by Linc Davis,

    Linc Davis Linc Davis Oct 5, 2011 10:28 AM in response to mudpize
    Level 10 (208,037 points)
    Applications
    Oct 5, 2011 10:28 AM in response to mudpize

    Although you seem to have ruled it out, you should check that you're not infected with the "Flashback" trojan by download and running the malware detector ClamXav. See the following thread:

     

    Finder shows strange letter and number...: Apple Support Communities

  • by mudpize,

    mudpize mudpize Oct 5, 2011 12:02 PM in response to Linc Davis
    Level 2 (155 points)
    Oct 5, 2011 12:02 PM in response to Linc Davis

    Wow, this exactly my issue. I am running a scan with ClamXav right now! Thanks so much...I'll report back.

  • by mudpize,

    mudpize mudpize Oct 5, 2011 1:23 PM in response to mudpize
    Level 2 (155 points)
    Oct 5, 2011 1:23 PM in response to mudpize

    I'm running the scan. It's going to take a long time. But I can already tell you I am seeing things like Trojan-234 & BC. Heuristic.Trojan being reported in some instances. UGH!

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 5, 2011 2:36 PM in response to mudpize
    Level 5 (4,801 points)
    Oct 5, 2011 2:36 PM in response to mudpize

    mudpize wrote:

     

    I'm running the scan. It's going to take a long time.

    I don't believe that ClamXav will be able to find it as it only looks for the installer which destroys itself when finished with the installation. There is also evidence that the installer signatures are being changed by the bad guys periodically.

     

    The only way I know of to be sure whether you have been infected or not is to look for those five files that Linc pointed out. If you only have the first one in the hidden folder, then that's OK, but the other four are unique to this Trojan.

     

    If you have been infected, you need to remove all five files during the same session. If you don't you might not be able to log back into your account.

    But I can already tell you I am seeing things like Trojan-234 & BC. Heuristic.Trojan being reported in some instances. UGH!

    If the infection names don't contain the letters "OSX" then chances are good that they are not Mac OS X malware. The Heuristic one might possibly be since it bases it's judgement on a best guess rather than a specific signature, but there are often false alarms with the heuristic ones.

  • by mudpize,

    mudpize mudpize Oct 5, 2011 3:19 PM in response to MadMacs0
    Level 2 (155 points)
    Oct 5, 2011 3:19 PM in response to MadMacs0

    I've located all 5 of those files that you have referenced on the other thread.

     

    .MacOSX/environment.plist is a hidden file but I turned on Tinker Tool to locate. Shall I remove the whole folder there or just the file there?

     

    Thanks.

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 5, 2011 3:34 PM in response to mudpize
    Level 5 (4,801 points)
    Oct 5, 2011 3:34 PM in response to mudpize

    mudpize wrote:

     

    I've located all 5 of those files that you have referenced on the other thread.

     

    .MacOSX/environment.plist is a hidden file but I turned on Tinker Tool to locate. Shall I remove the whole folder there or just the file there?

    Just the file. The folder is normally present in every user account and sometimes contains a good environmental.plist, but the installer completely replaces whatever is there with the one you have.

     

    Edit: Instead of trashing the files, can you temporarily move them all to a folder somewhere like your desktop. I may need to ask you to upload them to a couple of AV Sample databases so we can get the AV community working on coming up with signatures for them.

  • by mudpize,

    mudpize mudpize Oct 5, 2011 3:41 PM in response to MadMacs0
    Level 2 (155 points)
    Oct 5, 2011 3:41 PM in response to MadMacs0

    Okay will do. I'll let you know soon how it goes. Thanks!

first Previous Page 3 of 4 last Next