skype wont reopen after powercut

It is possible your drive(s) were left in a unknown state when the power went out. So run Disk Utility to repair/verify your drive(s). Use your installer dvd or another external bootable drive to repair the boot drive.

inteleguan wrote:

Also Finder is partially corrupt. Some of the text was replaced by codes. From what I found on forums. Symptoms are similar to Flashback Trojan. But I didn't find any of files mentioned and related with Flashback. But I didn't find Xprotect files either.

Your profile says you are running Mac OS X 10.6.2. If that is still true then you don't have XProtect and Java is vulnerable to attack by the latest FlashBack version.

If you do believe you are up-to-date with all your Snow Leopard software, then check to see if you have the latest version of Jave by typing "java -version" without the quotes, followed by a return, or launch Java Preferences from your Utilities folder and see if you have J2SE 1.6.0_29 installed. If Software Update doesn't take care of it you can download it from Java for Mac OS X 10.6 Update 6.

I'm not sure this will deactivate the Malware, but a couple of folks were able to eliminate these symptoms yesterday.

inteleguan wrote:

OK, following another threads, I installed older version of Skype (2.8) and it works. but Finder is still corrupted, and bunch of others programs doesn't work. Also iTunes doesn't recognize my iPhone...

I thought you said you were using the erase and re-install approach. That's still the recommended way to get rid of this thing, not simply using software update. That just protects you against future infection.

To make certain we know that you are infected and with what, follow these instructions from fane_j and others. Open the Terminal application (in /Applications/Utilities/), copy and paste the following command into a terminal window and press return.

defaults read ~/.MacOSX/environment

If the file doesn't exist, defaults returns

Domain /Users/.MacOSX/environment does not exist

If it does exist, it returns its contents.

The malware entry will look something like this:

{

"DYLD_INSERT_LIBRARIES" = "/Users/Shared/..so";

}

Do not attempt to remove any Trojan related files without specific instructions from myself or someone who has already dont this as you can easily lock yourself out of logging back in to your account.

inteleguan wrote:

so....it came back with DYLD INSERT LIBRARIES stuff..

Copy and paste it here as I need the information in order to tell you what to look for.

Select "Go to Folder" from the "Go" menu of the Finder (or type Command-Shift-G).

In the window copy and paste the following:

~/.MacOSX/ and hit return.

Make note of the date the file "environment.plist" was created / modified then drag it to the trash.

Open the Terminal app (found in /Applications/Utilities/)

Copy and paste the following commands into a Terminal window after the "$ " prompt, followed by the return key:

rm -rf "~/Library/Application Support/.SuperListv.so"

rm -rf ~/Library/Logs/vmlog

rm -rf /Users/Shared/.SuperListv.so

rm -rf /Users/Shared/.svcdmp

You will not receive confirmation of deletion, but you may be told that some of the files do not exist as not all have been found by all users.

Holding down the option key, select "Empty Trash" from the Finder menu, then restart your computer. All the visible signs of the Trojan should be gone at this point.

Again I want to emphasize that we do not know enough about this Trojan to be confident all the damage has been repaired. You are still advised to make certain you have a solid backup of your data and using the original installation disks, install and upate OS X and all your applications from a trusted source. Then restore your data files from backup. Or use TimeMachine to take you back to the date you were infected.

And lastly, Intego has discovered that the Trojan attempts to sniff out usernames and passwords that you enter into many popular sites (like banking sites, Google, PayPal, and others), presumably so that the malfeasants behind the software can exploit that information in other nefarious ways, and sends them back via Twitter. You should assume that happened and change the passwords for all such accounts that you have visited since being infected along with any other accounts that use the same password.

inteleguan wrote:

Is there possibility that I actually brought the trojan on my iPhone?

Not that anybody knows of. iOS is very different from OS X, so it would be extremely difficult for that to happen.

And how I protect my Mac from the future attacks?

Use a non-admin account for routine computing and the admin account only to do "admin" tasks.

Disable Java in your browsers. It's rarely used by any but malware sites any more. If you find a site which needs it, you trust it and must use it, turn it on for that session and off when you're finished.

Don't blindly approve dialogs asking for your admin password or permission to do things like ignore an invalid Certificate. Check them out first to make sure they are what they appear to be.

Stay away from pirate and torrent sites that dispense software or media files (e.g. music, movies...). Always try to download software and updates directly from the developers site or a trusted third party site (e.g. MacUpdate, C|NET VersionTracker...) or the AppStore.

How to install OS with deleting all my files?

Don't. Backup your files, format the HD, install the OS and applications from source, then copy those files from backup.

little quirk: iTunes still doesn't recognise the iPhone

I've been seeing questions about that this week from a couple of other folks on e-mail lists. Not sure what the problem/solution is.