Application began unexpectedly quitting

If you have Time Machine backups then it would be helpful to know the date of infection so that you could restore your entire system to a state before that date. I'm not certain, but that date might correspond to the modification date on the environment.plist file that the Trojan created on your system. Before deleting that file with the first command given by X423424X, I'd suggest running this command first, and writing down the date in the response line:

ls -la ~/.MacOSX/environment.plist

Sorry, I don't use TM so I hope others comment here.

Dennis Robinson4 wrote:

OK, here is where I am.

I did not know how to restore from the time machine and was afraid if I did I would bring my bug with it, so I dragged files over to the new window.

Well I use TimeMachine, but have not really had to do a restore, yet (madly knocking on wood)!

I would not be using the Finder to copy files as it was designed to work as described in Mac 101: Time Machine.

Here are the problems I am having so far, maybe I can get some help.

Address Book and Calendar are empty and I am unable to find the back up files to re-load them.

Also in Safari I am unable to find my bookmarks.

For Address Book and Calendar I'm going to guess ~/Library/Applications Support/Address Book/ and .../iCal/ respectively.

And Safari looks to be ~/Library/Safari/

See Questions 15 and 28 in Pondini's FAQ section here:

http://pondini.org/TM/FAQ.html

Well I hate to say it but just as this thread appears to be winding down yet another thread appeared on the same problem. I gave my "usual reply" but I am mentioning this here in case anyone wants to chime in all over again on the same subject.

Office 2004 unexpectedly quits

At least this time there's been enough occurrences that I could cut to the chase almost immediately.

Copy and paste the commands...where?

I assume you are referring to my other post (it would have been nice if you had quoted some context in your post here). I did say they were terminal command that you copy/paste into a terminal window.

bluetopazocean wrote:

Copy and paste the commands...where?

Into the Terminal app window after the "$ " prompt.

What problem are you trying to solve? If you have the Flashback Trojan and are referring to the post I think you are, that's no longer the recommended solution. Depending on when you were infected and with what there is new data out today on how to deal with it. Here's today's best advice:

Courtesy of Linc Davis:

You installed a variant of what’s commonly called the “Flashback” malware, although the name is obsolete.

If you’re absolutely sure you know when that happened, and you back up with Time Machine or something similar, you can save yourself a lot of time by restoring your whole system from the most recent snapshot taken before it was infected. Then take Steps 7, 8, and 10 below.

How can you tell when the infection took place? All you can be sure of is that you were infected some time before the problems started. You may have visited a blog that prompted you to install some kind of software, or a “certificate.” If you remember doing that recently, mention it in a reply, but don’t post a link.

If you don’t know when you were infected, there's no easy, reliable way to remove the malware, because it's constantly changing. I suggest you take the following steps immediately:

1. Back up all data to at least two different devices, if you haven't already done so.

2. Boot from your recovery partition (if running Mac OS X 10.7 or later) or your installation disc (if running an earlier version of the Mac OS), launch Disk Utility, and erase the startup drive. This action will destroy all data on the drive, so you must be sure of your backups.

3. Install the Mac OS.

4. Reboot and go through the initial setup process to create an account with the same name as your old one. Don’t import anything from your backups at this stage.

5. If running Mac OS X 10.6.x or earlier, run Software Update. You may have to run it more than once to fully update your system.

6. Restore the contents of the top-level subfolders of your home folder except “Library” from the most recent backup. The Library folder may contain components of the malware. It’s best not to restore anything from there. If you must do so, restore only files, not folders, and only if they’re visible in the Finder, and then only if you’re absolutely sure you know what they are and they haven’t been altered. Don’t restore anything in the home subfolder Library/LaunchAgents, if it exists, or any hidden files or folders, no matter where they are.

7. Launch Safari and select Safari ▹ Preferences… ▹ Security from the menu bar. Uncheck the box labeled Enable Java. Because of recurring security issues, the Java web plugin must be considered unsafe to use. (Note: I’m not referring to JavaScript, which is unrelated to Java, despite the similar names.) Very few websites have legitimate Java content nowadays. If you encounter one that does, and you think you can trust it, enable Java temporarily. Do this only if you know how to check for a malware infection immediately afterwards. If you’re not sure whether you know how to check, you don’t know how. Don’t rely on any kind of “anti-virus” software for protection.

8. Change every Internet password you have, starting with banking passwords. Check all financial accounts for unauthorized transactions. Take this step only after you’ve secured your system in the preceding steps, not before.

9. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated.

10. If you use any third-party web browsers, disable Java in their preferences, as you did with Safari in step 7.

More information about Flashback can be found by searching this site, or the Web.