Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

0 points

"Rosetta" applications suddenly stopped working

I've got a problem with my computer at work. It's running Snow Leopard 10.6.8. I've got a number of older apps, including Quark 6, Epson scanner software, Disc Catalog, etc, that have all been working fine for the last number of years. As of yesterday afternoon, I was still scanning with the Epson software and everything was running fine. When I came in to work this morning and fired up the computer, NONE of my pre-Snow Leopard apps work.

At first, when a few of my apps didn't work, I suspected a font issue, because at the end of the previous day, I was working on a "problem job" that had conflicts with my basic system fonts. But, as the hours passed, I began to realize none of my older apps worked. At that point, I started to suspect a problem with Rosetta.

Hours and hours of searching, both here and across the internet came up with nothing. A few sites gave step by step instructions to drop into terminal to reset bindings, delete preferences, etc. Nothing worked.

Most of the older apps I NEED for our company. Many of those don't have upgrades available, and some are just too expensive to justify.

After almost an entire day of getting nowhere, I decided to set up another "user" called Troubleshooting. Lo-and-behold, all of the apps worked fine. So, that ruled out a problem with the Rosetta interface, and the suspeced Security update in the recent past that was said to cause problems with the whole Rosetta interface.

So, my question is, since only my original Administrator User is not functioning properly, is there possilby a preference .plist file that could be causing the problem? Could there still be a font issue? Is there anything I can do in Terminal to reset to a default?

I wasted an entire day banging my head on the desk trying to wrap my brain around it. Repairing permissions, disc check, etc. did nothing to help the issue.

I COULD get around the problem by logging into my "Troubleshooting" user to use the apps...but that's beside the point. I COULD do that, but I really want to figure out what's going on with my main User workspace.

So, before I need to come into work on Monday and spend another whole day not knowing what to do, can anyone offer any ideas?

Thanks in advance.

Brad

PowerMac, Mac OS X (10.6.8)

Posted on Mar 23, 2012 6:37 PM

128 replies

NuLynx Author

Level 1

0 points

Mar 27, 2012 7:07 PM in response to X423424X

Yeah...page 2. (Yup, a lot of posts on this string). It was when you asked me to try the "file" command again, and I asked you what I had going wrong with my string of commands.

I wrote:

"I tried those with a few different applications. With fetch 5.0, I entered, and got:

Leopard:~ Panther$ /Applications/Fetch.app/Contents/MacOS/Fetch

The hard drive churned along for quite a number of minutes, but nothing happened.

When I tried Smasher, I entered and got:

Leopard:~ Panther$ /Applications/Utilities/Smasher/Smasher.app/Contents/MacOS/Smasher

2012-03-26 15:33:47.098 Smasher[1068:903] licensed.

Same results the first 4 times I tried...nothing was happening, and it just sat there with the hard drive spinning.

Then, I tried it again, and Smasher launched!

So, I quit out of it, and tried to launch it again by directly clicking on the app...got the same unexpectedly quit error."

So far, that's been the only app that's actually launched, including some newer apps than that one. But, for some reason, it launched from Terminal, but not by just clicking on either the app or the alias in the dock.

It hasn't ALWAYS been that way. Like I said in my reply, for the first 4 attempts it just sat there with the hard drive chattering away. Then, on the 5th, it launched. Still no luck just clicking on the app, though.

jsd2

Level 5

6,245 points

Mar 28, 2012 8:27 AM in response to NuLynx

hmm....

I have a machine where only 1 user account cannot run Rosetta applications.

Other problems with recent security update:

NuLynx Author

Level 1

0 points

Mar 28, 2012 9:04 AM in response to X423424X

X423424X wrote:

Another terminal command line. What does this report, if anything:

LaunchCFMApp /Applications/DiscCat/DiskCatalog

And if it says it cannot find LaunchCFMApp then do the following (this is one line):

/System/Library/Frameworks/Carbon.framework/Versions/A/Support/LaunchCFMApp /Applications/DiscCat/DiskCatalog

LaunchCFMApp /Applications/DiscCat/DiskCatalog

gave me this:

Leopard:~ Panther$ LaunchCFMApp /Applications/DiscCat/DiskCatalog

-bash: LaunchCFMApp: command not found

But:

/System/Library/Frameworks/Carbon.framework/Versions/A/Support/LaunchCFMApp/Appl ications/DiscCat/DiskCatalog

actually worked! DiskCatalog opened just fine...just like it should.

kr11048

Level 1

1 points

Mar 28, 2012 10:02 AM in response to NuLynx

Allow me to chime in. Same exact issue. In main user acct no PPC apps work (used System Profiler to identify all my PPC apps--none work). All give message like "Filemaker Pro unexpectedly quit" A new user account works normally. I've had the problem since installing the Security Update. Wasn't messing with fonts etc. so unless something happened randomly, it's not a font issue for me. Installation of Security update 1.1 did nothing. Re-installation of 10.6.3 did nothing since the same user acct was maintained. Is there a quick easy way to migrate one user's prefs to another user, but one by one, so if there's a problematic one I can eliminate it.

Mar 28, 2012 10:04 AM in response to NuLynx

Hi,

If anyone else is seeing this problem with rosetta apps not working for a particular user, please can you check/try the following :

1. Log in to the problematic account.

2. Open the Terminal program in utilites, you should already be in the user directory so just type the following :

cd .MacOSX

If this gives - No such file or directory, then you have a different problem to what I am seeing, so you can stop here.

3. Now type :

mv environment.plist environment.plist.old

4. Quit terminal, then restart the machine.

5. When logged back in, try opening your rosetta apps, and see if it now works.

I'll post some more info about this, once I've done some more digging.

bobtib.

jsd2

Level 5

6,245 points

Mar 28, 2012 10:36 AM in response to Brian Stroud

Brian,

If you had an environment.plist file inside that .MacOSX folder, highlight and hit <space> to QuickLook it. If you then see something there that includes "DYLD_INSERT_LIBRARIES", then take a look at:

Flashback Mac Trojan Horse Infections Increasing with New Variant

and

Are you having a (Mac) Flashback?

kr11048

Level 1

1 points

Mar 28, 2012 11:52 AM in response to Brian Stroud

Success! Thanks very much!

MadMacs0

Level 5

5,221 points

Mar 28, 2012 12:00 PM in response to jsd2

I have found this article http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml to be slightly more useful, although I have not yet been able to confirm infection by this variant. Note that a type 2 sub-variant will insert code into all launched applications.

MadMacs0

Level 5

5,221 points

Mar 28, 2012 12:05 PM in response to kr11048

kr11048 wrote:

Success! Thanks very much!

It's important to note that there are at least A-N variants of this Trojan and the more recent have two types, so attempting to clean it out is risky. Recommendations from most here are as follows (courtesy of Linc Davis):

You need to take the following steps immediately:

1. Back up all data to at least two different storage devices, if you haven't already done so.

2. Boot from your installation disc, launch Disk Utility, and erase the internal drive.

3. Reinstall the Mac OS.

4. Reboot and go through the initial setup process. Import from your backup only user data and settings, not applications or other files.

5. Run Software Update.

6. Change every Internet password you have. Check all financial accounts for unauthorized transactions.

7. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated.

8. Learn safe computing practices.

NuLynx Author

Level 1

0 points

Mar 28, 2012 12:28 PM in response to Brian Stroud

Brian Stroud wrote:

3. Now type :

mv environment.plist environment.plist.old

When type it I get:

mv: rename environment.plist to environment.plist.old: Permission denied

And, yeah, this is an administrator account, if that makes any difference.

X423424X

Level 6

14,265 points

Mar 28, 2012 12:40 PM in response to NuLynx

I haven't heard of any trojan variant that prevents ppc apps from running (seems rather pointless) unless it is a accidential byproduct of the trojan code. It is true that flashback trojan would break stuff. So just in case, type (copy/paste) the following terminal commands:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

ls -la /Users/Shared/*.so

If these produce anything other than errors then the trojan is there. There are other potential files in other places too but start here.

MadMacs0 wrote:

It's important to note that there are at least A-N variants of this Trojan and the more recent have two types, so attempting to clean it out is risky.

It's up to N now. What is it? A variant per week? Sigh 😟

MadMacs0

Level 5

5,221 points

Mar 28, 2012 12:44 PM in response to NuLynx

NuLynx wrote:

mv: rename environment.plist to environment.plist.old: Permission denied

And, yeah, this is an administrator account, if that makes any difference.

Try "sudo mv environment.plist environment.plist.old" without the quotes and hit return.

At the Password: prompt, enter your admin password. You will not see any typing, just hit return.

Mar 28, 2012 1:17 PM in response to jsd2

JSD2 thanks for that,

I guessed that it was something fishy, as the environment file referenced another hidden file (libgmalloc) in the User/Shared/ folder and that in turn referenced another hidden file (FlashEXEShell.tmp) in the ~Library/Application Support/ folder.

On trying to view the contents of FlashEXEShell.tmp in TextEdit I am presented with the following dialog

So at least I know how long the little bugger has be in the system.

Is there anyway to find out where this was downloaded from? (Unfortunatley I trashed my caches / history trying to solve the original problem)

NuLynx Author

Level 1

0 points

Mar 28, 2012 1:47 PM in response to MadMacs0

MadMacs0 wrote:

Try "sudo mv environment.plist environment.plist.old" without the quotes and hit return.

At the Password: prompt, enter your admin password. You will not see any typing, just hit return.

That worked, but I got "no such file or directory"

So, I guess I'm still back to where I was to begin with.

Thanks anyway.

Brad

X423424X

Level 6

14,265 points

Mar 28, 2012 2:03 PM in response to NuLynx

Of course you are going to get "no such file or directory" because that command is incorrect (syntax, mv source target). First I think you should try my suggestion because there are other files involved although environment.plist is usually one of the key ones.

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

ls -la /Users/Shared/*.so

Then if you want to move it the correct syntax is:

sudo mv ~/.MacOSX/environment.plist ~/.MacOSX/environment.plist.old

You don't have to cd to the .MacOSX directory to move the file in there. But if you insist:

sudo mv environment.plist environment.plist.old

"Rosetta" applications suddenly stopped working