Currently Being ModeratedApr 1, 2012 6:55 PM (in response to Chametzoo)
Could be many things, we should start with this...
"Try Disk Utility
1. Insert the Mac OS X Install disc, then restart the computer while holding the C key.
2. When your computer finishes starting up from the disc, choose Disk Utility from the Installer menu at the top of the screen. (In Mac OS X 10.4 or later, you must select your language first.)
Important: Do not click Continue in the first screen of the Installer. If you do, you must restart from the disc again to access Disk Utility.
3. Click the First Aid tab.
4. Select your Mac OS X volume.
5. Click Repair. Disk Utility checks and repairs the disk."
Then try a Safe Boot, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, reboot when it completes.
(Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive.)
Currently Being ModeratedApr 1, 2012 7:23 PM (in response to Chametzoo)
Not necessariy a 10.6 issue only and nothing to do with the Snow Leopard security update problems (subsequently fixed by Apple with a new version.)
Open Terminal in Applications>Utilties and copy/paste
defaults read ~/.MacOSX/environment
Hit return. "If it says something about "DYLD_INSERT_LIBRARIES" then you are infected with a variant of the Flashback Trojan. If it says something else or doesn't find the file you're OK."
See this related thread starting with jsd2's post.
Also this very long thread. Look at the last several pages.
If you are infected, since no one knows exactly all the possible locations of the infection, use a TM backup or clone that doesn't show the infection. If not possible, best to do a complete clean install.
Currently Being ModeratedApr 1, 2012 7:36 PM (in response to WZZZ)
It doesn't seem Intego, who first reported this, is yet aware of the latest developments regarding the effect of the later variants of this Trojan on PPC/Rosetta apps (this has been popping up lately kind of frequently here) but do a search for "Flashback Trojan."
Currently Being ModeratedApr 1, 2012 9:47 PM (in response to Chametzoo)
Yes... I've got DYLD_INSERT_LIBRARIES. Would it help to upgrade to 10.6? If I have to reinstall the system, what's a good way to do that. (i.e. easiest.) I have a lot of applications to reinstall.
Currently Being ModeratedApr 1, 2012 10:12 PM (in response to Chametzoo)
Snow Leopard/10.6.x Requirements...
* Mac computer with an Intel processor
* 1GB of memory (I say 4GB at least)
* 5GB of available disk space (I say 30GB at least)
* DVD drive for installation
* Some features require a compatible Internet service provider; fees may apply.
* Some features require Apple’s MobileMe service; fees and terms apply.
Which apps work with Mac OS X 10.6?...
It looks like they might still have it...
If it's a core Duo & not a Core2Duo, then it'll only run in 32 bit mode.
Lion/101.7 System requirements
• x86-64 processor (Macs with an Intel Core 2 Duo, Intel Core i3, Intel Core i5, Intel Core i7, or Xeon processor.)
• At least 2GB of memory
• Latest version of Mac OS X Snow Leopard (10.6.8), with the Mac App Store installed
• At least 4GB of disk space for downloading
Like Snow Leopard, Lion does not support PowerPC-based Macs (e.g., Power Macs, PowerBooks, iBooks, iMacs (G3-G5), eMacs).
Lion also does not support 32-bit Intel Core Duo or Core Solo based Macs. Rosetta is no longer available in Lion, which means Lion no longer supports PowerPC applications.
What applications are not compatible with Mac OS X 10.7 "Lion"?
Currently Being ModeratedApr 1, 2012 11:32 PM (in response to Chametzoo)
Yes... I've got DYLD_INSERT_LIBRARIES. Would it help to upgrade to 10.6?
No, the Trojan is most probably installed in your home folder, depeding on when it was installed. Read the Infection Type 2 section at the bottom of http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml.
If you have a TimeMachine backup and can determine the date/time of infection from the installed files, you should restore from just before that. Otherwise...
Courtesy of Linc Davis:
I suggest you take the following steps immediately:
1. Back up all data to at least two different devices, if you haven't already done so.
2. Boot from your recovery partition (if running Mac OS X 10.7 or later) or your installation disc (if running an earlier version of the Mac OS), launch Disk Utility, and erase the startup drive. This action will destroy all data on the drive, so you must be sure of your backups.
3. Install the Mac OS.
4. Reboot and go through the initial setup process to create an account. Don’t import anything from your backups at this stage.
5. If running Mac OS X 10.6.x or earlier, run Software Update.
6. Restore the contents of all the top-level subfolders of your home folder except “Library” from the most recent backup. You can also restore the files in the Library folder, but don’t restore any of its subfolders; only the files contained in those folders, and only if they’re visible in the Finder. Don’t restore any hidden files or folders, no matter where they are.
8. Change every Internet password you have, starting with banking passwords. Check all financial accounts for unauthorized transactions. Take this step only after you’ve secured your system in the preceding steps, not before.
9. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated. If you use any third-party web browsers under Mac OS X 10.5.x or earlier, disable Java in their preferences, as you did with Safari in step 7.
Currently Being ModeratedApr 2, 2012 4:46 AM (in response to MadMacs0)
Don’t restore any hidden files or folders, no matter where they are.
Mad, great advice, except how will the average user avoid restoring any hidden (dot) files or folders, since, by defintion, they are hidden? Toggle visibility from Terminal or with TinkerTool while restoring?
Currently Being ModeratedApr 2, 2012 8:50 AM (in response to WZZZ)
Linc answered this here.