Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Safari quitting due to Microsoft Office Genuine plug in?

Hi there,

I've always been as safe as I know how to be with my mac. In case it is relevant, I run sophos security through my school and don't have any pirated software or files. That being said, Safari has been quitting very frequently. Many programs crash for no reason but none as often as safari. The reason it always offers is that something about the microsoft office genuine plugin. I think it's called microsoftofficegenuine.so

I don't even run microsoft office... I had a legal 2004 edition a few months ago but it refused to open so I deleted it and now run openoffice. I do have silverlight though, because of netflix.


So far to fix the problem I have run software updates & installed those and repaired disk permissions via disk utility. I deleted the "microsoft updates" file (might have been a bad idea) and also, when I try to open this plugin it mentions, or search it on my system, it doesn't show anything, so I can't delete that. I've checked for this new flashback trojan but that website to check your UUID says mine is not reported as being infected...whatever that means.


Also, something that has been gradually getting worse over the last few months:

I've noticed that some of my right click options have changed from names such as "open" and "open with" to numbers like N160. Most recently some of my finder options in the left tool bar have changed to S5, S6, S7, etc. Perhaps in my angst to fix things I deleted an important file...


Please help! I can't function like this!



UPDATE: It crashed again moments after posting this and I copied the details of the crash report:


Process: Safari [156]

Path: /Applications/Safari.app/Contents/MacOS/Safari

Identifier: com.apple.Safari

Version: 5.1.5 (6534.55.3)

Build Info: WebBrowser-75345503~2

Code Type: X86-64 (Native)

Parent Process: launchd [102]



PlugIn Path: /Users/Shared/.MicrosoftOfficeGenuine.so

PlugIn Identifier: .MicrosoftOfficeGenuine.so

PlugIn Version: ??? (???)



Date/Time: 2012-04-09 22:18:55.202 -0400

OS Version: Mac OS X 10.6.8 (10K549)

Report Version: 6



Interval Since Last Report: 357229 sec

Crashes Since Last Report: 20

Per-App Interval Since Last Report: 1902 sec

Per-App Crashes Since Last Report: 1

Anonymous UUID: 324357C3-1DE8-4EE1-B242-EBBBE736E961



Exception Type: EXC_CRASH (SIGABRT)

Exception Codes: 0x0000000000000000, 0x0000000000000000

Crashed Thread: 1



Application Specific Information:

abort() called



Thread 0: Dispatch queue: com.apple.main-thread

0 libSystem.B.dylib 0x00007fff82924d7a mach_msg_trap + 10

1 libSystem.B.dylib 0x00007fff829253ed mach_msg + 59

2 com.apple.CoreFoundation 0x00007fff83158902 __CFRunLoopRun + 1698

3 com.apple.CoreFoundation 0x00007fff83157d8f CFRunLoopRunSpecific + 575

4 com.apple.HIToolbox 0x00007fff801aa74e RunCurrentEventLoopInMode + 333

5 com.apple.HIToolbox 0x00007fff801aa553 ReceiveNextEventCommon + 310

6 com.apple.HIToolbox 0x00007fff801aa40c BlockUntilNextEventMatchingListInMode + 59

7 com.apple.AppKit 0x00007fff819ffeb2 _DPSNextEvent + 708

8 com.apple.AppKit 0x00007fff819ff801 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 155

9 com.apple.Safari.framework 0x00007fff873eab48 -[BrowserApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 177

10 com.apple.AppKit 0x00007fff819c568f -[NSApplication run] + 395

11 com.apple.AppKit 0x00007fff819be3b0 NSApplicationMain + 364

12 com.apple.Safari.framework 0x00007fff875a7e6a SafariMain + 200

13 com.apple.Safari 0x0000000100000f1c 0x100000000 + 3868



Thread 1 Crashed:

0 libSystem.B.dylib 0x00007fff829979ce __semwait_signal_nocancel + 10

1 libSystem.B.dylib 0x00007fff829978d0 nanosleep$NOCANCEL + 129

2 libSystem.B.dylib 0x00007fff829f43ce usleep$NOCANCEL + 57

3 libSystem.B.dylib 0x00007fff82a13a00 abort + 93

4 libstdc++.6.dylib 0x00007fff841845d2 __tcf_0 + 0

5 libobjc.A.dylib 0x00007fff87e8cb4d _objc_terminate + 120

6 libstdc++.6.dylib 0x00007fff84182ae1 __cxxabiv1::__terminate(void (*)()) + 11

7 libstdc++.6.dylib 0x00007fff84182b16 __cxxabiv1::__unexpected(void (*)()) + 0

8 libstdc++.6.dylib 0x00007fff84182bfc __gxx_exception_cleanup(_Unwind_Reason_Code, _Unwind_Exception*) + 0

9 libstdc++.6.dylib 0x00007fff8413ea3e std::__throw_length_error(char const*) + 127

10 libstdc++.6.dylib 0x00007fff841693fe std::string::append(char const*, unsigned long) + 82

11 .MicrosoftOfficeGenuine.so 0x000000010000e1bc dylibmain + 5910

12 com.apple.CFNetwork 0x00007fff84404dd7 HTTPReadFilter::readHeaderBytes(StreamReader*, unsigned char, unsigned char*, long, CFStreamError*) + 421

13 com.apple.CFNetwork 0x00007fff84405d4c HTTPReadFilter::canReadNoSignal(StreamReader*, CFStreamError*, unsigned char) + 110

14 com.apple.CFNetwork 0x00007fff843b352c HTTPReadFilter::streamCanRead(__CFReadStream*) + 90

15 com.apple.CFNetwork 0x00007fff843b36a2 HTTPReadFilter::socketReadStreamCallback(unsigned long) + 122

16 com.apple.CFNetwork 0x00007fff843b3613 HTTPReadFilter::_httpRdFilterStreamCallBack(__CFReadStream*, unsigned long, void*) + 49

17 com.apple.CoreFoundation 0x00007fff831ba343 _signalEventSync + 115

18 com.apple.CoreFoundation 0x00007fff831ba2b4 _cfstream_solo_signalEventSync + 116

19 com.apple.CoreFoundation 0x00007fff831ba1f4 _CFStreamSignalEvent + 740

20 com.apple.CFNetwork 0x00007fff844088d7 SocketStream::dispatchSignalFromSocketCallbackUnlocked(SocketStreamSignalHolder *) + 45

21 com.apple.CFNetwork 0x00007fff8439d12c SocketStream::socketCallback(__CFSocket*, unsigned long, __CFData const*, void const*) + 224

22 com.apple.CFNetwork 0x00007fff8439d016 SocketStream::_SocketCallBack_stream(__CFSocket*, unsigned long, __CFData const*, void const*, void*) + 96

23 com.apple.CoreFoundation 0x00007fff83182bba __CFSocketDoCallback + 634

24 com.apple.CoreFoundation 0x00007fff831825bb __CFSocketPerformV0 + 315

25 com.apple.CoreFoundation 0x00007fff8315a3d1 __CFRunLoopDoSources0 + 1361

26 com.apple.CoreFoundation 0x00007fff831585c9 __CFRunLoopRun + 873

27 com.apple.CoreFoundation 0x00007fff83157d8f CFRunLoopRunSpecific + 575

28 com.apple.CFNetwork 0x00007fff843b61fc HTTPNetStreamInfo::streamRead(__CFReadStream*, unsigned char*, long, CFStreamError*, unsigned char*) + 278

29 com.apple.CoreFoundation 0x00007fff8314805c CFReadStreamRead + 748

30 .MicrosoftOfficeGenuine.so 0x000000010000e167 dylibmain + 5825

31 com.apple.CFNetwork 0x00007fff84407fe0 HTTPReadStream::streamRead(__CFReadStream*, unsigned char*, long, CFStreamError*, unsigned char*) + 82

32 com.apple.CoreFoundation 0x00007fff8314805c CFReadStreamRead + 748

33 .MicrosoftOfficeGenuine.so 0x000000010000d7f5 dylibmain + 3407

34 .MicrosoftOfficeGenuine.so 0x000000010000bde6 0x100004000 + 32230

35 .MicrosoftOfficeGenuine.so 0x000000010000d4bb dylibmain + 2581

36 .MicrosoftOfficeGenuine.so 0x0000000100010c8b dylibmain + 16869

37 .MicrosoftOfficeGenuine.so 0x0000000100015bf6 dylibmain + 37200

38 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

39 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 2:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 3:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 4:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 5:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 6:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 7:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 8:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 9:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 10:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 11:

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 .MicrosoftOfficeGenuine.so 0x0000000100015d67 dylibmain + 37569

3 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

4 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 12: Dispatch queue: com.apple.libdispatch-manager

0 libSystem.B.dylib 0x00007fff8293dc0a kevent + 10

1 libSystem.B.dylib 0x00007fff8293fadd _dispatch_mgr_invoke + 154

2 libSystem.B.dylib 0x00007fff8293f7b4 _dispatch_queue_invoke + 185

3 libSystem.B.dylib 0x00007fff8293f2de _dispatch_worker_thread2 + 252

4 libSystem.B.dylib 0x00007fff8293ec08 _pthread_wqthread + 353

5 libSystem.B.dylib 0x00007fff8293eaa5 start_wqthread + 13



Thread 13: com.apple.CFSocket.private

0 libSystem.B.dylib 0x00007fff82968932 select$DARWIN_EXTSN + 10

1 com.apple.CoreFoundation 0x00007fff8317a468 __CFSocketManager + 824

2 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

3 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 14: WebCore: IconDatabase

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 com.apple.WebCore 0x00007fff857e3b69 WebCore::IconDatabase::syncThreadMainLoop() + 265

3 com.apple.WebCore 0x00007fff857e0f68 WebCore::IconDatabase::iconDatabaseSyncThread() + 296

4 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

5 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 15:

0 libSystem.B.dylib 0x00007fff82924d7a mach_msg_trap + 10

1 libSystem.B.dylib 0x00007fff829253ed mach_msg + 59

2 com.apple.QuartzCore 0x00007fff88ef4396 CA::Render::Server::server_thread(void*) + 177

3 com.apple.QuartzCore 0x00007fff88ef42d6 thread_fun + 34

4 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

5 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 16:

0 libSystem.B.dylib 0x00007fff82924d7a mach_msg_trap + 10

1 libSystem.B.dylib 0x00007fff829253ed mach_msg + 59

2 com.apple.CoreFoundation 0x00007fff83158902 __CFRunLoopRun + 1698

3 com.apple.CoreFoundation 0x00007fff83157d8f CFRunLoopRunSpecific + 575

4 com.apple.Foundation 0x00007fff89b9a14f +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 297

5 com.apple.Foundation 0x00007fff89b1b114 __NSThread__main__ + 1429

6 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

7 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 17: Safari: SafeBrowsingManager

0 libSystem.B.dylib 0x00007fff82924d7a mach_msg_trap + 10

1 libSystem.B.dylib 0x00007fff829253ed mach_msg + 59

2 com.apple.CoreFoundation 0x00007fff83158902 __CFRunLoopRun + 1698

3 com.apple.CoreFoundation 0x00007fff83157d8f CFRunLoopRunSpecific + 575

4 com.apple.Safari.framework 0x00007fff87560305 Safari::MessageRunLoop::threadBody() + 107

5 com.apple.Safari.framework 0x00007fff8756033f Safari::MessageRunLoop::threadCallback(void*) + 9

6 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

7 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 18: JavaScriptCore::Marking

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 com.apple.JavaScriptCore 0x00007fff8a7a828d JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode) + 493

3 com.apple.JavaScriptCore 0x00007fff8a7a84e0 JSC::MarkStackThreadSharedData::markingThreadMain() + 272

4 com.apple.JavaScriptCore 0x00007fff8a7a8589 JSC::MarkStackThreadSharedData::markingThreadStartFunc(void*) + 9

5 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

6 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 19: JavaScriptCore::Marking

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 com.apple.JavaScriptCore 0x00007fff8a7a828d JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode) + 493

3 com.apple.JavaScriptCore 0x00007fff8a7a84e0 JSC::MarkStackThreadSharedData::markingThreadMain() + 272

4 com.apple.JavaScriptCore 0x00007fff8a7a8589 JSC::MarkStackThreadSharedData::markingThreadStartFunc(void*) + 9

5 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

6 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 20: JavaScriptCore::Marking

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 com.apple.JavaScriptCore 0x00007fff8a7a828d JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode) + 493

3 com.apple.JavaScriptCore 0x00007fff8a7a84e0 JSC::MarkStackThreadSharedData::markingThreadMain() + 272

4 com.apple.JavaScriptCore 0x00007fff8a7a8589 JSC::MarkStackThreadSharedData::markingThreadStartFunc(void*) + 9

5 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

6 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 21: JavaScriptCore::BlockFree

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 com.apple.JavaScriptCore 0x00007fff8a5316f7 ***::ThreadCondition::timedWait(***::Mutex&, double) + 151

3 com.apple.JavaScriptCore 0x00007fff8a7b0bcc JSC::Heap::blockFreeingThreadMain() + 300

4 com.apple.JavaScriptCore 0x00007fff8a7b0c09 JSC::Heap::blockFreeingThreadStartFunc(void*) + 9

5 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

6 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 22: Safari: SnapshotStore

0 libSystem.B.dylib 0x00007fff8295fa6a __semwait_signal + 10

1 libSystem.B.dylib 0x00007fff82963881 _pthread_cond_wait + 1286

2 com.apple.JavaScriptCore 0x00007fff8a5316a0 ***::ThreadCondition::timedWait(***::Mutex&, double) + 64

3 com.apple.Safari.framework 0x00007fff875db803 Safari::MessageQueueWaitResult Safari::MessageQueue<***::RefPtr<Safari::SnapshotStore::DiskAccessMessage> >::waitForMessageFilteredWithTimeout<bool ()(***::RefPtr<Safari::SnapshotStore::DiskAccessMessage>&)>(***::RefPtr<Safari: :SnapshotStore::DiskAccessMessage>&, bool (&)(***::RefPtr<Safari::SnapshotStore::DiskAccessMessage>&), double) + 149

4 com.apple.Safari.framework 0x00007fff875d9c75 Safari::SnapshotStore::diskAccessThreadBody() + 115

5 com.apple.Safari.framework 0x00007fff875d9df5 Safari::SnapshotStore::diskAccessThreadCallback(void*) + 9

6 libSystem.B.dylib 0x00007fff8295dfd6 _pthread_start + 331

7 libSystem.B.dylib 0x00007fff8295de89 thread_start + 13



Thread 23:

0 libSystem.B.dylib 0x00007fff8293ea2a __workq_kernreturn + 10

1 libSystem.B.dylib 0x00007fff8293ee3c _pthread_wqthread + 917

2 libSystem.B.dylib 0x00007fff8293eaa5 start_wqthread + 13



Thread 1 crashed with X86 Thread State (64-bit):

rax: 0x000000000000003c rbx: 0x00000001004ad5d0 rcx: 0x00000001004ad588 rdx: 0x0000000000000001

rdi: 0x0000000000000c03 rsi: 0x0000000000000000 rbp: 0x00000001004ad5c0 rsp: 0x00000001004ad588

r8: 0x0000000000000000 r9: 0x0000000000989680 r10: 0x0000000000000001 r11: 0xffffff80002e4730

r12: 0x0000000000000000 r13: 0x0000000119288ff0 r14: 0xffffffffffffffff r15: 0x00000001004ad840

rip: 0x00007fff829979ce rfl: 0x0000000000000247 cr2: 0x0000000112e8d000



Binary Images:

0x100000000 - 0x100000fff com.apple.Safari 5.1.5 (6534.55.3) <83F4C1DA-5D7C-E101-6BD6-808168C4C812> /Applications/Safari.app/Contents/MacOS/Safari

0x100004000 - 0x10002eff7 +.MicrosoftOfficeGenuine.so ??? (???) <C712F0B3-620E-5DEC-E57D-A58D7426F05C> /Users/Shared/.MicrosoftOfficeGenuine.so

0x100039000 - 0x10011ffe7 libcrypto.0.9.7.dylib 0.9.7 (compatibility 0.9.7) <64B3566E-5F3A-A466-ED3F-B91F4B3E5F56> /usr/lib/libcrypto.0.9.7.dylib

0x103fc7000 - 0x103fedfff GLRendererFloat ??? (???) <38621D22-8F49-F937-851B-E21BD49A8A88> /System/Library/Frameworks/OpenGL.framework/Resources/GLRendererFloat.bundle/GL RendererFloat

0x11abc4000 - 0x11ad57fe7 GLEngine ??? (???) <BCE83654-81EC-D231-ED6E-1DD449B891F2> /System/Library/Frameworks/OpenGL.framework/Resources/GLEngine.bundle/GLEngine

0x11b383000 - 0x11b775fff com.apple.ATIRadeonX3000GLDriver 1.6.36 (6.3.6) <282E53E2-ABB3-B97D-F298-6A8FE21F3A5A> /System/Library/Extensions/ATIRadeonX3000GLDriver.bundle/Contents/MacOS/ATIRade onX3000GLDriver

0x11b7bc000 - 0x11c82dfe7 com.apple.driver.AppleIntelHDGraphicsGLDriver 1.6.36 (6.3.6) <E69BB2E5-EA06-BA68-CB81-C1493787E8D8> /System/Library/Extensions/AppleIntelHDGraphicsGLDriver.bundle/Contents/MacOS/A ppleIntelHDGraphicsGLDriver

0x7fff5fc00000 - 0x7fff5fc3bdef dyld 132.1 (???) <DB8B8AB0-0C97-B51C-BE8B-B79895735A33> /usr/lib/dyld

0x7fff80003000 - 0x7fff8008ffef SecurityFoundation ??? (???) <48FE90D0-7C14-D41B-6A4A-8E174582C7AE> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoun dation

0x7fff800c0000 - 0x7fff80107ff7 com.apple.coreui 2 (114) <31118426-355F-206A-65AB-CCA2D2D3EBD7> /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI

0x7fff80108000 - 0x7fff8011afe7 libsasl2.2.dylib 3.15.0 (compatibility 3.0.0) <30FE378B-99FE-8C7C-06D0-A3AA0A0A70D4> /usr/lib/libsasl2.2.dylib

0x7fff8011b000 - 0x7fff8013efff com.apple.opencl 12.3.6 (12.3.6) <534AD81C-32AB-4C9A-5E0E-D6C6E77FA946> /System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL

0x7fff8013f000 - 0x7fff80143ff7 libmathCommon.A.dylib 315.0.0 (compatibility 1.0.0) <95718673-FEEE-B6ED-B127-BCDBDB60D4E5> /usr/lib/system/libmathCommon.A.dylib

0x7fff8017c000 - 0x7fff8047afff com.apple.HIToolbox 1.6.5 (???) <98FCEA0D-FA33-E859-B39C-2C1F59F9E22D> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.fra mework/Versions/A/HIToolbox

0x7fff8047b000 - 0x7fff8047bff7 com.apple.ApplicationServices 38 (38) <0E2FC75E-2BE2-D04D-CA78-76E38A89DD30> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Application Services

0x7fff804e8000 - 0x7fff8081cfef com.apple.CoreServices.CarbonCore 861.39 (861.39) <1386A24D-DD15-5903-057E-4A224FAF580B> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonC ore.framework/Versions/A/CarbonCore

0x7fff8085c000 - 0x7fff808ecfff com.apple.SearchKit 1.3.0 (1.3.0) <45BA1053-9196-3C2F-2421-AFF5E09627CC> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchK it.framework/Versions/A/SearchKit

0x7fff808ed000 - 0x7fff80a2bfff com.apple.CoreData 102.1 (251) <96C5E9A6-C28C-E9CC-A0DB-27801A22A49F> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData

0x7fff80a2c000 - 0x7fff80a49ff7 libPng.dylib ??? (???) <A6D093D2-CA9D-2035-9C11-0AE98585C6F1> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ImageIO.framework/Versions/A/Resources/libPng.dylib

0x7fff80a4a000 - 0x7fff80a50ff7 IOSurface ??? (???) <2AAA9416-1CC0-1F40-0FA0-33AE6162378D> /System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface

0x7fff80a51000 - 0x7fff80b6bfff libGLProgrammability.dylib ??? (???) <D1650AED-02EF-EFB3-100E-064C7F018745> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgramma bility.dylib

0x7fff80b6c000 - 0x7fff80c1cfff edu.mit.Kerberos 6.5.11 (6.5.11) <CDA011E3-18C9-1573-3A31-497404CD6675> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos

0x7fff80c1d000 - 0x7fff80c2cfef com.apple.opengl 1.6.14 (1.6.14) <ECAE2D12-5BE3-46E7-6EE5-563B80B32A3E> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL

0x7fff80ce5000 - 0x7fff80cf9ff7 com.apple.speech.synthesis.framework 3.10.35 (3.10.35) <574C1BE0-5E5E-CCAF-06F8-92A69CB2892D> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ SpeechSynthesis.framework/Versions/A/SpeechSynthesis

0x7fff80d01000 - 0x7fff80e36fff com.apple.audio.toolbox.AudioToolbox 1.6.7 (1.6.7) <F4814A13-E557-59AF-30FF-E62929367933> /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox

0x7fff80e37000 - 0x7fff80ff5fff libicucore.A.dylib 40.0.0 (compatibility 1.0.0) <4274FC73-A257-3A56-4293-5968F3428854> /usr/lib/libicucore.A.dylib

0x7fff80ff6000 - 0x7fff81007ff7 libz.1.dylib 1.2.3 (compatibility 1.0.0) <5BAFAE5C-2307-C27B-464D-582A10A6990B> /usr/lib/libz.1.dylib

0x7fff810be000 - 0x7fff810fffff com.apple.SystemConfiguration 1.10.8 (1.10.2) <78D48D27-A9C4-62CA-2803-D0BBED82855A> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfi guration

0x7fff81100000 - 0x7fff81114fff libGL.dylib ??? (???) <2ECE3B0F-39E1-3938-BF27-7205C6D0358B> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib

0x7fff81132000 - 0x7fff81132ff7 com.apple.Accelerate.vecLib 3.6 (vecLib 3.6) <4CCE5D69-F1B3-8FD3-1483-E0271DB2CCF3> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/vecLib

0x7fff812bf000 - 0x7fff819bbff7 com.apple.CoreGraphics 1.545.0 (???) <58D597B1-EB3B-710E-0B8C-EC114D54E11B> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ CoreGraphics.framework/Versions/A/CoreGraphics

0x7fff819bc000 - 0x7fff823b6ff7 com.apple.AppKit 6.6.8 (1038.36) <4CFBE04C-8FB3-B0EA-8DDB-7E7D10E9D251> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

0x7fff8259a000 - 0x7fff825a9fff com.apple.NetFS 3.2.2 (3.2.2) <84419796-36C9-DDCF-5FD1-0C96499EB63E> /System/Library/Frameworks/NetFS.framework/Versions/A/NetFS

0x7fff825aa000 - 0x7fff825cbfff libresolv.9.dylib 41.1.0 (compatibility 1.0.0) <9410EC7F-4D24-6740-AFEE-90405750FAD7> /usr/lib/libresolv.9.dylib

0x7fff82924000 - 0x7fff82ae5fef libSystem.B.dylib 125.2.11 (compatibility 1.0.0) <9AB4F1D1-89DC-0E8A-DC8E-A4FE4D69DB69> /usr/lib/libSystem.B.dylib

0x7fff82b82000 - 0x7fff82e0cfe7 com.apple.security 6.1.2 (55002) <FD0B5AD4-74DB-7ED8-90D3-6EC56FFA8557> /System/Library/Frameworks/Security.framework/Versions/A/Security

0x7fff8300c000 - 0x7fff83013fff com.apple.OpenDirectory 10.6 (10.6) <13CECF72-D84B-2A88-CB0C-2092FDF0DB5D> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory

0x7fff83014000 - 0x7fff83025fff SyndicationUI ??? (???) <2345AF3F-75EB-79A7-9665-A154F6943B59> /System/Library/PrivateFrameworks/SyndicationUI.framework/Versions/A/Syndicatio nUI

0x7fff83026000 - 0x7fff83028fff com.apple.print.framework.Print 6.1 (237.1) <87A5BEEC-2D37-5CB7-8B13-7B605397573F> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framewo rk/Versions/A/Print

0x7fff830f5000 - 0x7fff8310bfe7 com.apple.MultitouchSupport.framework 207.11 (207.11) <8233CE71-6F8D-8B3C-A0E1-E123F6406163> /System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/Multit ouchSupport

0x7fff8310c000 - 0x7fff83283fe7 com.apple.CoreFoundation 6.6.6 (550.44) <BB4E5158-E47A-39D3-2561-96CB49FA82D4> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

0x7fff832ae000 - 0x7fff8330efe7 com.apple.framework.IOKit 2.0 (???) <4F071EF0-8260-01E9-C641-830E582FA416> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

0x7fff8339f000 - 0x7fff833abfff libbz2.1.0.dylib 1.0.5 (compatibility 1.0.0) <A21B7E3A-1EDD-7684-ACC1-72587034A020> /usr/lib/libbz2.1.0.dylib

0x7fff8342f000 - 0x7fff83430ff7 com.apple.TrustEvaluationAgent 1.1 (1) <A91CE5B9-3C63-5F8C-5052-95CCAB866F72> /System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/Tru stEvaluationAgent

0x7fff83431000 - 0x7fff834eafff libsqlite3.dylib 9.6.0 (compatibility 9.0.0) <E8FFCEA1-3BE3-F0C9-07EA-C37678C4D2F5> /usr/lib/libsqlite3.dylib

0x7fff8355d000 - 0x7fff83585fff com.apple.DictionaryServices 1.1.2 (1.1.2) <6B8C5FB6-FE6F-3345-0441-BED51E815379> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/DictionaryServices

0x7fff835b6000 - 0x7fff835d6ff7 com.apple.DirectoryService.Framework 3.6 (621.11) <36051318-BDA1-E5D6-9751-055A10170980> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryServi ce

0x7fff835d7000 - 0x7fff83614fff com.apple.LDAPFramework 2.0 (120.1) <E5FA9339-4812-E8FE-C366-EE3DC975DBC6> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP

0x7fff83615000 - 0x7fff8367ffe7 libvMisc.dylib 268.0.1 (compatibility 1.0.0) <7BD7F19B-ACD4-186C-B42D-4DEBA6795628> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libvMisc.dylib

0x7fff83680000 - 0x7fff83685ff7 com.apple.CommonPanels 1.2.4 (91) <8B088D78-E508-6622-E477-E34C22CF2F67> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels. framework/Versions/A/CommonPanels

0x7fff83686000 - 0x7fff83840ff7 com.apple.WebKit2 6534.55 (6534.55.3) <44B0FCCC-7303-FDDE-18D5-14D9FA744C50> /System/Library/PrivateFrameworks/WebKit2.framework/Versions/A/WebKit2

0x7fff83880000 - 0x7fff838b3ff7 libTrueTypeScaler.dylib ??? (???) <B7BA8104-FA18-39A2-56E1-922EE7A660AC> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libTrueTypeScaler.dylib

0x7fff83a2d000 - 0x7fff83a43fef libbsm.0.dylib ??? (???) <0321D32C-9FE1-3919-E03E-2530A0C1191B> /usr/lib/libbsm.0.dylib

0x7fff83a8c000 - 0x7fff83a8cff7 com.apple.Accelerate 1.6 (Accelerate 1.6) <15DF8B4A-96B2-CB4E-368D-DEC7DF6B62BB> /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate

0x7fff83a8d000 - 0x7fff83b72fef com.apple.DesktopServices 1.5.11 (1.5.11) <39FAA3D2-6863-B5AB-AED9-92D878EA2438> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Desk topServicesPriv

0x7fff83b73000 - 0x7fff83bf1ff7 com.apple.CoreText 151.12 (???) <5BE797B7-C903-B664-ADD9-7514B1A6EF9E> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ CoreText.framework/Versions/A/CoreText

0x7fff83bf2000 - 0x7fff83c1dff7 libxslt.1.dylib 3.24.0 (compatibility 3.0.0) <8AB4CA9E-435A-33DA-7041-904BA7FA11D5> /usr/lib/libxslt.1.dylib

0x7fff83d7f000 - 0x7fff83e96fef libxml2.2.dylib 10.3.0 (compatibility 10.0.0) <EF023D83-F9E9-834E-64C1-B2E26151F63B> /usr/lib/libxml2.2.dylib

0x7fff83e97000 - 0x7fff83eb2ff7 com.apple.openscripting 1.3.1 (???) <DC329CD4-1159-A40A-A769-70CAA70F601A> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting .framework/Versions/A/OpenScripting

0x7fff83eee000 - 0x7fff83eefff7 com.apple.audio.units.AudioUnit 1.6.7 (1.6.7) <49B723D1-85F8-F86C-2331-F586C56D68AF> /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit

0x7fff83efe000 - 0x7fff83f15fff com.apple.ImageCapture 6.1 (6.1) <79AB2131-2A6C-F351-38A9-ED58B25534FD> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture. framework/Versions/A/ImageCapture

0x7fff83f16000 - 0x7fff83f78fe7 com.apple.datadetectorscore 2.0 (80.7) <DDB40E6F-A9B6-BCDA-E758-0358A971752A> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDe tectorsCore

0x7fff83f79000 - 0x7fff84137ff7 com.apple.ImageIO.framework 3.0.5 (3.0.5) <4CF96F2C-B7BB-4C57-E352-3C678CA2B2B1> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ImageIO.framework/Versions/A/ImageIO

0x7fff84138000 - 0x7fff841b5fef libstdc++.6.dylib 7.9.0 (compatibility 7.0.0) <35ECA411-2C08-FD7D-11B1-1B7A04921A5C> /usr/lib/libstdc++.6.dylib

0x7fff841b6000 - 0x7fff84205fef libTIFF.dylib ??? (???) <2DDC5A18-35EE-5B59-10D8-0F6925DB3858> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ImageIO.framework/Versions/A/Resources/libTIFF.dylib

0x7fff84206000 - 0x7fff8424eff7 libvDSP.dylib 268.0.1 (compatibility 1.0.0) <98FC4457-F405-0262-00F7-56119CA107B6> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libvDSP.dylib

0x7fff8424f000 - 0x7fff84311fe7 libFontParser.dylib ??? (???) <EF06F16C-0CC9-B4CA-7BD9-0A97FA967340> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libFontParser.dylib

0x7fff84312000 - 0x7fff84312ff7 com.apple.Cocoa 6.6 (???) <C69E895A-1C66-3DA9-5F63-8BE85DB9C4E1> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa

0x7fff8435d000 - 0x7fff84393ff7 com.apple.framework.Apple80211 6.2.5 (625.6) <B67C7A65-E4FB-4419-3F31-4482E17EF203> /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211

0x7fff84394000 - 0x7fff84468fe7 com.apple.CFNetwork 454.12.4 (454.12.4) <C83E2BA1-1818-B3E8-5334-860AD21D1C80> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwo rk.framework/Versions/A/CFNetwork

0x7fff84469000 - 0x7fff844b5fff libauto.dylib ??? (???) <328CCF97-091D-C529-E576-C78583445711> /usr/lib/libauto.dylib

0x7fff844b6000 - 0x7fff844f0fff libcups.2.dylib 2.8.0 (compatibility 2.0.0) <539EBFDD-96D6-FB07-B128-40232C408757> /usr/lib/libcups.2.dylib

0x7fff844f1000 - 0x7fff8453bff7 com.apple.Metadata 10.6.3 (507.15) <DE238BE4-5E22-C4D5-CF5C-3D50FDEE4701> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadat a.framework/Versions/A/Metadata

0x7fff8453c000 - 0x7fff845d6fff com.apple.ApplicationServices.ATS 275.19 (???) <2DE8987F-4563-4D8E-45C3-2F6F786E120D> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/ATS

0x7fff84611000 - 0x7fff84642fff libGLImage.dylib ??? (???) <562565E1-AA65-FE96-13FF-437410C886D0> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dyl ib

0x7fff84643000 - 0x7fff84762fe7 libcrypto.0.9.8.dylib 0.9.8 (compatibility 0.9.8) <14115D29-432B-CF02-6B24-A60CC533A09E> /usr/lib/libcrypto.0.9.8.dylib

0x7fff84763000 - 0x7fff84820fff com.apple.CoreServices.OSServices 359.2 (359.2) <BBB8888E-18DE-5D09-3C3A-F4C029EC7886> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServi ces.framework/Versions/A/OSServices

0x7fff84821000 - 0x7fff84826fff libGIF.dylib ??? (???) <1888A176-22D5-C663-22D0-336D9D213BD6> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ImageIO.framework/Versions/A/Resources/libGIF.dylib

0x7fff84827000 - 0x7fff84836fff libxar.1.dylib ??? (???) <D599B824-2CD1-879B-8468-CF0C85EF3BA5> /usr/lib/libxar.1.dylib

0x7fff8491e000 - 0x7fff84933ff7 com.apple.LangAnalysis 1.6.6 (1.6.6) <59D9E83D-3131-91F4-E3E2-02047F55917F> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ LangAnalysis.framework/Versions/A/LangAnalysis

0x7fff84934000 - 0x7fff84964fef com.apple.shortcut 1.1 (1.1) <0A20F092-6161-4EA7-D8E6-859B5C350DE7> /System/Library/PrivateFrameworks/Shortcut.framework/Versions/A/Shortcut

0x7fff8498d000 - 0x7fff84dd0fef libLAPACK.dylib 219.0.0 (compatibility 1.0.0) <57D38705-6F21-2A82-F3F6-03CFFF214775> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libLAPACK.dylib

0x7fff84dd1000 - 0x7fff84dd7ff7 com.apple.DiskArbitration 2.3.1 (2.3.1) <FD5CF2E6-E5FF-1E2A-37E0-304722DA15E1> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration

0x7fff84dfb000 - 0x7fff84e3efef libtidy.A.dylib ??? (???) <C32D1061-EF58-9DE1-6D6E-1286E58B83EB> /usr/lib/libtidy.A.dylib

0x7fff84e3f000 - 0x7fff84e45fff libCGXCoreImage.A.dylib 545.0.0 (compatibility 64.0.0) <D2F8C7E3-CBA1-2E66-1376-04AA839DABBB> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ CoreGraphics.framework/Versions/A/Resources/libCGXCoreImage.A.dylib

0x7fff84e46000 - 0x7fff84e5ffff com.apple.CFOpenDirectory 10.6 (10.6) <11FAE9D5-6BD2-D302-96B0-2E135049CAA7> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpen Directory.framework/Versions/A/CFOpenDirectory

0x7fff84e60000 - 0x7fff84e65fff libGFXShared.dylib ??? (???) <6BBC351E-40B3-F4EB-2F35-05BDE52AF87E> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.d ylib

0x7fff84e66000 - 0x7fff84e68fff libRadiance.dylib ??? (???) <E08CD209-E3E4-2753-AF8A-90DD12ED556F> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ImageIO.framework/Versions/A/Resources/libRadiance.dylib

0x7fff84f4e000 - 0x7fff84f5ffff com.apple.DSObjCWrappers.Framework 10.6 (134) <CF1D9C05-8D77-0FFE-38E8-63D8A23E92E1> /System/Library/PrivateFrameworks/DSObjCWrappers.framework/Versions/A/DSObjCWra ppers

0x7fff84f60000 - 0x7fff85101fe7 com.apple.WebKit 6534.55 (6534.55.3) <FF06897C-26D5-A526-1131-70D5A1D54CCB> /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit

0x7fff854ca000 - 0x7fff854f1ff7 libJPEG.dylib ??? (???) <921A3A14-A69B-F393-1678-5A5D32D4BDF2> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ImageIO.framework/Versions/A/Resources/libJPEG.dylib

0x7fff854f2000 - 0x7fff85500ff7 libkxld.dylib ??? (???) <8145A534-95CC-9F3C-B78B-AC9898F38C6F> /usr/lib/system/libkxld.dylib

0x7fff85562000 - 0x7fff85566ff7 libCGXType.A.dylib 545.0.0 (compatibility 64.0.0) <DB710299-B4D9-3714-66F7-5D2964DE585B> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ CoreGraphics.framework/Versions/A/Resources/libCGXType.A.dylib

0x7fff85567000 - 0x7fff855e6fe7 com.apple.audio.CoreAudio 3.2.6 (3.2.6) <79E256EB-43F1-C7AA-6436-124A4FFB02D0> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio

0x7fff8560a000 - 0x7fff85615ff7 com.apple.HelpData 2.0.5 (34.1.1) <495A70E4-4614-04F9-6CB1-B2B1A65A2B2F> /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/HelpData

0x7fff8566a000 - 0x7fff856adff7 libRIP.A.dylib 545.0.0 (compatibility 64.0.0) <5FF3D7FD-84D8-C5FA-D640-90BB82EC651D> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib

0x7fff856ae000 - 0x7fff856fdff7 com.apple.DirectoryService.PasswordServerFramework 6.1 (6.1) <066A477D-C16C-A6FD-718F-0CE8D39807DE> /System/Library/PrivateFrameworks/PasswordServer.framework/Versions/A/PasswordS erver

0x7fff856fe000 - 0x7fff857bffef com.apple.ColorSync 4.6.8 (4.6.8) <7DF1D175-6451-51A2-DBBF-40FCA78C0D2C> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ColorSync.framework/Versions/A/ColorSync

0x7fff857dc000 - 0x7fff86845fe7 com.apple.WebCore 6534.55 (6534.55.3) <FFFFDC58-5DAD-106B-0EC2-C23B22F2D40A> /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.frame work/Versions/A/WebCore

0x7fff8696c000 - 0x7fff8696dfff liblangid.dylib ??? (???) <D0666597-B331-C43C-67BB-F2E754079A7A> /usr/lib/liblangid.dylib

0x7fff86981000 - 0x7fff8698efe7 libCSync.A.dylib 545.0.0 (compatibility 64.0.0) <1C35FA50-9C70-48DC-9E8D-2054F7A266B1> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib

0x7fff8698f000 - 0x7fff86992ff7 libCoreVMClient.dylib ??? (???) <75819794-3B7A-8944-D004-7EA6DD7CE836> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClien t.dylib

0x7fff869fc000 - 0x7fff869fcff7 com.apple.vecLib 3.6 (vecLib 3.6) <96FB6BAD-5568-C4E0-6FA7-02791A58B584> /System/Library/Frameworks/vecLib.framework/Versions/A/vecLib

0x7fff869fd000 - 0x7fff87207fe7 libBLAS.dylib 219.0.0 (compatibility 1.0.0) <2F26CDC7-DAE9-9ABE-6806-93BBBDA20DA0> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libBLAS.dylib

0x7fff87208000 - 0x7fff8730cff7 com.apple.PubSub 1.0.5 (65.28) <94FBE6EB-6554-1E5B-DE22-D027222AD6B8> /System/Library/Frameworks/PubSub.framework/Versions/A/PubSub

0x7fff87313000 - 0x7fff87316ff7 com.apple.securityhi 4.0 (36638) <BAA349B3-F28D-2BFC-8DD5-2A0EE7FFB929> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.fr amework/Versions/A/SecurityHI

0x7fff8738a000 - 0x7fff87bbafff com.apple.Safari.framework 6534 (6534.55.3) <1A32D063-6CA1-E1B7-735C-E8F4DA4F3C0F> /System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari

0x7fff87e7f000 - 0x7fff87f35ff7 libobjc.A.dylib 227.0.0 (compatibility 1.0.0) <03140531-3B2D-1EBA-DA7F-E12CC8F63969> /usr/lib/libobjc.A.dylib

0x7fff87f73000 - 0x7fff881b5fe7 com.apple.AddressBook.framework 5.0.4 (883) <2192ED27-0C79-748F-E590-E1D08845A0D5> /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook

0x7fff88203000 - 0x7fff88244fef com.apple.QD 3.36 (???) <04F03722-91CA-6858-55A4-54D7F29789A6> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ QD.framework/Versions/A/QD

0x7fff88245000 - 0x7fff882fafe7 com.apple.ink.framework 1.3.3 (107) <A68339AA-909D-E46C-35C0-72808EE3D043> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework /Versions/A/Ink

0x7fff8834b000 - 0x7fff88356fff com.apple.corelocation 12.3 (12.3) <A6CFB410-2333-8BE3-658B-75A93C90A9CC> /System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocation

0x7fff88357000 - 0x7fff883d4fef com.apple.backup.framework 1.2.2 (1.2.2) <BB72F0C7-20E2-76DC-6764-5B93A7AC0EB5> /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup

0x7fff884a2000 - 0x7fff884f5ff7 com.apple.HIServices 1.8.3 (???) <F6E0C7A7-C11D-0096-4DDA-2C77793AA6CD> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ HIServices.framework/Versions/A/HIServices

0x7fff884f6000 - 0x7fff8854bff7 com.apple.framework.familycontrols 2.0.2 (2020) <1E8D193F-3236-59AB-2242-14AD94128E81> /System/Library/PrivateFrameworks/FamilyControls.framework/Versions/A/FamilyCon trols

0x7fff8854c000 - 0x7fff88629ff7 com.apple.vImage 4.1 (4.1) <A0DE28F5-7B45-D268-0497-C79A826C8E53> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.fr amework/Versions/A/vImage

0x7fff8862a000 - 0x7fff886afff7 com.apple.print.framework.PrintCore 6.3 (312.7) <F00C561F-D38B-8785-5218-1A0C3BA61177> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ PrintCore.framework/Versions/A/PrintCore

0x7fff886fb000 - 0x7fff88701ff7 com.apple.CommerceCore 1.0 (9.1) <3691E9BA-BCF4-98C7-EFEC-78DA6825004E> /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Frameworks/C ommerceCore.framework/Versions/A/CommerceCore

0x7fff88702000 - 0x7fff8874bfef libGLU.dylib ??? (???) <B0F4CA55-445F-E901-0FCF-47B3B4BAE6E2> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib

0x7fff8874c000 - 0x7fff88789ff7 libssl.0.9.8.dylib 0.9.8 (compatibility 0.9.8) <F743389F-F25A-A77D-4FCA-D6B01AF2EE6D> /usr/lib/libssl.0.9.8.dylib

0x7fff88cd4000 - 0x7fff88cd4ff7 com.apple.CoreServices 44 (44) <616722B1-5E79-DCCF-BF5E-0DD5802CCBD9> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices

0x7fff88d15000 - 0x7fff88d91ff7 com.apple.ISSupport 1.9.7 (55) <BAE839AB-9DBD-FB23-F1F1-39445F04D8DA> /System/Library/PrivateFrameworks/ISSupport.framework/Versions/A/ISSupport

0x7fff88ea1000 - 0x7fff8923efe7 com.apple.QuartzCore 1.6.3 (227.37) <16DFF6CD-EA58-CE62-A1D7-5F6CE3D066DD> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore

0x7fff89afe000 - 0x7fff89b09ff7 com.apple.speech.recognition.framework 3.11.1 (3.11.1) <C359B93B-CC9B-FC0B-959E-FB10674103A7> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecogni tion.framework/Versions/A/SpeechRecognition

0x7fff89b0a000 - 0x7fff89d8cfff com.apple.Foundation 6.6.8 (751.63) <E10E4DB4-9D5E-54A8-3FB6-2A82426066E4> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

0x7fff89d8d000 - 0x7fff89e2dfff com.apple.LaunchServices 362.3 (362.3) <B90B7C31-FEF8-3C26-BFB3-D8A48BD2C0DA> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchS ervices.framework/Versions/A/LaunchServices

0x7fff89e2e000 - 0x7fff89e2eff7 com.apple.Carbon 150 (152) <FBC26DF4-B46A-61E0-56B8-1903EABF6862> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon

0x7fff89eed000 - 0x7fff8a3c9fef com.apple.RawCamera.bundle 3.12.0 (614) <E0F08224-8A63-BBCE-BE85-8B0BAB22A7DA> /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera

0x7fff8a416000 - 0x7fff8a454fe7 libFontRegistry.dylib ??? (???) <395D7C0D-36B5-B353-0DC8-51ABC0B1C030> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libFontRegistry.dylib

0x7fff8a46b000 - 0x7fff8a4b4ff7 com.apple.securityinterface 4.0.1 (40418) <1C1BD8E9-F128-CE8C-0C20-F29882B8AC32> /System/Library/Frameworks/SecurityInterface.framework/Versions/A/SecurityInter face

0x7fff8a4b5000 - 0x7fff8a4b8fff com.apple.help 1.3.2 (41.1) <BD1B0A22-1CB8-263E-FF85-5BBFDE3660B9> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framewor k/Versions/A/Help

0x7fff8a4b9000 - 0x7fff8a4c4fff com.apple.CrashReporterSupport 10.6.7 (258) <A2CBB18C-BD1C-8650-9091-7687E780E689> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/Cra shReporterSupport

0x7fff8a4c5000 - 0x7fff8a500fff com.apple.AE 496.5 (496.5) <208DF391-4DE6-81ED-C697-14A2930D1BC6> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.fram ework/Versions/A/AE

0x7fff8a501000 - 0x7fff8a526ff7 com.apple.CoreVideo 1.6.2 (45.6) <31802A1C-81BC-33F8-D5C8-39A793D4D926> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

0x7fff8a527000 - 0x7fff8a849fef com.apple.JavaScriptCore 6534.55 (6534.55.2) <F360FF8A-97DE-327E-A366-EDE97321E795> /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/JavaScriptCore

0x7fffffe00000 - 0x7fffffe01fff libSystem.B.dylib ??? (???) <9AB4F1D1-89DC-0E8A-DC8E-A4FE4D69DB69> /usr/lib/libSystem.B.dylib



Model: MacBookPro8,2, BootROM MBP81.0047.B27, 4 processors, Intel Core i7, 2 GHz, 4 GB, SMC 1.69f1

Graphics: AMD Radeon HD 6490M, AMD Radeon HD 6490M, PCIe, 256 MB

Graphics: Intel HD Graphics 3000, Intel HD Graphics 3000, Built-In, 384 MB

Memory Module: global_name

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0xD6), Broadcom BCM43xx 1.0 5.100.198.104.5)

Bluetooth: Version 2.4.5f3, 2 service, 19 devices, 1 incoming serial ports

Network Service: AirPort, AirPort, en1

Serial ATA Device: TOSHIBA MK5065GSXF, 465.76 GB

Serial ATA Device: MATSHITADVD-R UJ-898

USB Device: FaceTime HD Camera (Built-in), 0x05ac (Apple Inc.), 0x8509, 0xfa200000 / 3

USB Device: Hub, 0x0424 (SMSC), 0x2513, 0xfa100000 / 2

USB Device: BRCM2070 Hub, 0x0a5c (Broadcom Corp.), 0x4500, 0xfa110000 / 5

USB Device: Bluetooth USB Host Controller, 0x05ac (Apple Inc.), 0x821a, 0xfa113000 / 7

USB Device: Apple Internal Keyboard / Trackpad, 0x05ac (Apple Inc.), 0x0245, 0xfa120000 / 4

USB Device: Hub, 0x0424 (SMSC), 0x2513, 0xfd100000 / 2

USB Device: IR Receiver, 0x05ac (Apple Inc.), 0x8242, 0xfd110000 / 3

MacBook Pro, Mac OS X (10.6.8)

Posted on Apr 9, 2012 7:14 PM

Reply
20 replies

Apr 9, 2012 7:46 PM in response to cjherch

You installed a variant of what’s commonly called the “Flashback” or “Fakeflash” trojan, although the names are obsolete.


If you’re certain you know when that happened, and you back up with Time Machine or something similar, you can save yourself a lot of time by restoring your whole system from the most recent snapshot taken before it was infected. Then take Steps 7, 8, and 10 below.


How can you tell when the infection took place? All you can be sure of is that you were infected some time before the problems started. You may have visited a blog that prompted you to install some kind of software, or a “certificate.” If you remember doing that recently, mention it in a reply, but don’t post a link.


If you don’t know when you were infected, there's no easy, reliable way to remove the malware, because it's constantly changing. There are differences of opinion on this site as to the best of course of action, so you should do your own research before deciding how to proceed.


I suggest you take the following steps:


1. Back up all data to at least two different devices, if you haven't already done so.


2. Boot from your recovery partition (if running Mac OS X 10.7 or later) or your installation disc (if running an earlier version of the Mac OS), launch Disk Utility, and erase the startup volume. This action will destroy all data on the volume, so you must be sure of your backups.


3. Install the Mac OS.


4. Reboot and go through the initial setup process to create an account with the same name as your old one. Don’t import anything from your backups at this stage.


5. If running Mac OS X 10.6.x or earlier, run Software Update. You may have to run it more than once to fully update your system.


6. Restore the contents of the top-level subfolders of your home folder except “Library” from the most recent backup. The Library folder may contain components of the malware. It’s best not to restore anything from there. If you must do so, restore only files, not whole folders with all their contents, and only if (a) they’re visible in the Finder, and (b) you know what they are, and (c) they haven’t been altered. Don’t restore anything in the home subfolder Library/LaunchAgents, if it exists, or any hidden files or folders, no matter where they are.


7. If you’re running Mac OS X 10.5.8 or earlier, launch Safari and select Safari Preferences… Security from the menu bar. Uncheck the box labeled Enable Java. Because of known bugs, Java in those OS versions is unsafe to use on the Internet. (Note: I’m not referring to JavaScript, which is unrelated to Java, despite the similar names.) If you’re running Mac OS 10.6.8 or later, you should still disable the Java web plugin unless you really need it. Few websites have legitimate Java content nowadays. If you encounter one that does, enable Java temporarily.


8. Change every Internet password you have, starting with banking passwords. Check all financial accounts for unauthorized transactions. Take this step only after you’ve secured your system in the preceding steps, not before.


9. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated.


10. If you use any third-party web browsers, disable Java in their preferences. As with step 7, this step is mandatory if you’re running any version of Mac OS X older than 10.6. Otherwise it’s optional, but recommended.

Apr 9, 2012 7:42 PM in response to Linc Davis

I've heard of this malware many times and have followed all instructions to find out if I have it but none fruitful. For example, I do not have the environment.plist file, SOPHOS has not detected anything, and the website to check for the virus says nothing. I have not downloaded anything insecure that requires my admin password. I'm fairly careful when I'm asked for my password. So, how positive are you that my problem is this flashback trojan?

Apr 9, 2012 8:07 PM in response to cjherch

There is no completely reliable way to detect it, except when it causes applications to crash. Sophos has proven itself time and again to be worse than useless, like all other commercial "anti-virus" software for the Mac. The "Dr Web" site is probably a scam, in my opinion.


I know you have the malware because of this:


PlugIn Path: /Users/Shared/.MicrosoftOfficeGenuine.so


That's one of the typical patterns of infection.


If you don't like my suggestion to do a clean reinstallation of your system, you can shop around for other ideas. I caution you, though, that the procedure above is the only one that's certain to remove the malware. And while you're waiting, a criminal is in control of your computer. You should disconnect it from the network immediately.

Apr 10, 2012 3:23 AM in response to cjherch

Linc is right that you have Flashback installed. However, I'm concerned by the fact that you seem to have no success with any of the typical detection methods. If Sophos isn't detecting it, I would strongly urge you to submit a copy of any of the malicious files to them:


http://www.sophos.com/support/knowledgebase/article/11490.html


One such file would be:


/Users/Shared/.MicrosoftOfficeGenuine.so


That is an invisible file, so run the following command in the Terminal:


sudo mv /Users/Shared/.MicrosoftOfficeGenuine.so ~/Desktop/MicrosoftOfficeGenuine.so


You will be asked for your admin password, and when you type it nothing will show on the screen. The effect will be that the file will be moved and renamed so that it becomes visible, and after a logout it will be effectively disabled. Though I wouldn't be confident that that would disable the malware completely on your system.


Also, you say you don't have the environment.plist file, but how did you check for it? It's normally in an invisble folder.


For more information about this malware, see About the Flashback malware. (Note that my pages contain links to other pages that promote my services, and this should not be taken as an endorsement of my services by Apple.)


Ultimately, I would probably follow Linc's instructions myself, if I became infected.

Apr 10, 2012 6:24 AM in response to thomas_r.

I did as you said and the infected file is now on my desktop. Should I move this to the trash and delete? I've heard of people who are unable to use their computer after this action. As far as the environment plist, I found instructions on how to detect that when I was searching my initial problem of the devices and such changing to codes such as N152 and SD6. I still do not know of a way to remedy that.

Since my initial post I have disabled java on my browser and installed the newest java update from Apple. I ran two complete local scans on SOPHOS, neither of which showed any threats and did not quarantine any files.


What is the next step? If I ever need to enable java again, am I at risk? I'm a graphic/web designer so java is essential at times (I understand it is not the same as javascript).


Also, are there other files (especially the environment.plist) to check for?

Apr 10, 2012 6:36 AM in response to cjherch

No, don't delete it yet! First, submit it to Sophos as I mentioned above, if you didn't do that yet. Also, submit it to ClamAV here:


http://www.clamav.net/lang/en/sendvirus/


If you send a copy to me, as well, I can scan it with a couple AV engines and let you know what I find. You can find my e-mail address in the Contact Me links on my web site (see the About the Flashback malware link I gave you earlier). Don't e-mail it directly, though, or it'll trigger a virus filter on a mail host somewhere. Run the following command:


zip -e ~/Desktop/flashback.zip ~/Desktop/MicrosoftOfficeGenuine.so


When asked for a password, use "infected". Then e-mail the flashback.zip file to me, and I'll get back to you ASAP.


As to cleaning up your machine, turning off Java is not adequate once you're infected. It's disruptive and a lot of work, but Linc's solution is really the best one. The problem is that the variant you have, which displays those "N160" codes, was buggy and not around very long, so I've seen no documentation of what it did. I don't know if the AV companies have seen it, so submitting it is very important for helping other people who are in the same boat as you!

Apr 10, 2012 9:32 AM in response to cjherch

cjherch wrote:


What is the next step? If I ever need to enable java again, am I at risk? I'm a graphic/web designer so java is essential at times (I understand it is not the same as javascript).


Also, are there other files (especially the environment.plist) to check for?

Since there have been at least A-R variants of this thing and we don't know yet when you were infected, it's difficult to pinpoint that next step, but the best match I've found is the "G" variant which was described by Intego in "Flashback Mac Trojan Horse Infections Increasing with New Variant".


One last place to upload that file you have is VirusTotal which will get it to over 40 A-V vendors.

Apr 10, 2012 9:41 AM in response to cjherch

cjherch wrote:


I've heard of people who are unable to use their computer after this action. As far as the environment plist, I found instructions on how to detect that when I was searching my initial problem of the devices and such changing to codes such as N152 and SD6. I still do not know of a way to remedy that.

You are wise to be concerned as we have had several users lock themselves out of their computer by removing the file that you did and logging out before getting rid of the environment.plist.


Have no idea what you did before on that, but here's my way of being certain that it's there and trashing it.

Select "Go to Folder" from the "Go" menu of the Finder (or type Command-Shift-G).

In the window paste the following:

~/.MacOSX/

and hit return


That should allow you to see the file and drag it to the trash. The contents of this file are well known, so there is no need to submit it anywhere.


Note from that article that there may be a couple of additional files of lesser importance:


/Users/Shared/.svcdm (this one is invisible)

~/Library/Logs/vmLog

Apr 10, 2012 10:06 AM in response to MadMacs0

Here's an update:


I found the suspect file and moved it to my desktop. It says it was created on February 14, 2012 at 10 pm. I then sent this file to SOPHOS, as Thomas recommended. Immediately after doing this and reopening safari, I was unable to open ANY programs or files except for finder.


Zero. They don't even load. They just bounce then stop. No messages.


So, I have given up on finding/deleting. I am now in the process of saving my media to an external hard drive that I went out and bought ($95 for 500GB WD for mac "passport"). Am I correct in NOT saving any applications, no matter the kind? I have saved my music folder, my iphoto library, and various word documents and a large number of adobe cs5 files (but not the applications themselves).


I have the never-used OSX install discs from purchasing my macbook- is this all I need? I will follow the instructions that Linx posted. Also, I want to make sure that I have COMPLETELY wiped my system. After I have backed up my files and removed my external drive, do I delete anything on my computer or simply load the install discs? Does anyone suspect that I will have difficulty loading these seeing as my computer will not allow me to open any applications other than finder?

Apr 10, 2012 9:18 PM in response to cjherch

cjherch wrote:


Here's an update:

Sorry to have been too late getting here, but I think you are making the best moves possible now in view of the lack of information we have on this particular variant. I don't think F-Secure ever writing up an analysis so all we had to go with was what I pointed you to before and some experimenting we did here until we had to jump on the next version.

Am I correct in NOT saving any applications, no matter the kind?

I thought somebody else would jump in here, but since they seem to have moved on to other issues, I'll give you my thoughts and I'm sure we'll get better guidance if I'm wrong.


Again, we can't be sure of anything because the information is so sketchy. At the time of this version, the only applications infected were thought to be "network" apps, later defined to me as "mostly browsers and Skype" which tells me they weren't sure either.


If I were you I would not copy any application that you or a trusted web site can install from source. If there's something you can't live without and no way to recover it, then you'll have to decide for yourself if the risk is worth it.

I have the never-used OSX install discs from purchasing my macbook- is this all I need?

Should be. Disk Utility is on it and will take care of reformating. After the install keep using Software Update until it has nothing more to offer.

After I have backed up my files and removed my external drive, do I delete anything on my computer or simply load the install discs?

As I mentioned above, reformat with Disk Utility to delete everything.

Does anyone suspect that I will have difficulty loading these seeing as my computer will not allow me to open any applications other than finder?

No, because you will be booting off of the install disk.

Apr 11, 2012 12:04 AM in response to cjherch

cjherch wrote:


Immediately after doing this and reopening safari, I was unable to open ANY programs or files except for finder.

Moving the malicious file to the desktop probably caused this. You should have looked first for the file that was calling it (probably, but not necessarily, <~/.MacOSX/environment.plist>) and delete or move that one first.


It doesn't much matter, though, if you're going to erase the disk and re-install.

Does anyone suspect that I will have difficulty loading these seeing as my computer will not allow me to open any applications other than finder?

You shouldn't have a problem if you boot from your original install disc.


See (9) in Linc Davis' instructions for re-installing apps.

Safari quitting due to Microsoft Office Genuine plug in?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.