Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

SnowLeo777 Author

Level 1

0 points

New malware?

Since a couple of days my iMac (Snow Leopard (10.6.8) would not start up when it is connected to the Internet. Blue

screen appears, and the desktop never appears. If I disconnect the Internet or turn off the modem, it loads

correctly and works as usual. If I turn on the modem while the computer is already on, it freezes or gets extremely

slow - impossible to open any application or turn it off in a normal way. I called my Internet provider, we reset

the modem, and I connected my old PC to test the modem with another computer. It works without problem. After the

reset I tried it with Mac again. The computer was able to start up, very slowly, and I managed to set up the

Internet connection again. But then a message appeared on the screen saying "Please type you computer password in

order for Dropbox to function properly". I clicked "cancel". After that the computer became incredibly slow again,

freezing each time I clicked the mouse.
I would like to run ClamXav or another antivirus software but can not do it because I need to get definitions from

Internet, and the computer becomes not usable as soon as it's connected to the Internet.

Does it look like a malware? The message that appears by itself proposing to enter the password for the computer

seems not to be normal.

I would really appreciate some advice!

iMac, Mac OS X (10.6.8)

Posted on Oct 23, 2012 2:27 PM

Best reply

BDAqua

Level 10

239,333 points

Posted on Oct 23, 2012 2:43 PM

Doesn't sound like malware yet.

One way to test is to Safe Boot from the HD, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, Test for problem in Safe Mode...

PS. Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive

Reboot, test again.

If it only does it in Regular Boot, then it could be some hardware problem like Video card, (Quartz is turned off in Safe Mode), or Airport, or some USB or Firewire device, or 3rd party add-on, Check System Preferences>Accounts>Login Items window to see if it or something relevant is listed.

Check the System Preferences>Other Row, for 3rd party Pref Panes.

Also look in these if they exist, some are invisible...

/private/var/run/StartupItems

/Library/StartupItems

/System/Library/StartupItems

/System/Library/LaunchDaemons

/Library/LaunchDaemons

View in context

57 replies

SnowLeo777 Author

Level 1

0 points

Oct 27, 2012 8:32 AM in response to BDAqua

These messages in the Console repeat often during startup but I don't know how to interprete them and if they are related to the problem:

Sender: com.apple.launchctl.Aqua[115]

Message: launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.versioncueCS4.monitor.plist

Sender: com.apple.launchd.peruser.501[113]

Message: (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

Sender: com.apple.launchd.peruser.501[113]

Message: (0x100600390.mach_init.VersionCueCS4monitor) Failed to check-in!

Sender: Apple80211Agent[150]

Message: IMKClient: exception caught trying to get the rootProxy for connection ((** NSConnection 0x2000bce20 receivePort <NSMachPort: 0x2000bcda0> sendPort <NSMachPort: 0x2000bcd20> refCount 8590708256 **)):

NSPortTimeoutException : connection timeout: did not receive reply

Sender: Apple80211Agent[150]

Message: This exception was thrown inside thread: <NSThread: 0x20000ebc0>{name = (null), num = 1}. This thread is the main thread.

Sender: com.apple.WindowServer[75]

Message: <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

Sender: com.apple.fontd[83]

Message: FODBCheck: foRec->annexNumber != kInvalidAnnexNumber (0)

Sender: com.apple.diskmanagementd[249]

Message: Can't access "efi-boot-device" NVRAM variable

BDAqua

Level 10

239,333 points

Oct 27, 2012 11:30 AM in response to SnowLeo777

Ouch, this is starting to sound like a Hardware problem.

Get Find Any File...

http://apps.tempel.org/FindAnyFile/

Hold Option or alt key when selecting Find to Find All.

Search for Name contains...

com.apple.ReportCrash.Self

SnowLeo777 Author

Level 1

0 points

Oct 27, 2012 1:24 PM in response to BDAqua

It found a file "com.apple.ReportCrash.Self.plist" in System/Library/LaunchAgents

What should I do next?

Thank you.

BDAqua

Level 10

239,333 points

Oct 27, 2012 1:57 PM in response to SnowLeo777

Now we need to find out why...

Sender: com.apple.launchd.peruser.501[113]

Message: (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

Do a Get Info on that file & see what rights are on it.

SnowLeo777 Author

Level 1

0 points

Oct 27, 2012 2:48 PM in response to BDAqua

com.apple.ReportCrash.Self.plist

system: Read & Write

wheel: Read only

everyone: Read only

BDAqua

Level 10

239,333 points

Oct 27, 2012 4:12 PM in response to SnowLeo777

Hmmmm, hopefully somebody else has some ideas, I'm at a loss at the moment. 😟

WZZZ

Level 6

13,226 points

Oct 27, 2012 8:28 PM in response to BDAqua

Could not find: com.apple.ReportCrash.Self

BD, when I first started using 10.6, I used to get that message all the time. I gave up, removed it from its original location and moved it into ~/Library/LaunchAgents. I think it's some meaningless buggy OS error and I never got another compaint that it couldn't be found. No problems whatsoever after moving it, including subsequent 10.6 point updates.

http://www.insanelymac.com/forum/topic/192563-fix-could-not-find-comapplereportc rashself/

BDAqua

Level 10

239,333 points

Oct 27, 2012 8:37 PM in response to WZZZ

Great tip W, thanks a bunch! 🙂

I've never had that error, & in 10.6.5 to 10.8.2 it's always in System>Library>Launch Agents...

I wonder what it's all about Alfie???

SnowLeo777 Author

Level 1

0 points

Oct 27, 2012 9:19 PM in response to BDAqua

So should I try to move it from System>Library>Launch Agents to Library>Launch Agents?

BDAqua

Level 10

239,333 points

Oct 27, 2012 10:36 PM in response to SnowLeo777

I'd certainly give it a try, then reboot.

MadMacs0

Level 5

5,221 points

Oct 27, 2012 10:43 PM in response to SnowLeo777

SnowLeo777 wrote:

So should I try to move it from System>Library>Launch Agents to Library>Launch Agents?

I'm confident that you won't be able to move it, but you should be able to copy it and subsequently delete it from /System/Library/LaunchAgents/ with your admin password.

I also agree with your choice of moving it to /Library/LaunchAgents first, rather than your home folder Library. That way it will work for all users, not just one.

WZZZ

Level 6

13,226 points

Oct 28, 2012 4:02 AM in response to SnowLeo777

SnowLeo777 wrote:

So should I try to move it from System>Library>Launch Agents to Library>Launch Agents?

If you move it using the Finder, it will make you, not root (system) the owner. That won't be right for the HD Library*, which should not have your user as the owner. You need to do this using the command line. Copy/paste the following into Terminal (in Utilities), hit return, then enter your admin password, which you won't see in any form as you type it in. Then hit return again.

sudo mv /System/Library/LaunchAgents/com.apple.ReportCrash.Self /Library/LaunchAgents

Next check to see it appears in the HD Library/LaunchAgents and that it is no longer present in /System/Library/LaunchAgents. If it is still there, trash it. Trashing it will require authenticating with your admin password.

*NOTE: I had moved it my user, not the HD Library. My user is indicated by the tilde character ~ in front. MadMacs is suggesting it would be better to move it to the second level library, the HD Library, so it will be accessible to all users, not just your user. There are three libraries: one in your user, one in the HD Library and one in the System Library.

SnowLeo777 Author

Level 1

0 points

Oct 28, 2012 10:49 AM in response to WZZZ

The file has been successfully moved (I had to type "com.apple.ReportCrash.Self.plst" in Terminal instead of just "com.apple.ReportCrash.Self" in order for it to work).

I restarted the computer (wireless mouse on, Ethernet cable unplugged) and it booted vert quicky. This message does not appear anymore:

(com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

But as soon as I plugged in the Ethernet cable, the system has frozen again, and I had to turn it off with the power button. Restart with Ehernet cable plugged in was unsuccessful - stayed on a blue screen, both in ordinary boot and safe boot.

After the file "com.apple.ReportCrash.Self.plst" has been moved to a new location, it boots very quickly when there is no Internet connection. The Console keeps displaying other errors during startup but I don't know if they are real errors or it is normal:

Every time during startup:

Sender: com.apple.launchctl.Aqua[104]

Message: launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.versioncueCS4.monitor.plist

Sender: com.apple.launchd.peruser.501[102]

Message: (0x100302d80.mach_init.VersionCueCS4monitor) Failed to check-in!

Sender: com.apple.WindowServer[79]

Message: <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

Often:

Sender: Apple80211Agent[132]

Message: IMKClient: exception caught trying to get the rootProxy for connection ((** NSConnection 0x20009d000 receivePort <NSMachPort: 0x20009cf80> sendPort <NSMachPort: 0x20009cf00> refCount 8590577664 **)):

NSPortTimeoutException : connection timeout: did not receive reply

Sender: Apple80211Agent[132]

Message: This exception was thrown inside thread: <NSThread: 0x20000ebc0>{name = (null), num = 1}. This thread is the main thread.

Sender: com.apple.fontd[113]

Often: FODBCheck: foRec->annexNumber != kInvalidAnnexNumber (0)

BDAqua

Level 10

239,333 points

Oct 28, 2012 11:01 AM in response to SnowLeo777

Looks like the problem now is...

com.adobe.versioncueCS4

WZZZ

Level 6

13,226 points

Oct 28, 2012 11:19 AM in response to SnowLeo777

Sorry, that should have been with .plist. Glad you knew how to correct that.

Are you getting a kernel panic? That would be a message that you have to restart, or does it just freeze? Look for a panic log in Console>Library>Logs>Diagnostic Reports.

Also check in Console in Crash Reporter and Hang Reporter.

Can you leave Console open and then connect the Ethernet cable. If it doesn't freeze up right away, you might see where it's getting logged.

New malware?