SnowLeo777
Level 1 (0 points)

Q: New malware?

Since a couple of days my iMac (Snow Leopard (10.6.8) would not start up when it is connected to the Internet. Blue

screen appears, and the desktop never appears. If I disconnect the Internet or turn off the modem, it loads

correctly and works as usual. If I turn on the modem while the computer is already on, it freezes or gets extremely

slow - impossible to open any application or turn it off in a normal way. I called my Internet provider, we reset

the modem, and I connected my old PC to test the modem with another computer. It works without problem. After the

reset I tried it with Mac again. The computer was able to start up, very slowly, and I managed to set up the

Internet connection again. But then a message appeared on the screen saying "Please type you computer password in

order for Dropbox to function properly". I clicked "cancel". After that the computer became incredibly slow again,

freezing each time I clicked the mouse.
I would like to run ClamXav or another antivirus software but can not do it because I need to get definitions from

Internet, and the computer becomes not usable as soon as it's connected to the Internet.

Does it look like a malware? The message that appears by itself proposing to enter the password for the computer

seems not to be normal.

I would really appreciate some advice!

iMac, Mac OS X (10.6.8)

Posted on Oct 23, 2012 2:27 PM

Close
SnowLeo777

Q: New malware?

  • All replies
  • Helpful answers

Previous Page 2 of 4 last Next

  • by BDAqua,

    BDAqua BDAqua Oct 26, 2012 11:23 AM in response to SnowLeo777
    Level 10 (123,905 points)
    Oct 26, 2012 11:23 AM in response to SnowLeo777

    Open Console in Utilities & see if there are any clues or repeating messages when this happens.

     

    Or...

     

    Open console in Applications>Utilities, check the system log for the date/time of the last problem  & the Startup right after that for clues.

  • by SnowLeo777,

    SnowLeo777 SnowLeo777 Oct 27, 2012 8:32 AM in response to BDAqua
    Level 1 (0 points)
    Oct 27, 2012 8:32 AM in response to BDAqua

    These messages in the Console repeat often during startup but I don't know how to interprete them and if they are related to the problem:

     

    Sender:     com.apple.launchctl.Aqua[115]

    Message:  launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.versioncueCS4.monitor.plist

     

     

    Sender:     com.apple.launchd.peruser.501[113]

    Message:  (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

     

     

    Sender:  com.apple.launchd.peruser.501[113]

    Message:  (0x100600390.mach_init.VersionCueCS4monitor) Failed to check-in!

     

     

    Sender: Apple80211Agent[150]

    Message:  IMKClient: exception caught trying to get the rootProxy for connection ((** NSConnection 0x2000bce20 receivePort <NSMachPort: 0x2000bcda0> sendPort <NSMachPort: 0x2000bcd20> refCount 8590708256 **)):

              NSPortTimeoutException : connection timeout: did not receive reply

     

     

    Sender: Apple80211Agent[150]

    Message:  This exception was thrown inside thread: <NSThread: 0x20000ebc0>{name = (null), num = 1}.  This thread is the main thread.

     

     

    Sender:     com.apple.WindowServer[75]   

    Message: <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

     

     

    Sender:     com.apple.fontd[83]

    Message: FODBCheck: foRec->annexNumber != kInvalidAnnexNumber (0)

     

     

    Sender:     com.apple.diskmanagementd[249]

    Message:  Can't access "efi-boot-device" NVRAM variable

  • by BDAqua,

    BDAqua BDAqua Oct 27, 2012 11:30 AM in response to SnowLeo777
    Level 10 (123,905 points)
    Oct 27, 2012 11:30 AM in response to SnowLeo777

    Ouch, this is starting to sound like a Hardware problem.

     

    Get Find Any File...

     

    http://apps.tempel.org/FindAnyFile/

     

    Hold Option or alt key when selecting Find to Find All.

     

    Search for Name contains...

     

    com.apple.ReportCrash.Self

  • by SnowLeo777,

    SnowLeo777 SnowLeo777 Oct 27, 2012 1:24 PM in response to BDAqua
    Level 1 (0 points)
    Oct 27, 2012 1:24 PM in response to BDAqua

    It found a file "com.apple.ReportCrash.Self.plist" in System/Library/LaunchAgents

     

    What should I do next?

    Thank you.

  • by BDAqua,

    BDAqua BDAqua Oct 27, 2012 1:57 PM in response to SnowLeo777
    Level 10 (123,905 points)
    Oct 27, 2012 1:57 PM in response to SnowLeo777

    Now we need to find out why...

     

    Sender:     com.apple.launchd.peruser.501[113]

    Message:  (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

     

    Do a Get Info on that file & see what rights are on it.

  • by SnowLeo777,

    SnowLeo777 SnowLeo777 Oct 27, 2012 2:48 PM in response to BDAqua
    Level 1 (0 points)
    Oct 27, 2012 2:48 PM in response to BDAqua

    com.apple.ReportCrash.Self.plist

     

    system: Read & Write

    wheel: Read only

    everyone: Read only

  • by BDAqua,

    BDAqua BDAqua Oct 27, 2012 4:12 PM in response to SnowLeo777
    Level 10 (123,905 points)
    Oct 27, 2012 4:12 PM in response to SnowLeo777

    Hmmmm, hopefully somebody else has some ideas, I'm at a loss at the moment.

  • by WZZZ,

    WZZZ WZZZ Oct 27, 2012 8:28 PM in response to BDAqua
    Level 6 (13,112 points)
    Mac OS X
    Oct 27, 2012 8:28 PM in response to BDAqua

    Could not find: com.apple.ReportCrash.Self

     

    BD, when I first started using 10.6, I used to get that message all the time. I gave up, removed it from its original location and moved it into ~/Library/LaunchAgents. I think it's some meaningless buggy OS error and I never got another compaint that it couldn't be found. No problems whatsoever after moving it, including subsequent 10.6 point updates.

     

    http://www.insanelymac.com/forum/topic/192563-fix-could-not-find-comapplereportc rashself/

  • by BDAqua,

    BDAqua BDAqua Oct 27, 2012 8:37 PM in response to WZZZ
    Level 10 (123,905 points)
    Oct 27, 2012 8:37 PM in response to WZZZ

    Great tip W, thanks a bunch!

     

    I've never had that error, & in 10.6.5 to 10.8.2 it's always in System>Library>Launch Agents...

    com.apple.ReportCrash.Self.gif

    I wonder what it's all about Alfie???

  • by SnowLeo777,

    SnowLeo777 SnowLeo777 Oct 27, 2012 9:19 PM in response to BDAqua
    Level 1 (0 points)
    Oct 27, 2012 9:19 PM in response to BDAqua

    So should I try to move it from System>Library>Launch Agents to Library>Launch Agents?

  • by BDAqua,

    BDAqua BDAqua Oct 27, 2012 10:36 PM in response to SnowLeo777
    Level 10 (123,905 points)
    Oct 27, 2012 10:36 PM in response to SnowLeo777

    I'd certainly give it a try, then reboot.

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 27, 2012 10:43 PM in response to SnowLeo777
    Level 5 (4,801 points)
    Oct 27, 2012 10:43 PM in response to SnowLeo777

    SnowLeo777 wrote:

     

    So should I try to move it from System>Library>Launch Agents to Library>Launch Agents?

    I'm confident that you won't be able to move it, but you should be able to copy it and subsequently delete it from /System/Library/LaunchAgents/ with your admin password.

     

    I also agree with your choice of moving it to /Library/LaunchAgents first, rather than your home folder Library. That way it will work for all users, not just one.

  • by WZZZ,

    WZZZ WZZZ Oct 28, 2012 4:02 AM in response to SnowLeo777
    Level 6 (13,112 points)
    Mac OS X
    Oct 28, 2012 4:02 AM in response to SnowLeo777

    SnowLeo777 wrote:

     

    So should I try to move it from System>Library>Launch Agents to Library>Launch Agents?

    If you move it using the Finder, it will make you, not root (system) the owner. That won't be right for the HD Library*, which should not have your user as the owner. You need to do this using the command line. Copy/paste the following into Terminal (in Utilities), hit return, then enter your admin password, which you won't see in any form as you type it in. Then hit return again.

     

     

     

    sudo mv /System/Library/LaunchAgents/com.apple.ReportCrash.Self /Library/LaunchAgents

     

     

    Next check to see it appears in the HD Library/LaunchAgents and that it is no longer present in /System/Library/LaunchAgents. If it is still there, trash it. Trashing it will require authenticating with your admin password.

     

     

    *NOTE: I had moved it my user, not the HD Library. My user is indicated by the tilde character ~ in front. MadMacs is suggesting it would be better to move it to the second level library, the HD Library, so it will be accessible to all users, not just your user. There are three libraries: one in your user, one in the HD Library and one in the System Library.

  • by SnowLeo777,

    SnowLeo777 SnowLeo777 Oct 28, 2012 10:49 AM in response to WZZZ
    Level 1 (0 points)
    Oct 28, 2012 10:49 AM in response to WZZZ

    The file has been successfully moved (I had to type "com.apple.ReportCrash.Self.plst" in Terminal instead of just "com.apple.ReportCrash.Self" in order for it to work).

     

    I restarted the computer (wireless mouse on, Ethernet cable unplugged) and it booted vert quicky. This message does not appear anymore:

    (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self

     

    But as soon as I plugged in the Ethernet cable, the system has frozen again, and I had to turn it off with the power button. Restart with Ehernet cable plugged in was unsuccessful - stayed on a blue screen, both in ordinary boot and safe boot.

     

    After the file "com.apple.ReportCrash.Self.plst" has been moved to a new location, it boots very quickly when there is no Internet connection. The Console keeps displaying other errors during startup but I don't know if they are real errors or it is normal:

     

    Every time during startup:

     

    Sender:  com.apple.launchctl.Aqua[104]

    Message: launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.versioncueCS4.monitor.plist

     

    Sender: com.apple.launchd.peruser.501[102]

    Message: (0x100302d80.mach_init.VersionCueCS4monitor) Failed to check-in!

     

    Sender: com.apple.WindowServer[79]

    Message:  <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

     

    Often:

     

    Sender: Apple80211Agent[132]

    Message: IMKClient: exception caught trying to get the rootProxy for connection ((** NSConnection 0x20009d000 receivePort <NSMachPort: 0x20009cf80> sendPort <NSMachPort: 0x20009cf00> refCount 8590577664 **)):

              NSPortTimeoutException : connection timeout: did not receive reply

     

    Sender: Apple80211Agent[132]

    Message: This exception was thrown inside thread: <NSThread: 0x20000ebc0>{name = (null), num = 1}.  This thread is the main thread.

     

    Sender:  com.apple.fontd[113]

    Often: FODBCheck: foRec->annexNumber != kInvalidAnnexNumber (0)

  • by BDAqua,

    BDAqua BDAqua Oct 28, 2012 11:01 AM in response to SnowLeo777
    Level 10 (123,905 points)
    Oct 28, 2012 11:01 AM in response to SnowLeo777

    Looks like the problem now is...

     

    com.adobe.versioncueCS4

Previous Page 2 of 4 last Next