Error 268D4 Malware

Question

Level 1

41 points

Error 268D4 Malware

Good day, community

I'm using a MacBook Pro 5.5 (2013 spec 2.6 mhz) with OS10.6.8. 3 days ago I mis-typed a website address and as soon as the website loaded a window popped open with the Error 268D4 message: "HTTP://Writecomputer.club You computer has been blocked due to malware. Error 268D4 Call 1 888 334-4927 to have our engineers remove the malware."

Having run across this sort of scam before I ignored it, closed the window and did not expect actual problems with my MacBook.

But this time I immediately started getting the "spinning wheel of death". It seemed to be associated at first with using the finder. Some times I could use force quit and see "Finder not responding". Re-launch finder did not work. Only shut down by power button would work. Also, I have 3 accounts on my Mac: 2 user and 1 admin. All 3 are affected which really surprised me.

I have tried starting up in Safe Mode but that has no effect and I still get the spinning wheel. For awhile I was able to progress opening a file but now when I start the computer I get the log in page with my 3 accounts but I cannot log in to any of them.

Since I am traveling I don't have access to my back up drive but I am looking for advise for when I get home. Primary concern is not to contaminate the back up drive!

The only good thing at the moment is my data is not encrypted which would be far worse!

Thanks,

Hugh

MacBook Pro, Mac OS X (10.6.8)

Posted on Dec 30, 2016 5:43 PM

Reply

Answer 1

Hugh Piercy Author

Level 1

41 points

Jan 1, 2017 7:20 AM in response to a brody

In reply to Thomas R. Yes, it could be a coincidence. But on the other hand, a window popped open saying "Your computer has been blocked" and my computer became un-useable.

But I agree with A. Brody that I shouldn't mess about with a root user account unless under the direction of someone at Apple Care. Much better to just re-install from the back up I have.

Unfortunately Malwarebytes wont run on OS 10.6.8. But I was able to run EtreCheck. Which I've copied in below. The only thing that looks like a possible issue might be the .PBSyncDB file. No sign of a hardware issue that I can see. Please let me know if you see something I don't.

Happy New Year!

Hugh

EtreCheck version: 3.1.5 (343)

Report generated 2016-12-31 09:33:51

Download EtreCheck from https://etrecheck.com

Runtime 20:30

Performance: Poor

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Beachballing

Description:

Intermittent when finder in use

Hardware Information:ⓘ

MacBook Pro Intel Core 2 Duo (aluminum unibody)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro5,5

1 2.53 GHz Intel Core 2 Duo (Duo) CPU: 2-core

8 GB RAM

BANK 0/DIMM0

4 GB DDR3 1067 MHz ok

BANK 1/DIMM0

4 GB DDR3 1067 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 533

Video Information:ⓘ

NVIDIA GeForce 9400M - VRAM: 256 MB

Color LCD 1280 x 800

spdisplays_display_connector

System Software:ⓘ

OS X Snow Leopard 10.6.8 (10K549) - Time since boot: about one hour

Disk Information:ⓘ

Hitachi HTS545050B9A300 disk0 : (465.76 GB) (Rotational)

[Show SMART report]

- (disk0s1) <not mounted> : 210 MB

Hugh's 500 GB (disk0s2) / [Startup]: 499.76 GB (435.07 GB free)

HL-DT-ST DVDRW GS23N ()

USB Information:ⓘ

Apple Internal Memory Card Reader

Apple Inc. BRCM2046 Hub

Apple Inc. Bluetooth USB Host Controller

I-O DATA USB Flash Disk 490.9 MB

512 MB (disk1s1) /Volumes/512 MB : 515 MB (41 MB free)

Apple Inc. Built-in iSight

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

Unknown Files:ⓘ

~/Library/LaunchAgents/.PBSyncDB

One unknown file found. [Check files]

Kernel Extensions:ⓘ

/System/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (3.3.4 - SDK 10.8 - 2016-12-30) [Support]

[loaded] com.rim.driver.BlackBerryUSBDriverInt (0.0.97 - 2016-12-30) [Support]

[not loaded] com.rim.driver.BlackBerryUSBDriverVSP (0.0.97 - 2016-12-30) [Support]

System Launch Agents:ⓘ

[not loaded] 4 Apple tasks

[loaded] 64 Apple tasks

[running] 6 Apple tasks

System Launch Daemons:ⓘ

[not loaded] 53 Apple tasks

[loaded] 89 Apple tasks

[running] 25 Apple tasks

Launch Agents:ⓘ

[running] at.obdev.LittleSnitchUIAgent.plist (2015-12-06) [Support]

[failed] com.rim.BBAlbumArtCacher.plist (2013-06-25) [Support] - /Library/Application Support/BlackBerry/RimAlbumArtDaemon: Executable not found!

[failed] com.rim.BBLaunchAgent.plist (2013-06-25) [Support] - /Library/Application Support/BlackBerry/BBLaunchAgent.app: Executable not found!

Launch Daemons:ⓘ

[running] at.obdev.littlesnitchd.plist (2015-12-06) [Support]

[loaded] com.adobe.fpsaud.plist (2016-08-29) [Support]

[loaded] com.bombich.ccc.plist (2016-01-17) [Support]

[loaded] com.microsoft.office.licensing.helper.plist (2014-02-26) [Support]

[failed] com.rim.BBDaemon.plist (2013-06-25) [Support] - /Library/Application Support/BlackBerry/BBDaemon: Executable not found!

[loaded] com.skype.skypeinstaller.plist (2016-03-26) [Support]

[loaded] jp.co.canon.MasterInstaller.plist (2015-08-08) [Support]

User Launch Agents:ⓘ

[not loaded] .PBSyncDB (hidden) (2010-08-08) [Support]

[failed] com.adobe.ARM.[...].plist (2010-01-22) [Support] - /Applications/Adobe Reader 9/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper: Executable not found!

User Login Items:ⓘ

Canon IJ Network Scanner Selector EX Application Hidden

(/Applications/Canon Utilities/IJ Network Scanner Selector EX/Canon IJ Network Scanner Selector EX.app)

Internet Plug-ins:ⓘ

JavaAppletPlugin: 13.9.8 - SDK 10.6 (2013-08-18) Check version

FlashPlayer-10.6: 23.0.0.162 - SDK 10.9 (2016-09-29) [Support]

QuickTime Plugin: 7.6.6 (2014-07-06)

Flash Player: 23.0.0.162 - SDK 10.9 (2016-09-29) Cannot contact Adobe

SharePointBrowserPlugin: 14.4.0 - SDK 10.6 (2014-07-26) [Support]

GarminGpsControl: 2.6.3.0 Release (2015-06-15) [Support]

iPhotoPhotocast: 7.0 (2013-08-18)

Audio Plug-ins:ⓘ

iSightAudio: 7.6.6 (2014-07-06)

3rd Party Preference Panes:ⓘ

Flash Player (2016-08-29) [Support]

Time Machine:ⓘ

Time Machine information requires OS X 10.8 "Mountain Lion" or later.

Top Processes by CPU:ⓘ

7% WindowServer

1% launchd(2)

0% usbmuxd

Top Processes by Memory:ⓘ

49 MB Finder

41 MB WindowServer

33 MB SystemUIServer

33 MB mds

25 MB Dock

Virtual Memory Information:ⓘ

2.74 GB Available RAM

2.74 GB Free RAM

5.26 GB Used RAM

0 B Cached files

0 B Swap Used

Diagnostics Information:ⓘ

Dec 31, 2016, 07:36:53 AM Self test - passed

Reply

Answer 2

thomas_r.

Level 7

32,097 points

Jan 2, 2017 3:44 AM in response to Hugh Piercy

Hugh Piercy wrote:

In reply to Thomas R. Yes, it could be a coincidence. But on the other hand, a window popped open saying "Your computer has been blocked" and my computer became un-useable.

Your computer did not become unusable. Your web browser did, and only because of a web page that used tricks to prevent you from closing that window/tab. Those tricks are very easy to bypass if you know how (for example, most of the time re-opening Safari while holding down the shift key will take care of the problem).

This was not caused by malware, and unless you are the unlucky discoverer of something new that nobody else has seen yet (which is unlikely), it did not result in your machine being infected with any malware. Your EtreCheck report bears that out. I see no signs of anything malicious.

The only thing that looks like a possible issue might be the .PBSyncDB file. No sign of a hardware issue that I can see.

The .PBSyncDB file is a file that is created by some versions of Intego's Personal Backup software. It is not malicious.

Note that EtreCheck does not test for hardware issues. It may be able to identify a failing hard drive, but for anything else, you really would need to run Apple Hardware Test. Even that is more limited than the tests Apple techs can do. If Apple Hardware Test fails to find a problem, that definitely doesn't mean a problem doesn't exist.

Using Apple Hardware Test - Apple Support

Reply

Answer 3

Hugh Piercy Author

Level 1

41 points

Jan 3, 2017 6:27 PM in response to thomas_r.

In reply to Thomas R. Yes, it could be a coincidence. But on the other hand, a window popped open saying "Your computer has been blocked" and my computer became un-useable.

But I agree with A. Brody that I shouldn't mess about with a root user account unless under the direction of someone at Apple Care. Much better to just re-install from the back up I have.

Unfortunately Malwarebytes wont run on OS 10.6.8. But I was able to run EtreCheck. Which I've copied in below. The only thing that looks like a possible issue might be the .PBSyncDB file. No sign of a hardware issue that I can see. Please let me know if you see something I don't.

Happy New Year!

Hugh

EtreCheck version: 3.1.5 (343)

Report generated 2016-12-31 09:33:51

Download EtreCheck from https://etrecheck.com

Runtime 20:30

Performance: Poor

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Beachballing

Description:

Intermittent when finder in use

Hardware Information: ⓘ

MacBook Pro Intel Core 2 Duo (aluminum unibody)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro5,5

1 2.53 GHz Intel Core 2 Duo (Duo) CPU: 2-core

8 GB RAM

BANK 0/DIMM0

4 GB DDR3 1067 MHz ok

BANK 1/DIMM0

4 GB DDR3 1067 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 533

Video Information: ⓘ

NVIDIA GeForce 9400M - VRAM: 256 MB

Color LCD 1280 x 800

spdisplays_display_connector

System Software: ⓘ

OS X Snow Leopard 10.6.8 (10K549) - Time since boot: about one hour

Disk Information: ⓘ

Hitachi HTS545050B9A300 disk0 : (465.76 GB) (Rotational)

[Show SMART report]

- (disk0s1) <not mounted> : 210 MB

Hugh's 500 GB (disk0s2) / [Startup]: 499.76 GB (435.07 GB free)

HL-DT-ST DVDRW GS23N ()

USB Information: ⓘ

Apple Internal Memory Card Reader

Apple Inc. BRCM2046 Hub

Apple Inc. Bluetooth USB Host Controller

I-O DATA USB Flash Disk 490.9 MB

512 MB (disk1s1) /Volumes/512 MB : 515 MB (41 MB free)

Apple Inc. Built-in iSight

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

Unknown Files: ⓘ

~/Library/LaunchAgents/.PBSyncDB

One unknown file found. [Check files]

Kernel Extensions: ⓘ

/System/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (3.3.4 - SDK 10.8 - 2016-12-30) [Support]

[loaded] com.rim.driver.BlackBerryUSBDriverInt (0.0.97 - 2016-12-30) [Support]

[not loaded] com.rim.driver.BlackBerryUSBDriverVSP (0.0.97 - 2016-12-30) [Support]

System Launch Agents: ⓘ

[not loaded] 4 Apple tasks

[loaded] 64 Apple tasks

[running] 6 Apple tasks

System Launch Daemons: ⓘ

[not loaded] 53 Apple tasks

[loaded] 89 Apple tasks

[running] 25 Apple tasks

Launch Agents: ⓘ

[running] at.obdev.LittleSnitchUIAgent.plist (2015-12-06) [Support]

[failed] com.rim.BBAlbumArtCacher.plist (2013-06-25) [Support] - /Library/Application Support/BlackBerry/RimAlbumArtDaemon: Executable not found!

[failed] com.rim.BBLaunchAgent.plist (2013-06-25) [Support] - /Library/Application Support/BlackBerry/BBLaunchAgent.app: Executable not found!

Launch Daemons: ⓘ

[running] at.obdev.littlesnitchd.plist (2015-12-06) [Support]

[loaded] com.adobe.fpsaud.plist (2016-08-29) [Support]

[loaded] com.bombich.ccc.plist (2016-01-17) [Support]

[loaded] com.microsoft.office.licensing.helper.plist (2014-02-26) [Support]

[failed] com.rim.BBDaemon.plist (2013-06-25) [Support] - /Library/Application Support/BlackBerry/BBDaemon: Executable not found!

[loaded] com.skype.skypeinstaller.plist (2016-03-26) [Support]

[loaded] jp.co.canon.MasterInstaller.plist (2015-08-08) [Support]

User Launch Agents: ⓘ

[not loaded] .PBSyncDB (hidden) (2010-08-08) [Support]

[failed] com.adobe.ARM.[...].plist (2010-01-22) [Support] - /Applications/Adobe Reader 9/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper: Executable not found!

User Login Items: ⓘ

Canon IJ Network Scanner Selector EX Application Hidden

(/Applications/Canon Utilities/IJ Network Scanner Selector EX/Canon IJ Network Scanner Selector EX.app)

Internet Plug-ins: ⓘ

JavaAppletPlugin: 13.9.8 - SDK 10.6 (2013-08-18) Check version

FlashPlayer-10.6: 23.0.0.162 - SDK 10.9 (2016-09-29) [Support]

QuickTime Plugin: 7.6.6 (2014-07-06)

Flash Player: 23.0.0.162 - SDK 10.9 (2016-09-29) Cannot contact Adobe

SharePointBrowserPlugin: 14.4.0 - SDK 10.6 (2014-07-26) [Support]

GarminGpsControl: 2.6.3.0 Release (2015-06-15) [Support]

iPhotoPhotocast: 7.0 (2013-08-18)

Audio Plug-ins: ⓘ

iSightAudio: 7.6.6 (2014-07-06)

3rd Party Preference Panes: ⓘ

Flash Player (2016-08-29) [Support]

Time Machine: ⓘ

Time Machine information requires OS X 10.8 "Mountain Lion" or later.

Top Processes by CPU: ⓘ

7% WindowServer

1% launchd(2)

0% usbmuxd

Top Processes by Memory: ⓘ

49 MB Finder

41 MB WindowServer

33 MB SystemUIServer

33 MB mds

25 MB Dock

Virtual Memory Information: ⓘ

2.74 GB Available RAM

2.74 GB Free RAM

5.26 GB Used RAM

0 B Cached files

0 B Swap Used

Diagnostics Information: ⓘ

Dec 31, 2016, 07:36:53 AM Self test - passed

Reply

Answer 4

a brody

Level 10

85,442 points

Dec 31, 2016 8:36 PM in response to Hugh Piercy

Who is she? Admin passwords give more access to files than you should have unless our intent is to install something known to be harmless. Don't use pronouns unless you are certain the person in question is obvious.

In fact the one real way any malware or virus can be introduced on Macs is through "social engineering." You ask the end user to do something that opens the gateway to harming themselves. The admin password is one such gateway. Now some programs because they need access to system libraries are fine to do so, but others I'd be very wary of.

Reply

Answer 5

a brody

Level 10

85,442 points

Dec 31, 2016 5:13 AM in response to Hugh Piercy

Sounds like something has situated itself in your root System file or the Boot ROM. Hopefully not the latter.

Lesson 1: You encounter a suspicious website, don't just close the window, Force Quit the application with command-option-escape. That command comes from a much higher level than the application, and won't give the application a chance to run. When you next open the browser, hold the shift key so it does not reload the same page.

https://www.malwarebytes.com/mac/

Is designed to remove the toughest malware, but is not an anti-virus tool. It may be worth a try though in your situation.

As for the security of backing up your data when you return home, you need to ensure there is no sign of it left before backing up over your old backup.

Most malware will be very visible with the http://www.etrecheck.com tool, but not all.

Most anti-virus software for the Mac is unreliable. Although I've heard good things about Sophos. But as with any such software, your best defense is a good offense, and not give in to the temptation of clicking on anything from an unreliable website. Throwing on new system tools, you need to be able to also find out how to remove them, otherwise they can slow your Mac down even further, and only for the cause of a one in a million chance of getting anything harmful.

Reply

Answer 6

Hugh Piercy Author

Level 1

41 points

Dec 31, 2016 5:44 AM in response to a brody

Thanks for the quick reply.

Every mis-step is a good chance to learn! While I knew not to click anything on the web page, I did not know to force quit Safari. I just closed the tab.

Your first comment seems in line with this from another thread with similar symptoms:

For some reason, the plist file of the finder had been modified. So she had me create a root user. I logged into this user, went into the library/preference of my main account. There, she made me throw the finder plist file to the trash, as well as a folder relating to finder in this preference folder.

I'll try the Malwarebytes app. It may have to wait till I get home and can boot from you CCC clone back up. I'll try to get it on my computer via flash drive from my wife's computer but my computer becomes unusable after a few minutes.

One concern with using the flash dive, is would this type of malware copy itself to the flash drive? Seems unlikely but I may destroy the flash drive afterwards (if I cannot prove it clean).

Also, anyone have a comment on ClamX?

Best regards,

Hugh

Reply

Answer 7

thomas_r.

Level 7

32,097 points

Dec 31, 2016 9:04 AM in response to Hugh Piercy

It's exceedingly unlikely that the problem you're seeing is due to malware. There is currently no known malware infecting Macs simply by visiting a website.

The more likely explanations are a badly corrupt system or a hardware issue (most likely a failing hard drive). You may want to have an Apple tech take a look and confirm that diagnosis, but if not, when you get home, you can try erasing your hard drive and restoring from backup. (Or, better yet, reinstall a fresh system and restore only your data from the backup.)

If that doesn't work, it's hardware.

Reply

Answer 8

Eric Root

Level 10

686,297 points

Jan 1, 2017 8:22 AM in response to Hugh Piercy

That looks fairly clean. Part of the RIM software is missing. If you aren't using it, uninstall it. Thomas's suggestion of a reinstall is probably your next step.

RIM Uninstall

Reply