Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Within the past week I noticed some strange behaviour on my Snow Leopard MacBook Pro.

A few of my windows in the background closed themselves without me doing anything while I was working. Then I noticed some graphical "glitching". Dragged windows would leave "trails" of themselves, and my menubar was showing some strange glitching and spacing that had never been there before. This particular behaviour has not repeated itself (other than a new graphical "momentary glitch" every time I start up). However...

Shortly after that (not immediately, but within a couple of days) I could not access the internet with my Airport. With cable is ok, but when I try to access via Airport (all browsers) I get "ERROR 106: The internet connection has been lost".

After Googling, I tried a few Airport reset solutions which didn't help. Sooo...

I thought it could be a virus of some kind. I downloaded Avast (on a recommendation.. I already have ClamXav) and scanned. I found some infected .exe files which I had never opened, but also a number of infections (13) in my Java cache like this >>

vload.class: infection Java:Jade-C [Heur] vmain.class: infection Java:CVE-2010-0094-C [Expl] been/piro.class: infection Java:Agent-DU [Expl] plugin/sportGame.class: infection Java:Agent-DR [Expl]

So now I thought there may be a serious problem. I downloaded the trial of Kapersky Anti-Virus (upon further reading it seemed like it might be a more "pro" app) .. and did another scan. Found the same infections and a few more. So I disinfected them. Zap.

Now I thought it might be a good idea to do an Onyx cleanup of my system. Upon repairing permissions I found a lot of these...

Permissions differ on System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/Contents/Home/lib/security/cacerts, should be -rw-r--r-- , they are lrwxr-xr-x

Permissions differ on System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Remote Desktop Message.app/Contents/Resources/ko.lproj/UIAgent.nib, should be drwxr-xr-x , they are -rwxr-xr-x

Permissions differ on System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_TW.lproj/RemoteDesktopMenu.nib, should be drwxr-xr-x , they are -rwxr-xr-x

.. I won't list them all unless asked, but basically they are all pertaining to either System/Library/CoreServices/RemoteManagement/ or System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/

I also found

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired

.. but I discovered this is nothing to worry about)

So now I still can't access internet via Airport, and.. I get a freeze when I try to shut down. I go to bluescreen and the progress wheel just keeps circling, until I force a shut down with the power button. Thank god it restarts afterwards (the first time I thought "Oh no..")

Anyone have any ideas what my next steps should be? I am "on the road" at the moment in Berlin, and all I have is my laptop and an external drive. Not being able to use wireless is seriously hampering my work, and on top of that my money situation is not great right now. I don't know how I can afford the money or "computerless time" if I have to somehow go in for repair.

I always have "Hands Off" running, and I thought that would take care of any kind of remote hacking, but I could be wrong. I have downloaded some "trial" versions of music software from Frostwire, so perhaps that could be the culprit. But none of these files came up positive on my scans.

I'll end with that. Sorry for the long post. Hopefully someone can throw some guidance my way. Have I been hacked? What should be my next steps?

share|improve this question
2  
long posts are fine. I can't help cause i'm not a mac guy, but that's a fairly good, well documented question. –  Journeyman Geek Aug 15 '11 at 14:27
1  
As Journeyman says, long posts are fine (and welcome). Better lots of detail than "omg mi mac has a virus help me plz". –  tombull89 Aug 15 '11 at 14:33
    
I don't think this has to be a virus. Are you experiencing the same behavior on another user account? –  slhck Aug 15 '11 at 14:36

2 Answers 2

I don't think you have been hacked, but you do seem to have a lot of other issues that have to be fixed anyway. In addition more AV programs do not generally make you any safer, but they do slow down your computer to a crawl.

share|improve this answer
    
Thanks for the advice. If I have something like Hands Off (a Little Snitch clone) do you think I need an antivirus app like Avast or Kaspersky? If I only go with one, would you have a suggestion? –  Kristan Smith Aug 16 '11 at 8:48
    
Look up reviews, I don't know what is best for macs, or even if there is a clear best. –  soandos Aug 16 '11 at 13:59

I believe that your problem is hardware related. It could be a problem with your graphics card, with the airport adapter or a general problem with the motherboard. I highly doubt that it is a virus.

Since it is not convenient for you to take it to repair and there is still a good chance that you can solve it with software, you can try a few things:

  • Create another user account and see if there any differences
  • Re-install the OS (if you have the disk with you). It doesn't take that long and it should clean up any software problems.
  • Buy a cheap mac compatible USB wireless adapter to get wireless working until you fix the problems

In any case, you should backup your files as soon as possible. I wouldn't be surprised if you have an unexpected disk failure at this point.

share|improve this answer
    
Thanks everybody! –  Kristan Smith Aug 15 '11 at 16:08
    
Whooops.. meant to add more. So... I created another user and was able to access via wifi. Then I switched back to my main account and am now able to access via airport. I decided to uninstall Avast Antivirus as I did notice that my system was really sluggish. Uninstallation is unclear.. I cannot remove it from my Pref Panel without Pref Panel freezing. So I trashed the application after a quick Google check. Then I shut down. Again I went to bluescreen and froze. I forced a shutdown, then restarted. This time I would not restart (for the first time) and I thought AAAAAAAH! –  Kristan Smith Aug 15 '11 at 16:13
1  
But after a second restart it worked. Weirdly, Avast is still there [correction I have now removed it - how convoluted!]. So I am thinking maybe that is part of the problem. (Although my issues [windows shutting by themselves, glitching, loss of wifi] started before I installed it or Kaspersky). So I am doing an immediate backup (should have already done one, right?) I guess the only things that are still affecting me right now = my shutdowns and startups are iffy, my system is very slow. And I guess reinstalling the OS will be my next step. Recommend good way to check my hardware? –  Kristan Smith Aug 15 '11 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.