[steve666]

I think my ibook (10.3.9) may have some kind of bug or worm from quicktime. When I tried to update prebinding I got an error message for the first time and the log mentioned quicktime as the culprit. I know Apple had a security issue recently with quicktime. My computer has been acting strange lately, taking a long time to boot and having to reboot to get it to start, then having to change my network setting to get on the net.
I was wondering if there is anything I can download that may be able to search for a possible virus/worm? Thanks.

[Cold Warrior]

ClamXav 1.0.8e912 - MacUpdate

ClamXav, if you really want to scan. But you won't find any virus or trojan. You could try an archive-install to fix almost any OS issue, assuming it's not hardware-caused (e.g., failing RAM).

[steve666]

Originally Posted by Cold Warrior 

ClamXav 1.0.8e912 - MacUpdate

ClamXav, if you really want to scan. But you won't find any virus or trojan. You could try an archive-install to fix almost any OS issue, assuming it's not hardware-caused (e.g., failing RAM).

What does it search for, just worms?
OSX10.3.9 has an archive feature? If so I should try that.

[peeb]

It is highly unlikely that you have a virus of worm.

[ghporter]

There are no current viruses, worms, trojan horses, or other malware in the wild that you can just "pick up" on a Mac. None. Not that it's impossible, but it seems to be too hard for the script kiddies to be interested, and the real virus coders see more lucrative (literally) targets in the Windows world.

What is is that makes you think you're infected, and why are you relating it to QuickTime?

[steve666]

Originally Posted by ghporter 

There are no current viruses, worms, trojan horses, or other malware in the wild that you can just "pick up" on a Mac. None. Not that it's impossible, but it seems to be too hard for the script kiddies to be interested, and the real virus coders see more lucrative (literally) targets in the Windows world.

What is is that makes you think you're infected, and why are you relating it to QuickTime?

Well,all of a sudden my ibook started acting wierd so I ran YASU and during updating prebinding I got an error message for the first time. I checked the log and the problem was with quicktime. I ran fsck and the hard drive checked out OK and then I noticed Apple had a security update for quikctime, something about maliscious codes?. I did the update and then ran YASU again and the prebinding went fine without an error.
However my computer is still acting up so I think perhaps something got into my system.

[Cold Warrior]

You didn't get anything on your system.

There are no exploits in the wild.

Your issues are indicative of other issues, like maybe a corrupt file (which an update probably fixed).

[steve666]

My system is still acting odd. I always have to restart it in the morning, it doesnt boot up properly-spinning ball and all.
Before I try to get on the net I have to switch my location from automatic to home LAN, or the other way around if its already on home LAN.

[Cold Warrior]

It sounds hosed. Just archive-install if nothing else works for you.

[steve666]

Originally Posted by Cold Warrior 

It sounds hosed. Just archive-install if nothing else works for you.

I dont have the install software, is there a way to do that from the system?
By the way, have you ever heard of something called 'pipe daemon', microsoft AU daemon'-both show up in the activity monitor. I also saw in the library something with the word daemon in it.

I would also love to get ical to stop starting up whenever I turn on the computer. I never use it.

[Cold Warrior]

does the MS AU show as intel or PPC?

for iCal, open System Prefs, choose Accounts, then your account, and the Login Items tab. iCal should be listed; select it and click the minus sign.

[steve666]

The MS AU doesnt say anything about a processor. Thats another thing located as a log in item.
Thanks for the tip about ical, maybe I should do the same for itunes helper and that microsoft daemon thing?

[analogika]

"Daemons" are invisible background applications.

The Microsoft AU daemon is the background AutoUpdate process that automatically checks for newer versions of Microsoft Office.

And a Google search:

The pipe daemon processes requests from the Postfix queue manager to
deliver messages to external commands. This program expects to be run
from the master(8) process manager.

Message attributes such as sender address, recipient address and next-
hop host name can be specified as command-line macros that are expanded
before the external command is executed.

The pipe daemon updates queue files and marks recipients as finished,
or it informs the queue manager that delivery should be tried again at
a later time. Delivery status reports are sent to the bounce(8),
defer(8) or trace(8) daemon as appropriate.

Whatever it is, it's supposed to be there.

[mduell]

Originally Posted by ghporter 

There are no current viruses, worms, trojan horses, or other malware in the wild that you can just "pick up" on a Mac. None.

Isn't the trojaned copy of Office still floating around out there?

[analogika]

IIRC, that was a 200 KILObyte file available on a couple of file-sharing networks.

Or is there something else I'm not aware of?

Also, when downloading pirated software off file-sharing networks and indiscriminately installing stuff (perhaps even authorizing it with the system password), all bets are off.
That's not malware; that's just stupidity.

IMHO of course.

[Cold Warrior]

How do we detect that trojan?

[Cold Warrior]

never mind.... this was the codec trojan that changes dns servers. It's detectable in Leopard by opening network prefs, advanced, and looking for grayed-out dns servers (that you didn't set yourself, such as on a router).

[steve666]

Originally Posted by analogika 

"Daemons" are invisible background applications.

The Microsoft AU daemon is the background AutoUpdate process that automatically checks for newer versions of Microsoft Office.

And a Google search:
Whatever it is, it's supposed to be there.

thank you

[steve666]

This is the last part of the log I get from YASU when updating prebinding gets me the error message:

QuickTime/QuickTimeStreaming.component/Contents/MacOS/QuickTimeStreaming
2007-12-16 21:27:25.584 update_prebinding[967] redo_prebinding on /System/Library/QuickTime/QuickTimeStreaming.component/Contents/MacOS/QuickTimeStreamingrebinding can't be redone for: /System/Library/QuickTime/QuickTimeStreaming.component/Contents/MacOS/QuickTimeStreaming (for architecture ppc) because of undefined symbols:
_OSAtomicAdd32
_OSAtomicAnd32
_OSAtomicCompareAndSwap32
_OSAtomicOr32
_OSAtomicXor32
_OSMemoryBarrier
.
2007-12-16 21:27:25.585 update_prebinding[967] Will check and redo_prebinding on /System/Library/PrivateFrameworks/CoreMediaAuthoringPrivate.framework/Versions/A/CoreMediaAuthoringPrivate
2007-12-16 21:27:26.086 update_prebinding[967] Will check and redo_prebinding on /Library/Internet Plug-Ins/QuickTime Plugin.plugin/Contents/MacOS/QuickTime Plugin
2007-12-16 21:27:26.906 update_prebinding[967] Will check and redo_prebinding on /System/Library/QuickTime/QuickTimeComponents.component/Contents/MacOS/QuickTimeComponents
2007-12-16 21:27:31.295 update_prebinding[967] Will rebase /System/Library/Frameworks/QTKit.framework/Versions/A/QTKit to address 0x91873000
*** Sunday, December 16, 2007 9:27:34 PM - error updating prebinding ***
Error number: missing value
Offending object: missing value
Additional info: missing value

[Cold Warrior]

it just looks like some quicktime files are corrupt or the quicktime installation is jacked up.

Just download the latest full quicktime installer from Apple and install it on your Mac to overwrite those likely corrupted files.

[ghporter]

Originally Posted by mduell 

Isn't the trojaned copy of Office still floating around out there?

I haven't heard of any new hits in quite some time-but it may be that I just stopped looking. And this isn't an "easy to stumble across and accidentally 'catch'" package, It is a "something for nothing" gimmick; it is aimed at people who figure that getting a free copy of Office is ok. Greed is bad for your computer.

[peeb]

Stupidity is bad for your computer. A 'legitimate' free copy of office is not that hard to come by...