How do i recover from a total lockup

My Mac Mini running Snow Leopard locked up last night. The external touchpad moves the cursor but seems to have lost click capability. The keyboard seems to work.
I shut it down using the hardware switch on the back, but when I turned it on again today the same programs were still open and the machine was locked up.
I was able to close the programs one by one by right-clicking on its icon (the touchpad does respond to the 2-finger right click), pressing arrow keys until Quit is highlighted, then hitting Enter. All the programs are closed but the machine is still locked up.
I get no response when I click on the apple logo in the upper left corner of the screen. I can right-click on it, which brings up it menus, but I cannot highlight any of the choices.
Is there a keyboard command I can use to reboot? or do you have any other ideas? TIA.
(Luckily I brought my work laptop home with me, so I am using that to communicate.)

If you can access the Apple menu, bring up Force Quit and force quit Finder. See if that free's things up.
Cmd/Opt/ESC brings up the menu.

Similar Messages

HT4859 How do I recover from Icloud - I want to "roll back" my phone to the 3rd of October

How do I recover from Icloud - I want to "roll back" my phone to the 3rd of October

If your device backs up to iCloud, and that would happen every day assuming "conditions" are right, then you probably only have the latest backup available for a restore. You won't have one taken October 3 available.
I say "latest backup available" because, although Apple mentions up to 3 backups are available for restore, most users report having only one when they try performing a restore. Certainly expecting going back 5 days would be outside the limits.

HT201274 ipad is disabled. how do i recover from different computer

My daughter has managed to disble her ipad by enetering the wrong passcode to many times and not it disblays locked connect to itunes. However we are overseas and I cannont connect the device to the iMac (which it is normally synced to), I only have my laptop. How can I recover her iPad? Help.

Recovery Mode
1. Disconnect the USB cable from the device, but leave the other end of the cable connected to your computer's USB port.
2. Turn off the device: Press and hold the Sleep/Wake button for a few seconds until the red slider appears, then slide the slider. Wait for the device to turn off.
3.While pressing and holding the Home button, reconnect the USB cable to the device. The device should turn on.
4. Continue holding the Home button until you see the "Connect to iTunes" screen. When this screen appears, release the Home button. iTunes should alert you that it has detected a device in recovery mode. Click OK, and then click Restore to restore the device.
Note: Data will be lost.

How can I recover from the new Pages

Does anyone know how I can recover a Pages file which has become locked into the new Pages program? I never edited it with the new Pages, but now I'm told I must have the new Pages to open it. I even tried opening it with the new Pages and converting it to PDF with the plan to copy and paste it into Pages '09, but i lost control of line spacing, etc. (It is a 4-column file of data on one page (in the '09 version, that is). Appreciate any help.

Jay,
Surely you did edit the file with Pages 5.2, or you wouldn't be having this problem. It's an easy mistake to make since both versions have exactly the same filename and extension. They are just stored in different folders. 5.2 is in Applications and 4.3 is in Applications/iWork '09.
Use TimeMachine to locate a clean backup file.
Jerry

How can I Recover From Damaged Drive?

Hi,
I've had an internal HD corrupt in my new Mac Pro, and I'm wondering what I can do to recover the data. I've looked at this several posts including this one listing 3 data recovery software apps:
https://discussions.apple.com/message/15249262#15249262
I also considered using Ubuntu Remix as described here, but it's looking like the dd tool exists in OSX as a command from terminal? That led me to this article, describing how to use the dd tool. So IS this something that's just included in OSX? Also, I'm not really clear on what to enter for the Unix drive path. The drive shows up in Disk Utility as a 4.14TB drive (even though it's only 2TB), but is not mounted, and so I don't know what the drive path would be. . . would it still be /volumes/Archive? Or would it be the name I see in Disk Utility?
I've already tried Disk Warrior (booting to the CD even though the drive in question is not my OSX drive), and it said the drive couldn't be rebuilt. When I startup the computer, it gives me a message saying the drive couldn't be initialized, and the option to initialize, eject, or (I think) ignore.
Does anyone have any thoughts on the best methods from what I've listed here? I can supply more information if needed. Just tell me what to look for.
Thanks,
Lawrence

Lawrence,
The same has happened to my gf's iMac. She has 27" iMac mid 2011 and today the drive went down. Instead of 1TB HD with two partitions Disk Utility lists it as "4.14 GB ST_M13FQBL Media" with no partitions. On top of that there is a strange noise generated - I believe this is fan related.
It took me a while to workout what the heck was going on with it as Apple Hardware Testing (AHT) does not list any problems. Initially I thought that MBR was wiped due to Windows 7 service pack installation, but when run Disk Utility I realized that there is something wrong with HD.
Apple started replacement program for faulty Seagate HDs for iMac sold between late 2009 and mid 2011. Unfortuantely her iMac is not eligible, but luckilly it is still on warranty. More details about the recall can be found here http://www.apple.com/uk/support/imac-harddrive/
I have read a bit about the issue and I found this link was very usefull:
When a drive powers up, its MCU (microcontroller) puts it through a self test during which it confirms the integrity of the SDRAM and serial flash memory, among other things. It then consults the PUIS flag and, if disabled, it commands the motor controller IC to spin up the motor. The drive then accesses the hidden System Area (also called the Service Area or Negative Cylinders) on the platters and retrieves information such as the runtime ATA firmware, P-list and G-list (factory defects and grown defects), translator (to convert LBAs to physical Cylinder/Head/Sector), etc. If any of these modules are corrupted or inaccessible, then the drive powers up in a kind of "safe" mode. In this mode there is no access to user data. Sometimes the drive reports 0 LBAs, as is the case with some Seagate models that have corrupted G-lists or SMART data. At other times the drive identifies itself with its "factory alias" (eg ST_M13FQBL or ROM MODEL HAWK) rather than its actual model number. This alias is stored within the serial flash memory on the PCB.
Milos on his blog (http://www.milos.ivanovic.co.nz/blog/218) explains similar problem and shows the solution how to perform a DIY repair of the HD. Unfortunately I am not sure if the fix applies to this case, and also, I do not have required hardware to perform the repair (and additional machine I could temporaily plug the HD to power it up)
Lawrence, it would be great if you shared your experience on recovering the data from that drive. My gf does not want to turn her iMac to Apple service yet as she wants to get her data back from the drive. I am planning to run some data recovery apps against that HD, and if nothing, I will send the HD to Seagate Recovery Services and hope to get it done for free as it is their faulty drives.
Thanks,

How can I recover from Windows login failure: User Profile Service failed the login

I have Boot Camp installed on a separate partition on a MacBook Pro, late 2011 model. I have Mavericks installedd (10.9.1). I use, variously, both Parallels and VM Fusion to access the BootCamp installation of Windows 7.
Except for having recently installed updates of both VMFusion and Parallels, I got this failure message when trying to login to Windows:: The User Profile Service failed the logon. User profile cannot be loaded.
I had just been on Windows a few moments previously to access a business site that only accepts IE. Appreciate any useful insight on dealing with this issue without having to totally replace the BootCamp installation. A lot of the suggestions on Microsoft Windows repair sites are either incomprehensible or don't seem applicable.

Same problem here. Windows 7 support gives several so-called fixes (including regedit tweaks, eliminating the blocked user account), but all require access to that partition. So far as I know, I have only one user, since this is my personal computer -- unless there is some sort of default "administrator" logon.
Windows support says the problem might be caused by antivirus software running while we try to logon, but this problem has never happened to me before, and I have not made anti-virus changes (maybe AVG or Avast did so automatically)
I tried to access regedit through Finder, but get a garbled text-edit with the message that regedit cannot be opened by DOS.
So I wonder (a) is there a default admin logon? (b) Can we tinker with the settings inside Windows from Finder, or (c) how else can we get into Windows?
My setup: Macbook Pro (Fall 2010), 10.6.8, boot camp, Windows 7.

Both drives failed in RAID 1 array. How do I recover from this?

So I have a large problem on my hands; my RAID 1 array has 2 disks which have both failed. One disk failed at a time with a span of about a month between the 2 failures. Since I hear no clicking noises from the disks and I can still see both of them when I do a "diskutil list", I'm guessing the disk electronics are good as well, so I should be able to work with the disks. Here's the output from "diskutil checkRaid" :
Name: USB RAID Set 1
Unique ID: AD191DE5-49CB-4BEE-9362-D98B690DAC3A
Type: Mirror
Status: Offline
Device Node: disk2
Apple RAID Version: 2
# Device Node UUID Status
0 disk1s3 5D09E4DE-E0E9-4518-8672-F247F5CE0CBB Failed
1 disk3s3 431B65E0-DF51-4045-8C1E-CCB69E95916D Failed
Here's what I'd like to do: Although I have a good idea of which of the 2 disks has the most recent data on it, I'd like to be able to mount disk1s3 and disk3s3 independently and compare which has more data on it. Then, I'm going to plug in another USB hard disk and copy the data from the failed raid disk with the greatest disk utilization over to the USB disk I plugged in. At that point I'll trash the RAID 1 array and start over again. Of course I have no backup of my data, so just recovering isn't an option (my genius thinking was, "Ahh who needs backups, I'm using RAID!" Hah.. good one).
I tried doing the following to mount the slices: # diskutil mount disk1s3 and # diskutil mount disk1s3 force. Neither of which mount the disk. I've also tried specifying a mount point and that doesn't work either. All commands come back with "Volume disk1s3 mounted" but if I type "mount", I don't see it mounted anywhere. dmesg and /var/log/system.log don't give me anything useful about why the slices don't mount... the only thing I see from dmesg are the errors which started this mess:
HFS resolvelink: can't find iNode6487433
USBF: 107524. 33 AppleUSBEHCI[0x27c4800]::DoControlTransfer sync request on workloop thread. Use async!
AppleRAID::recover() member 5D09E4DE-E0E9-4518-8672-F247F5CE0CBB from set "USB RAID Set 1" (AD191DE5-49CB-4BEE-9362-D98B690DAC3A) has been marked offline.
AppleRAID::restartSet - restarting set "USB RAID Set 1" (AD191DE5-49CB-4BEE-9362-D98B690DAC3A).
disk2: media is not present.
HFS: err 6 reading VH blk (RAID 1)
jnl: flushing fs disk buffer returned 0x6
disk2: media is not present.
jnl: dojnlio: strategy err 0x6
jnl: writejournalheader: error writing the journal header!
AppleRAID::restartSet - restarting set "USB RAID Set 1" (AD191DE5-49CB-4BEE-9362-D98B690DAC3A).
AppleRAIDSet::addMember() detected expired sequenceNumber (12) for member 5D09E4DE-E0E9-4518-8672-F247F5CE0CBB
Also here's a diskutil list in case that's useful to anyone:
# diskutil list
/dev/disk0
#: type name size identifier
0: Applepartitionscheme *74.5 GB disk0
1: Applepartitionmap 31.5 KB disk0s1
2: Apple_HFS Macintosh HD 74.4 GB disk0s3
/dev/disk1
#: type name size identifier
0: Applepartitionscheme *931.5 GB disk1
1: Applepartitionmap 31.5 KB disk1s1
2: Apple_Boot 128.0 MB disk1s2
3: Apple_RAID 931.4 GB disk1s3
/dev/disk2
#: type name size identifier
0: Apple_HFS *931.4 GB disk2
/dev/disk3
#: type name size identifier
0: Applepartitionscheme *931.5 GB disk3
1: Applepartitionmap 31.5 KB disk3s1
2: Apple_Boot 128.0 MB disk3s2
3: Apple_RAID 931.4 GB disk3s3
/dev/disk4
#: type name size identifier
0: Applepartitionscheme *647.5 MB disk4
1: Applepartitionmap 31.5 KB disk4s1
2: Apple_HFS DiskWarriorCD 647.4 MB disk4s2
So, does anyone know how I can mount the slices independently so that I can grab the data off the useful slice?

Ok figured this one out myself. So the file system types that the FS is labeled with isn't known by the standard mount program, but really under the covers apple's software raid slice is just a HFS partition. Fantastic.
1) So first you figure out what slice you want to mount, in my case /dev/disk1s3 (oh ya, unlike the diskutil command, you need to actually specify the full path to the device so you need the /dev in there)
2) Create a mount point to mount the slice to "mkdir /Volumes/disk1s3" for example
3) Mount it up! "mount -t hfs /dev/disk1s3 /Volumes/disk1s3"
4) If you're interested in actually using the GUI to view the files, you can place an alias on your desktop by doing a "ln -s /Volumes/disk1s3 /Users/<putyour_user_namehere>/Desktop/disk1s3 "
This probably only works for a RAID 1 or maybe even a RAID 1+0 but in any case it allowed me to pull my data off so that I could back the data up and re-create the RAID 1 setup. You should only be doing this if both your drives get marked as failed, otherwise it's way easier to just use the disk utility to repair the array.

Firefox froze - needed ans to msg - unable to do - browser froze - had to delete - reload frm scratch - lost bookm - how do I recover from an older copy of ffox

I had opened ff and i got this empty msg bubble ( as in the newspaper comics ). It required an answer, but I had no idea what it was asking. The only thing that loaded on top line,i.e. firefox file edit view etc. was the word firefox. I could not go any further until msg was answered. I messed with this thing for three days and got nowhere. The only thing that I could figure out was that part of the software code was clobbered. I deleted and reloaded firefox, no luck. I got to the same point every time and the browser stopped. Fortunately I have Safari that was fully operational and was able to continue with the download of mozilla firefox for the Mac. I am using MAC OS X Lion 10.7.5 I finally conlcuded that the only way I was going to get this thing up and running was to delete/uninstall and empty the trash and recreate FIREFOX, which worked, but I LOST everything worse part was all the bookmarks. I can no way remember all of these NECESSARY bookmarks. However I do have, I believe, what is to be an old copy of Firefox. Can I find out if these are the correct bookmarks and if they are can I copy or import to get them merged back into the bookmark files on firefox.
I need some help.

Hi please see the instructions on how to recover bookmarks from an old profile: [[Recover lost or missing Bookmarks]]

How can I recover from a Botched BATCH DATE CHANGE in iPhoto?

Botched Batch Date Change iPhoto08
Short Story: Intending to change the date for one photo I managed to change the dates for all 8,525 images in my iPhoto08 library to the SAME DATE!! I found that the original creation dates were saved in the in the Modified field that appears in the Photo Info Window / File metadata subsection. I would like some help figuring out how to set the Date Created to this File Modified Date that appears in the Photo Info Window.
GORY DETAILS:
I used iPhoto08/ Photos menu / BATCH CHANGE... /“Set DATE to 20100723 1:20:54 PM” with “Modify original files” checked. iPhoto changed all 8,525 images to the same date.
I now realize I should have used Photos menu / Adjust Date and Time ... But the damage was already done. Unfortunately there was no Edit menu / Undo for this operation. ALL 8,525 images have the same date. I checked in the the iPhoto Information sidebar--same date all images.
Next, as a test, I dragged an image to the desktop and opened it in Graphic Converter7.0.3. The same date “20100723 1:20:54 PM” appeared in the Image Browser List /”Date Created”, “Date Modified”, “Date Captured” metadata fields.
The following appeared in the Graphic Converter
Image Preview sidebar (subWindow) going left to right
Image menu/button
Date and Time: Friday, July 23, 2010 1:20:54 PM PT
Exif menu/button
File date and time: 2010:07:23 13:20:54
Date and time of original data generation: 2010:07:23 13:20:54
Unknown tag (36868): 2010:07:23 13:20:54 <- significant?
ExifTool menu/button
ExifTool Version Number:8.40
Warning: [minor] Suspicious MakerNotes offset for tag 0x9001
----System----
File Modification Date/Time: 2010:07:23 13:20:54-07:00
----IFDO----
Modify Date: 2010:07:23 13:20:54
----ExifIFD----
Date/Time Original: 2010:07:23 13:20:54
Create Date: 2010:07:23 13:20:54
<<<<<<OH MY GOD >>>>>> the BATCH CHANGE / SET DATE not only RESET the date for EVERY IMAGE in my library, it also changed the date metadata EVERYWHERE inside each individual image file.
Actually it's my Mom and Dad's iPhoto library containing all the kids and grand kids pictures, family trips, important events, everything. There is no backup. I feel as if I have tipped over a file cabinet containing all our photos. Our “date and event” organized 8,525 image iPhoto library was now as useful as a giant shoebox. On second thought, a shoe box full of real photo prints would be more useful than my iPhoto library because the prints would have the print date stamped on them.
At this point feeling desperate I closed my eyes and said a quick prayer to Saint Rita - Patron Saint of the Impossible.
I returned to iPhoto .................and noticed the Show Photo Info MENU item in the Photo Menu.
I selected it.
And Low and behold,
in the Photo Info WINDOW,
under the Meta data File SUBSECTION, the correct photo creation date appeared -->" Modified: 20071002 05:46:07 PM" I checked different photos ... They all had different FILE MODIFIED dates. These dates were/are the old creation dates! My prayers were answered: THANK YOU SAINT RITA!
But now I am really stumped! This File Modified Date seems to be some kind of external metadata that is indexed or keyed to each image. How is this metadata stored in the iPhoto library? How can I access this File Modified date? I now turn to you GREAT iPhoto WIZARDS. Pray tell, how can I set the “Creation Date to the file Modified Date” that appears in the Photo Info Window as a (scriptable?) batch process.
I am on my knees for this one...please help. we have iphoto11 but afraid to upgrade to it. until i know more i don't want to loose this Modified Date metadata.

thanks for the quick response...
no simple solution because no backup to restore from
iPhoto seems to be using file metadata as some sort of index key in the
Photo Info Window. open up the iphoto library package and take a look at
the .xml file -- ModDate is used everywhere. hoping to export this data and merge/join it to
each image.
still trying to figure it out.
thanks,
Tom

How do I recover from a failed installition of driv

Hi, I have a problem with a failed installation of the soundblaster Extigy on my Toshiba Satellite P00-88 notebook PC. The problem is that it has only partially installed on my system and the processes listed below are running at startup;
RcMan.exe
RCenter.exe
Mediadet.exe
CTNotify.exe
CTsvcCDA.exe
I can't uninstall them as they don't show up in add/remove programs, but I can stop them running with msconfig and I can switch off the disc detector software, but I would rather get rid of them altogether. I've given up on installing the Extigy as it fails every time at 4% on the progress bar of the installation program with task manager reporting the installation wizard failing to respond, although it works fine on my desktop machine.
Would it be safe to make a backup of the registry, then search through it and delete all instances of creative? The sound card on the notebook is conexant, which is the reason for trying to install the Extigy to start with as it's total rubbish as a sound card, does it use any creative entries in the registry? I made a system restore point before installing the Extigy but it and previous other restore points don't work, reporting nothing changed on the system, even though the soundblaster installation events show up on the list after the restore point. Any help would be appreciated.

Hi jutapa thank's for pointing me to that piece of software, It seems to have done the trick! I use Process Explorer (a program by the same people), that's how I found which processes where related to Creative, I wonder why the "delete process" option isn't incorporated into that program? It would have saved me even posting here LOL.

How do I recover from a hard drive crash??

I had an extreme hard disk crash with all of my images and the recovery service could only recover a few of the images. Here's my problem - when I originally imported my Nikon images (.NEF format) into LR, I created a new .dng format and saved the .NEF images as the backup copy. Now that I'm trying to get images back, when I try to import from the backup image in the .NEF format, I get a message in LR that says "The files appear to be unsupported or damaged." What the heck does that mean? What good are the backups if I can't get to them in LR? Please help or I've lost thousands of images to use in LR.

Quilla98 wrote:
I just did some checking and LR seems to import .NEF format files if taken with the D70 but not with the D90. So it appears you are absolutely correct about 1.4.1 not supporting the D90 .NEF files. I guess Bridge can handle the D90 .NEF format but LR won't. So to use the same process again, I'd have to somehow clear all of the files that Bridge has and start over. It would probably be much simpler to either use the DNG converter or upgrade to LR 2.
Support for the D90 was introduced along when the Camera Raw 4.6 update whereas Lightroom 1.4.1 only supports cameras included by Camera Raw 4.4.1. So, yes you will have to upgrade to Lightroom 2.x or convert the NEFs to DNG format.

How do you recover from catastrophic change of PC and iPhone at same time?

Long Story:
1) Upgraded from iP3G to iP4 last year, kept both. iP4 synched regularly. 3G in storage.
2) Synching PC died (motherboard) but have HDD.
3) LOST iP4 in mountains.
4) Got new PC.
5) Reactivated 3G.
Now I'm trying to figure out what files to put where from old HDD to new PC to get contacts/data/settings/SMS/photos, etc? I have it all on the old HDD and it is in an enclosure. I just need to know what key files I need, where they are on the old HDD and where to put them on the new. (Both old and new PC's are running Win7 Ult.)

Thanks, Eric-
Not a great option at this point, b/c I'm using this as an opportunity to rearrange the file structure of my stuff, using libraries differently and the like, and I've already moved some things. I found the below post on another thread helpful, except...
Computer crashed, moved iPad to new PC...
When I go to Edit>Preferences>Devices, it lists the backup I want to restore from, but it has the same name as the current backup. When I right click on the iPhone under Devices and go to the Restore from Backup Wizard, it only lists the current backup.
So here's what I tried:
0) Went to Users>Me>AppData>Roaming>Apple Computer> MobileSync
1) I created a folder called "Temp"
2) I copied the current backup folder to Temp
3) In the Backup folder, I opened the folder containing the current backup and deleted the whole thing, emptying that folder.
4) I copied the entire contents of the desired backup into the newly emptied folder.
5) But now it doesn't give me the option to restore.
6) So I undid the changes and got back to square 1.
So my current question is how can I get it to restore from an alternate backup, especially since the two phones had the same name so the backups have the same name?

HT4759 How do I recover from iCloud long running script problem on pc?

I have not been able to access icloud from my pc for weeks. I have 2 icloud accounts set up and several iOS devices. Does anybody know how to address this? Windows 7

The message that I get is a "long running script error" - any ideas?

Activation: how can I recover from a hard drive crash?

My hard drive crashed on me... All my data is safe, but now I have to figure out how to reactivate both Lightroom 3 and CS3.
I have rebuilt the failed machine with a new hard drive, but it was getting rather old so I also took the opportunity to purchase a new machine. My intention is to get Lightroom and CS3 installed and registered on the new machine. I understand that under normal circumstances I could deactivate Adobe products on the old machine, install and reactivate on the new machine. But since I rebuilt it, the old machine doesn't actually have Lightroom and CS3 installed and activated -- no activation, so no chance to deactivate.
I see two options. Which is easier?
I could reinstall both Lightroom and CS3 on the old machine, activate them, then deactivate them, then install and activate on the new machine. If I reinstall and reactivate on the old machine, will Adobe's activation service recognize that I'm reactivating on a machine that already had Lightroom and CS3 installed (everything is the same except the hard drive)? If not, will I be able to activate since I will be trying to activate an already-activated license?
Alternately, I could just install on the new machine and attempt to activate there. I expect I'll run into problems, again because I'm trying to activate with a key that was used to activate on a different system. I expect I'll have to phone into Adobe to clear this up.
I'm concerned that if I take the wrong path it will make it more difficult to get everything working in the end, possibly to the point where Adobe will refuse to allow me to activate my licences on my new machine. Does anybody have any advice?
Thanks.

Since CS3 is not a shipping version there is NO activation needed, only the current shipping version. Install CS3 and insert the serial number.
Do the same with LR. No install, uninstall, gymnastics needed nor phone calls to Adobe Tech Support.
I did this when my power supply shorted and took the whole machine up in smoke, all four hard drives worth. When I got the new computer I just installed CS2 with the license and no activation needed.
Rich

How does one recover from Downloader:OSX/Flashback.C?

Hi All,
I am pretty sure I dowloaded and installed it on one or more of my machines...
It seems that a re-install of Lion is the only way to bring back Lion's XProtectUpdater functions...
Is there a thread for fixing this dumb mistake?
Cheers,
Adam

After giving this additional thought, I realize that you seem to be the first to report having been infected by this version, so I don't think any of us can offer an exact solution yet. If you don't mind taking your time, I'd like walk you through this slowly so we can all learn more about it.
It would seem that this version was served up for a short time around Oct 11. Do you know if you used it that long ago or was it more recently? Do you still have the installer? If so, hang on to it for now as we may need you to provide it to some sample sites.
Go ahead and test to see if XProtect has been compromised by opening your Terminal app (in the Utilities folder) then copy and paste the following into a new window after the "$" prompt:
sudo launchctl list
hit return and when prompted, enter your admin password (you won't see any typing) and hit return again.
The list should include "com.apple.xprotectupdater.plist" if it's working.
If it's not working, then inspect either of the following two files:
/System/Library/LaunchDaemons/com.apple.xprotectupdater.plist
/usr/libexec/XProtectUpdater
If either are blank, then you have been infected. Restore from backup or reinstall Lion.
Next you will need to fix Safari and/or FireFox. F-Secure has these instructions:
Disinfection
Manual Removal Instructions
In Terminal, convert the affected PLIST files to XML:
plutil -convert xml1 /Applications/Safari.app/Contents/Info.plist
plutil -convert xml1 /Applications/Firefox.app/Contents/Info.plist
Remove the following entry from the PLIST files:
<key>LSEnvironment</key>
<dict>
<key>DYLD_INSERT_LIBRARIES</key>
<string>%malware_path%</string>
</dict>
Delete the file specified in %malware_path%
Intego explains concerning Safari:
...it adds the actual backdoor module at /Applications/Safari.app/Contents/Resources/UnHackMeBuild.
What I don't know is whether or not any of the other files are still installed. They were:
.MacOSX/environment.plist
Library/LaunchAgents/com.apple.SystemUI.plist
Library/Preferences/perflib
Library/Preferences/Preferences.dylib
Library/Logs/softwareupdate.log
and Intego said that #4 is not installed. If you find any of them please move them all at once and hold on to them and let us know. The first is a hidden folder, so if you need help looking into that let me know. If that one is not moved at the same time as the others you will probably be unable to log back into your account.

How do i recover from a total lockup

Similar Messages

Maybe you are looking for