Safari Crashes: Blames Hidden Plug-In

Question

I've been having a problem for over a week now.  Safari 5.0.6 keeps crashing, and gives the following plug-in as the likely culprit:  .ZCMpegTo.tmp.  I can't find that plug-in in any folder, and when I do a Finder search, no mathces are found.  I want to get rid of this plug-in if it is the problem, but after reading other people's problems, I'm wondering if this isn't part of a larger issue.  Could there be a virus?  I've been having another problem that has coincided with the crashes -  if I do a Google search in Safari, and click on a result, I'm not taken to the correct page.  I end up at some retail page;  never the same site however.  If I go back and click on the same Google result a second time, I go to the correct page.  Anyone else in a similar boat, and does anyone have a suggestion to correct this problem?

Answer 1

You installed a variant of the “Flashback” malware.
If you’re absolutely sure you know when that happened, and if you back up with Time Machine or something similar, you can save yourself a lot of time by restoring your whole system from the most recent snapshot taken before it was infected. Then take Steps 7 (if applicable) and 8 below.
How can you know when the infection took place? All you can be sure of is that you were infected some time before the problems started. You may have visited a suspicious website that prompted you to install some kind of software, or a “certificate.” If you remember doing that recently, mention it in a reply, but don’t post a link. Or you may have downloaded a file with a Bittorrent client, always a dependable source of malware.
If you don’t know when you were infected, there's no easy, reliable way to remove the malware, because it's constantly changing. I suggest you take the following steps immediately:
1. Back up all data to at least two different devices, if you haven't already done so.
2. Boot from your recovery partition (if running Mac OS X 10.7 or later) or your installation disc (if running an earlier version of the Mac OS), launch Disk Utility, and erase the startup drive. This action will destroy all data on the drive, so you must be sure of your backups.
3. Install the Mac OS.
4. Reboot and go through the initial setup process to create an account. Don’t import anything from your backups at this stage.
5. If running Mac OS X 10.6.x or earlier, run Software Update.
6. Restore the contents of the top-level subfolders of your home folder except “Library” from the most recent backup. The Library folder holds files such as settings and caches used by applications, and may also contain components of the malware — which are probably hidden from view in the Finder. It’s best not to restore anything from the Library folder. If you must do so, restore only files, not folders, and only if they’re visible. Don’t restore any hidden files or folders, no matter where they are.
7. If you’re running Mac OS X 10.5.x or earlier, disable Java in Safari’s preferences, and leave it disabled until you upgrade to Mac OS X 10.6.8 or later, including all available updates. The Java web plugin is unsafe to use under older versions of the Mac OS. Note: I’m not referring to JavaScript, which is unrelated to Java, despite the similar names.
8. Change every Internet password you have, starting with banking passwords. Check all financial accounts for unauthorized transactions. Take this step only after you’ve secured your system in the preceding steps, not before.
9. Reinstall your third-party software from fresh downloads or original media, not from backups which may be contaminated. If you use any third-party web browsers under Mac OS X 10.5.x or earlier, disable Java in their preferences, as you did with Safari in step 7.
More information about Flashback can be found by searching this site, or the Web.
If you use a Mac OS version older than 10.6, you should upgrade at least to 10.6.8 as soon as possible, even if you have to buy a new computer. Those older Mac OS versions are no longer maintained by Apple, and they may have other security holes, besides the one mentioned above, that make them permanently unsafe to use on the Internet.