System Preferences changing, Possible Compromised P/W

nikdgr
Re: Trojan BackDoor.Wirenet.2
Feb 15, 2014 1:25 AM (in response to Linc Davis)
I was recently reviewing comments from Linc Davis and after replying was told it might be better to start a new discussion
Ive been having issue with my MacBook Pro, finding locks open in System Preference, Password Login issues, Bluetooth enabling without going into System Preferences, in fact I rarely use Bluetooth,.. and reconfiguration of Security & Privacy, wifi starting without opening network preferences. I did run the diagnostic test Linc Davis posted in support for "Trojan BackDoor.Wineret.2".
Maybe the wrong test for me to run.
But I was informed that a colleague had aquired my password for my MacBook Pro, Im not sure if its true, second hand information, although this colleague did have access,...... How or if the P/W was attained maybe from me leaving exposed laying out in written form, not sure ....but I have since changed the password, many months back, and the issues I mentioned still come and go, any possiblity these could be changing romotely
Basically what I'd like to know is any of the information from the diaognostic test of Linc Davis's is revealing anything out of the ordinary. Additionally, I've been suggested to do a clean install becuase of a root access possibility.
I would take this to the proper authority, however where Im at: the judical system could care-less, ....the police don't even have cars, pen, let alone paper to write a report.
Thank you for any suggestions
Boot Mode: Normal
USB
   Hub (SMSC)
   Hub (SMSC)
System diagnostics
   Preview 2014-01-28-003447 hang
   SecurityAgent 2014-01-30-141803 crash
   SecurityAgent 2014-01-30-141811 crash
   SecurityAgent 2014-01-30-141949 crash
   SecurityAgent 2014-01-30-142226 crash
   SecurityAgent 2014-01-30-142411 crash
   SecurityAgent 2014-01-30-142519 crash
User diagnostics
   cider 2014-01-26-234202 crash
Extrinsic system jobs
   com.microsoft.office.licensing.helper
launchd items
   /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
             (com.microsoft.office.licensing.helper)
   Library/LaunchAgents/com.apple.FolderActions.enabled.plist
             (com.apple.FolderActions.enabled)
   Library/LaunchAgents/com.apple.FolderActions.folders.plist
             (com.apple.FolderActions.folders)
Extrinsic loadable bundles
   /System/Library/Extensions/HuaweiDataCardDriver.kext
             (com.huawei.driver.HuaweiDataCardDriver)
   /Library/Internet Plug-Ins/Flash Player.plugin
             (com.macromedia.Flash Player.plugin)
   /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
             (com.microsoft.sharepoint.browserplugin)
   /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
             (com.microsoft.sharepoint.webkitplugin)
   /Library/PreferencePanes/Flash Player.prefPane
             (com.adobe.flashplayerpreferences)
   /Library/Spotlight/LogicPro.mdimporter
             (No bundle ID)
Unsigned shared libraries
   /usr/lib/bkLib.dylib
   /usr/lib/lib6200Lib.dylib
   /usr/lib/lib6246Lib.dylib
   /usr/lib/lib6270Lib.dylib
   /usr/lib/lib7225lib.dylib
   /usr/lib/lib8200Alib.dylib
   /usr/lib/lib8200lib.dylib
   /usr/lib/lib8220lib.dylib
   /usr/lib/libAgent.dylib
   /usr/lib/libcurl.zte.dylib
   /usr/lib/libIceraDownloadLib.dylib
   /usr/lib/libmd5.dylib
   /usr/lib/libTinyXml.dylib
Restricted user files: 317
Font problems: 40
Elapsed time (s): 213

I didn't see your message last month, but was just searching for other cases of reported Wirenet infections. I've seen three cases now in the last two months, so this is obviously being actively distributed somehow, and up until March 13, Mac OS X did not protect you from it.
Wirenet, aka NetWeird, is malware that includes backdoor functionality, which means that it gives the hackers behind it the ability to install additional components on your system or make configuration changes. Basically, whatever they want to do. So, the question is, did you actually have it installed, or did your anti-virus software just detect an installer that you hadn't opened yet?
It may be too late to get such information. If you are like most people, you deleted all detected files at the time they were detected, thus destroying any evidence we might be able to work with. If you can still extract information from your anti-virus software about what file(s) were found and where they were located, that would be exceedingly helpful.
If you think you may have actually opened a suspicious installer or app, and that this malware was actually installed on your machine, there is only one possible response that can ensure that your machine is clean: erase the hard drive. See:
How to reinstall Mac OS X from scratch
If you're not sure, it would probably be safest to do this.

Similar Messages

System Preferences Changing Without User Input

I have one user who has had random system preferences change without her input.
She is a network user connecting to a Lion 10.7.5 Server via OD.
Her desktop is Lion - 10.7.4
Example: Today her setting for Security and Privacy to require a password on screen saver wake-up was changed/no longer checked.
Her setting to be able to use a right click on her mouse changed 3x last week without input.
Any ideas?

If you are asking if the user is defined more than once, the answer is no. Just one entry.

Software Update icon in System Preferences changed

Never seen this before. This morning I noticed that Software Update icon in System Preferences changed from the regular one to a BIG switch. Noticed this only in MBP.

I got it back. I moved Software Update preference pane from /System/Library/PreferencePanes to Desktop and moved it back. The original icon is back ! Ofcourse I ran Disk Permissions after checking.

Undesired automatic system preferences changes

Has anybody experienced automatic changes of system preferences after restarting/shutting down the computer?
This is what I've been struggling with since I updated to Mavericks on a MacBook Pro 13-inch Mid 2009:
1) Trackpad/scroll direction. I prefer not to have the natural scroll, but it reverts to selected
2) Keyboard: I want the F buttons as standard function keys, but this turns to unchecked
3) Language and Region/Advanced/number separators, I want the "." for decimals, but it turns to "," (I'm Italian, but for my job it's easier having the "british" sets)
4) I prefer Google Chrome as default browser, but after restarting/shutting down, Safari becomes the standard browser.

If you're having trouble making changes to files that are inside your home folder (represented by a house icon in the sidebar of a Finder window), or if you can't get changes to the settings of an application to stick, then please see below.
Back up all data.
This procedure will unlock all your user files (not system files) and reset their ownership and access-control lists to the default. If you've set special values for those attributes on any of your files, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it.
I've tested these instructions only with the Safari web browser. If you use another browser, they may not work as described.
Step 1
If you have more than one user account, and the one in question is not an administrator account, then temporarily promote it to administrator status in the Users & Groups preference pane. To do that, unlock the preference pane using the credentials of an administrator, check the box marked Allow user to administer this computer, then reboot. You can demote the problem account back to standard status when this step has been completed.
Triple-click anywhere in the following line on this page to select it:
{ sudo chflags -R nouchg,nouappnd ~ $TMPDIR..; sudo chown -R $UID:staff ~ $_; sudo chmod -R u+rwX ~ $_; chmod -R -N ~ $_; } 2>&-
Copy the selected text to the Clipboard by pressing the key combination command-C.
Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Paste into the Terminal window (command-V). I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.
You'll be prompted for your login password. Nothing will be displayed when you type it. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.
The command may take a few minutes to run, or perhaps longer if you have literally millions of files in your home folder. Wait for a new line ending in a dollar sign ($) to appear, then quit Terminal.
Step 2 (optional)
Take this step only if you have trouble with Step 1 or if it doesn't solve the problem.
Boot into Recovery. When the OS X Utilities screen appears, select
Utilities ▹ Terminal
from the menu bar. A Terminal window will open.
In the Terminal window, type this:
res
Press the tab key. The partial command you typed will automatically be completed to this:
resetpassword
Press return. A Reset Password dialog will open. You’re not going to reset a password.
In the dialog, select the startup volume ("Macintosh HD," unless you gave it a different name) if it's not already selected.
Select your username from the menu labeled Select the user account if it's not already selected.
Under Reset Home Directory Permissions and ACLs, click the Reset button.
Select
 ▹ Restart
from the menu bar.

System preference changes

I just got my iMac and I'm having trouble when I attempt to make changes in my system preferences. The only thing I've attempted to do was change my screen saver preferences, and when I do I get the annoying, spinning color wheel. After about 3 minutes or so of watching that I go to the "Force Quit" option and see that system preferences are "not responding". Anyone else encountered this problem?

Hey there,
Many people have had success by downloading and installing the iLife09 Support package. Give it a shot. Hope it helps.
http://support.apple.com/downloads/iLifeSupport_9_03\
B-rock

Why are the settings in system preference changed itself?

the settings always change back to how they were before itself. for example, in trackpad i have been choosing to use "tap to click" and after a while it will automatically untick the box for me. so as the highlight color that i have been choosing different color but ended up it still change back to blue... what should i do about that?

Back up all data now.
This procedure will unlock all your user files (not system files) and reset their ownership and access-control lists to the default. If you've set special values for those attributes on any of your files, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. If none of this is meaningful to you, you don't need to worry about it.
Step 1
If you have more than one user account, and the one in question is not an administrator account, then temporarily promote it to administrator status in the Users & Groups preference pane. You can demote it back to standard status when this step has been completed.
Launch the Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Drag or copy — do not type — the following line into the Terminal window, then press return:
sudo chflags -R nouchg,nouappnd ~ $TMPDIR.. ; sudo chown -R $UID:20 ~ $_ ; chmod -R -N ~ $_ 2> /dev/null
Be sure to select the whole line by triple-clicking anywhere in it. You'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning not to screw up. You don't need to post the warning. If you don’t have a login password, you’ll need to set one before you can run the command.
The command will take a noticeable amount of time to run. Wait for a new line ending in a dollar sign (“$”) to appear, then quit Terminal.
Step 2
Boot into Recovery by holding down the key combination command-R at startup. Release the keys when you see a gray screen with a spinning dial.
When the OS X Utilities screen appears, select Utilities ▹ Terminal from the menu bar. A text window opens.
In the Terminal window, type this:
resetpassword
That's one word with no spaces. Then press return. A Reset Password window opens. You’re not going to reset a password.
Select your boot volume ("Macintosh HD," unless you gave it a different name) if not already selected.
Select your username from the menu labeled Select the user account if not already selected.
Under Reset Home Directory Permissions and ACLs, click the Reset button.
Select  ▹ Restart from the menu bar.

System Preferences Sporadically and Unilaterally Change

I find that my system preferences sometimes change unilaterally.
I have seen isolated posts on the discussion boards about specific preference settings being lost, but I think there is a general problem somewhere. Perhaps with corrupted preference files?
1) Most commonly, I find icons missing from the menu bar (usually bluetooth status, clock, or the flag that represents keyboard input menu, but sometimes my airport status icon disappears too). It is not that they all disappear all the time -- normally I will be working just fine and a few days later will notice that something is missing. I open system preferences, change the preference back to what I want, and all is fine for a while (maybe a couple of days, maybe 2 weeks). With the bluetooth status icon, in particular, I usually find that the preference is correctly set in System Preferences>Bluetooth; which means I have to uncheck it, click OK, then go back into System Preferences>Bluetooth and recheck it and click OK before it reappears in my menu bar. This has been a problem since 10.4.1.
2) I also have been noticing, lately, that my PowerBook does not always "remember" Wi-Fi networks to which I have previously (and quite recently) connected. For example, it does not remember my hidden home network, and it has on recent occasions "forgotten" the hidden network in my office. I can always easily rejoin the networks by entering the network name and network password, but Airport used to remember even hidden networks and would log on to them automatically as long as I had correctly logged in in the past. Accordingly, I suspect this is some sort of system preference or keychain problem. I think it pre-dates my recent upgrade to 10.4.4, but I am not 100% sure. It is a bit frustrating, though, because now that Tiger stores wi-fi network passwords in the System keychain -- which apparently has a different password from the normal administrator password, and which password is so secret that even I am not allowed to have it -- I have no way to go into the keychain to view passwords that I have forgotten (unfortunately, forgetting passwords is an increasingly frequent occurrence as passwords grow more complex and more numerous and as I advance in age).
Any ideas would be welcome.
DXB Law

Problem disappeared with an OS upgrade.

Update mac os x 10.7 change system preference?

Hello,
I am a new Mac user. My Mac is os x lion 10.7. I was recently afraid of being infected with trojan and thus, I erased all the hard drive (7 passes) and then re-installed Mac os x. I set administrative password to access items with lock icon in system preference (like sharing, etc). However, after I installed the updates for Mac os x (update directly when clicking software update), I turned on my Mac and see that my setting for system preferences changed and the box "require an administrative password for item with lock icon" was unchecked (I was sure that I checked this box before).
I do not know whether the update for Mac Os x did that change or the spyware/trojan is still in my Mac and made the change to make my Mac vulnerable?
In addition, I set require administrative password to install any software or applications. However, when I clicked on "software update" from the apple icon to get updates, the updates installed without asking me for password. Is this strange and what should I do to set password for anything that need to install in my Mac.
I really appreciate your help. Thanks a lot.

There are no known viruses for Mac OS X. The system has built-in anti trojan/spyware. In short, you need to ignore a lot of warnings and just about invite it in.
i'd re-install Lion again and leave System Preferences alone. You can do an install "in place". It shouldn't effect any of your data. That said, you should always have a good backup.

Startup Disk Icon in Preferences Changed..change back?

For some reason, the icon for Startup Disk in the System Preferences changed on me, and I am unsure of how to change it back. I have already tried repairing permissions with no sucess. If someone could let me know how to change it back and (if i need it) send me the icon or point me to where the original icon would be. Thanks in advance.
Here is a picture of the current icon: /___sbsstatic___/migration-images/migration-img-not-avail.png
<html>
MacBook 1.83 GHz, 1 GB RAM Mac OS X (10.4.7) HP zv5000 P4 2.8 Ghz (128 ATI 9000, 512 mb, XP); PowerMac G4 400 AGP 1 GB OSX 10.3.9

hi - Welcome to Apple Discussions!
try this:
Open your hard drive > Library > Caches folder in the finder...
Drag the file named com.apple.preferencepanes.cache to your Desktop...
look at System Preferences again - is it o.k.?
if so, trash that prefpanes cache file on your desktop...
if not, post back...
cheers

Unable to change mouse settings in System Preferences

Using a standard wired USB Apple Mouse (oval shape with scrolling nib and squeeze option for the 4th button), the options in System Preferences seem to have no effect. Have tried configuring the secondary button (to emulate right click) and nothing happens. The 4th button used to function as "Mission Control" but now there is no effect. Is it possible the mouse hardware no longer works? It's less than a year old.
Some other information: I recently reinstalled the iMac to make room for BootCamp and Windows 7. Could that process have soured to mouse settings? Right clicking (same mouse) works in Windows 7 so I doubted the hardware problem.
I've followed steps for removing HID plists and stuff from the Library/Preferences area, but no joy. Is there some other troubleshooting I can perform to get this feature working again? It *was* working before the reinstall, but now isn't.
BTW: I'm aware of the "<control>click" to get a right click going, but when you get used to using something and are very productive in that method it is difficult to just "change the way I'm doing it" so please help me to find the cause for this issue instead of teaching me new ways to do things.

Please read this whole message before doing anything.
This procedure is a test, not a solution. Don’t be disappointed when you find that nothing has changed after you complete it.
Step 1
The purpose of this step is to determine whether the problem is localized to your user account.
Enable guest logins* and log in as Guest. For instructions, launch the System Preferences application, select Help from the menu bar, and enter “Set up guest users” (without the quotes) in the search box. Don't use the Safari-only “Guest User” login created by “Find My Mac.”
While logged in as Guest, you won’t have access to any of your personal files or settings. Applications will behave as if you were running them for the first time. Don’t be alarmed by this; it’s normal. If you need any passwords or other personal data in order to complete the test, memorize, print, or write them down before you begin.
Test while logged in as Guest. Same problem?
After testing, log out of the guest account and, in your own account, disable it if you wish. Any files you created in the guest account will be deleted automatically when you log out of it.
*Note: If you’ve activated “Find My Mac” or FileVault, then you can’t enable the Guest account. The “Guest User” login created by “Find My Mac” is not the same. Create a new account in which to test, and delete it, including its home folder, after testing.
Step 2
The purpose of this step is to determine whether the problem is caused by third-party system modifications that load automatically at startup or login.
Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards. Boot in safe mode* and log in to the account with the problem. The instructions provided by Apple are as follows:
Shut down your computer, wait 30 seconds, and then hold down the shift key while pressing the power button.
When you see the gray Apple logo, release the shift key.
If you are prompted to log in, type your password, and then hold down the shift key again as you click Log in.
Safe mode is much slower to boot and run than normal, and some things won’t work at all, including wireless networking on certain Macs. The next normal boot may also be somewhat slow.
The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.
*Note: If FileVault is enabled, or if a firmware password is set, or if the boot volume is a software RAID, you can’t boot in safe mode.
Test while in safe mode. Same problem?
After testing, reboot as usual (i.e., not in safe mode) and verify that you still have the problem. Post the results of steps 1 and 2.

Is it possible to have your system preferences saved as a profile?

I have hooked my Mac up to my 40" TV. I'm using a clever little box that combines the minidisplay port and toslink into an HDMI output. However, I would like different settings in preferences depending on which display I'm using. For example I would like the dock, icons and cursor a bit bigger and optical audio output for the TV, but normal sized and analouge out for my usual monitor. Since I'll never be using both at the same time (I only have the one head) I'd like to be able to save my system preferences into 2 profiles and select between the 2 rather than manualy changing everything each time. Is this possible? It seems like it should be but I can't find a straight forward way to do it.
Two potential solutions spring to mind, first use different users for each display and switch between the 2 but this is far less than ideal. Secondly, set up for one display and save copies of the relevant plist files, then set up for the second display and save again then use a script/automator action to switch between the 2 and restart Finder. Although I have no idea about the technicalites of the second solution. All help appreciated.

Some progress on second idea. Saved a copy of universal access plist with cursor set to large then set the cursor to small again. Replacing the plist file had no effect until I went into the UA pane and changed a setting at which point it must rewrite the file and refresh because the cursor size also changed at this point.
Tried the same again and restarted Finder, no effect. Also tried altering another pref pane instead with no effect. Need a way to force the computer to look at the plist files, no idea how though. :-)

System preferences won't save changes

When making changes in my system preferences, say changing the screensaver, the change does not save. When I go back into the preferences, they have reverted back to the previous setting. It's also doing the same thing with Safari. When I delete all website info in the preferences, it reverts back to the previous. I just upgraded to 10.7.1, but it was doing it before with 10.6 as well. Any idea what's causing this?

Possible conflicting or corrupted files, usually preference files. Step one is create a new admin user account, log into it, and see if changes persist.

Remotely changing System Preferences via Firewire?

Hi all,
I've got an old mac mini and a new Mac book. The trick is, I've just moved overseas and don't have a monitor for the mini any longer. I have bought a cable to connect it to my tv, but I'm afraid the tv is too old, and won't play nice with the mini! Of course I cannot afford a new monitor either!
My goal is to set up the Mini as a home server for my MacBook and a windows machine. To do so I need to adjust all of three settings. The trick is, I can't figure out how to get in to change the preferences in order to make this possible.
I can start the Mini in Target disc mode, but of course cannot install any screen sharing software, etc. remotely. Does anyone have any ideas on how I could get access to the mini's System Preferences? Could I do that through Terminal? Boot camp?
Thanks in advance for any suggestions!
JakeOle

Hi Jake, and Welcome to the Discussions!
You could change the Sharing settings in...
Mini's /Library/Preferences/com.apple.sharing.firewall.plist
You'd likely have to use Terminal to reset the Permissions on it after saving it again though.
The Mini is pretty portable... know a friend with a Monitor?

Changing System Preferences

I work in an office at a university which maintains all the teaching classroom computers, and we periodically reinstall OS X and generally refresh all our Macs once (or more) a year from a custom-made image which has all of the proper software set up, etc. There are a lot of computers, and it's a pretty time consuming process, so I thought it would be helpful to create an Applescript that automatically fills all the network settings back in through System Preferences instead of doing each one manually. I've only just started learning Applescript, and while I'm pretty sure this can be done, I'm just not sure how. I've read through tons of tutorials, but I can't come up with a solution.
I have been using Xcode to create a nice interface, and what I would like to do is create a drop-down list of all the classrooms, so whoever is running the Applescript can choose a room from the list and the script will change the computer's IP and network settings. I have gotten as far as making System Preferences open up and change to Network settings, but beyond that I am having trouble. I need to know how I can get Applescript to modify the text fields in the Network pane. I have tried many different methods for this, but I can't seem to come up with one that actually works.
Can someone tell me (or point me in the direction of a good tutorial) how to modify the contents of text fields with Applescript? I think I can figure the rest out once I get past this little hurdle, but meanwhile it's driving me crazy. Thank you in advance.

> Can someone tell me (or point me in the direction of a good tutorial) how to modify the contents of text fields with Applescript?
I'd recommend a different approach.
While it is possible to modify text files via AppleScript, if you're manipulating preferences you should familiarize yourself with the defaults command.
defaults gives you command line access to the preferences system. You may need to do this anyway since many preference files are moving to a binary .plist file rather than text files.
man defaults will give you the basics. You can invoke this via AppleScript's do shell script command if you want an AppleScript solution.

Use Automator to Change System Preferences?

Hi. I want to create a workflow or applescript that will open my system's sound preferences and change the output source. The Applescript editor doesn't record any of my actions.

Modify the setting from System Preferences, and then look for plist files in ~/Library/Preferences/ and /Library/Preferences/ modified around that time. When you've located a possible plist, open the Terminal application in the /Applications/Utilities/ folder and enter 'defaults read ' without the quote marks. Drag the plist into the Terminal and press Enter; you will then see a list of keys. If a key looks like it contains what you're looking for, remember its value, change the setting again from System Preferences, and check the key again. Once you've found the key, you can use a 'defaults write' action in Automator's shell script option to change the value. If you can't write the key successfully, post back here with the name of the key and where you found it for further assistance.
(12421)

System Preferences changing, Possible Compromised P/W

Similar Messages

Maybe you are looking for