Two Trojans found after TimeMachine backup?

HelloSeveral weeks ago I and after a weekly manual backup I discovered that I had two Trojans and after several attempts two get rind of then they keep popping up every time I do a TM backup.When I click unlock to delete the Trojans they both disappear until next time I do a TM back.Has anyone else found these on their computers and if so how did you get them off for good?Cheers Colin Please see attached for the little nastiest.

Hey MiltonX
Sorry you're having trouble with this. It sounds like the threat is probably being backed up somewhere in the time machine.
First thing to do is take a look at the path where the threats are located. You can usually find this in the quarantine manager after you authenticate as administrator. If you don't see it listed in the scan results, you can either click "reveal in finder" from the quarantine manager, or if you can't find the full path that way, pull up the scan log by clicking the small gear icon in the "scans" menu and selecting "View scan log."
Once you've found the full path to the threat, take a look at this article. I'm guessing the path will be located somewhere in /Backups.backupdb/. If that's the case, you can skip to step 18 and follow the instructions under the Time Machine Archive heading. That will walk you through removing the backedup threat and hopefully prevent it from coming back anymore.
Hope that makes sense, but if you have any questions, let me know!

Similar Messages

My backup drive is no longer bootable after TimeMachine backup to it. Why?

When I purchased a Lacie Porche 350 GB Firewire drive, I partitioned it properly via Disk Utilities and backed up my entire Hard drive using SilverKeeper to one of the two drives created by partitioning, resulting in an OS 10.4.10 Tiger bootable drive. Which I tested and it booted up perfectly. The day prior to upgrading to Leopard OS, I used SilverKeeper to back up everything on my hard drive again, since there were a lot of system software, security, also software programs and utilty updates on board since mm initial backup. Afterwards, I checked out the bootability of my back up drive (partition), which again worked perfectly.
After installing Leopard, TimeMachine recognized and asked if I wanted it to back up my hard drive (with Leopard O)S to the same (it recognized) named backup drive (partition) and I clicked yes. TM's backup of my entire hard drive went quickly and without a hitch. I knew TM's backup was not a bootable type, but figured that I still had a bootable Tiger system on the same drive if I needed to use that in an emergency and decided to test that out again.
Was wrong! Previously bootable drive no longer showed up in Startup Disk to select from in System Preferences. Thus no longer bootable! I now have 2 full backups of my entire hard drive (one with Tiger, the other with Leopard) on the one external drive, neither are bootable. Guess I can boot up from the installer DVD in emergency, but that wasn't the reason why I made a bootable backup drive to begin with.
Don't know if and what TM did that rendered the formerly bootable drive unbootable. Did nothing to change the previously working bootable drive. Anyone else have similar experience after running TM? Idea of cause? Suggestions, or work-a-round? Is this a known issue, or should this be sent to Apple's Feedback?
Thank you kindly,
superush

The TimeMachine backups were made to the same bootable clone partition that the Tiger bootable clone is on mentioned in my original post. The bootable clone was backed up there via SilverKeeper, which is included in the software that came with the 350 GB ,LaCie Porche external firewire drive.
Am now thinking that perhaps that version of SilverKeeper, which was recognized by my OS Tiger, may not be recognized by Leopard OS, and when used TM to make backup to same partition cloned bootable drive, that may have made my bootable SilverKeeper backup clone null and void.
Could that be the possibility?
Best regards,
superush

Eject usb disk after Timemachine backup done! But SpotLight prevent!

Hi, all
OS: 10.8.2
How can I disable Spotlight indexing the Timemachine volume ?
After I backup with TimeMachine, I can't eject the usb disk because the SpotLight(mds daemon) is indexing on the usb disk, How Can I disable this. I don't want to plug in my usb disk all the way I am using the macbook pro. And I don't want to completely disable spotlight.
I have try mdutil -i off -d /Volumes/TimeMachineV1
but it failed, says can't disabled on the tm volume, ***?!

I would just let the indexing complete - it will stop indexing with the drive disconnected and begin indexing again when the drive is connected. It may take a couple of hours or more to fully index the drive the first time but it should be easy going after the drive is first indexed.
I'd just wait it out - it shouldn't take too long.
Clinton

Edited table data not found after physical backup

hi,
i have recoverd to another location physical backups of oracle files. i have all data but data in one table patient can not be viewed. however, if i execute count(*) query it retruns total number of rows. can any one help me.
i am using 11g database and i am executing this query from sql*plus
" select * from patients;". messegae received "no data found".
thanks
susan

user3293897 wrote:
hi,
i have recoverd to another location physical backups of oracle files. How you've performed the recovery?
i have all data but data in one table patient can not be viewed. however, if i execute count(*) query it retruns total number of rows. can any one help me.
i am using 11g database and i am executing this query from sql*plus
" select * from patients;". messegae received "no data found".
You mean that the table has data in the first database, and you lose the data while copying and recovering the db?

Time Capsule can't be found after initial backup

I am having real problems with a brand new 2TB Time Capsule.
It will allow me to connect wirelessly and make the initial time machine backup but once that has completed (which it does successfully) it refuses to then find the disk again.
I've upgraded it to the latest firmware (7.7.2) which got over a "Internal Hard Drive Needs Repair" error message I was getting and has allowed me to make a fresh backup but once that's done it wont complete anymore and will eventially just fail.
I've tried reseting and reforming the time machines hdd but always end up back at the screen above.
Can anyone help at all?
Here are the specs of the MBP I'm using:

Hey
Thanks for your reply.
I've tried what you said. There was no drive mounted so in finder i disconnected from the TC. I then tried your manually mount method which didn't work. Just refused to find the TC despite it being on and me rebooting it. Used both name and IP address just kept saying it's not there or isn't connected.
Tried removing the TC disk from the preferences and then re-adding it but now it just hangs at this:

After upgrading to Mavericks, I am having trouble with TimeMachine backups.

After upgrading to Mavericks, I am having trouble with TimeMachine backups. As the backups get close to completion, it suddenly increasing the amount of data being backed up. My 400GB data takes up about 700GB on the backup drive.
Tried reformatting the backup disk and had the same result.

After upgrading to Mavericks, I am having trouble with TimeMachine backups. As the backups get close to completion, it suddenly increasing the amount of data being backed up. My 400GB data takes up about 700GB on the backup drive.
Tried reformatting the backup disk and had the same result.

Is it possible to completely restore from Snow Leopard TimeMachine Backup after a clean Lion install?

Hello,
I cannot install Lion because my disk cannot be used, so I am planning to do a full, clean install of the system. My question is if it is possible to restore entirely from the TimeMachine backup after that or if it is better to spend time for figuring out how to remove the "this disk cannot be used" message in the lion installer?
Thanks,
Thomas

Just a gut feeling, if you are getting "disk cannot be used" errors you need to figure out why first before you try to install something else. Have u run Disk Utility from within the Lion installer? Try that and see if what kindof errors you get there...
But yes, assuming the disk is still in good shape, and you have the SL installer DVD, you should be able to do a reinstall and use the TM backup to get things back into the shape they were in before you tried to install Lion.
Message was edited by: coocooforcocoapuffs

Timemachine - Backups have gone

Hi All,
This is my first post, so be gentle!
I backup to a Western Digital MyBookWorld 2TB NAS drive. Since upgrading to ML I've twice experienced a total loss if my timemachine backups.
On each occassion I've noticed because TM starts doing a full backup - which I stopped. Going to TM preferences showed no previous backups the first time it happened. Today I went into TM (trying to find a backup of my iPhone in an attempt to get my iOS5 back after discovering the joys of the new Maps app - but that's another story) there were no backups before today, though TM preferences showed a backup from last night.
Anyways, I don't really understand what has happened so I looked at the TM logs - which I also don't understand, but it looks like something went wrong. Do any of you folk know what has happened and do you have any advice? My goal is to have dependable backups. Would I be better off buying a TimeCapsule?
Thanks,
Marc
Log follows!
Starting automatic backup
Attempting to mount network destination URL: afp://[email protected]/WD_Backup
Mounted network destination at mount point: /Volumes/WD_Backup using URL: afp://[email protected]/WD_Backup
Runtime corruption detected on /Volumes/WD_Backup/Jazzbook.sparsebundle (fsck_hfs -q termination status: 3)
Network destination already mounted at: /Volumes/WD_Backup
Recovery backup requested by user.
Deleted backup image: /Volumes/WD_Backup/Jazzbook.purgeable. 1.21 TB available on host volume.
Creating disk image /Volumes/WD_Backup/Jazzbook.sparsebundle
Failed to hide extension on /Volumes/WD_Backup/Jazzbook.sparsebundle, error: Error Domain=NSCocoaErrorDomain Code=4 "The file “Jazzbook.sparsebundle” doesn’t exist." UserInfo=0x7fa553101bd0 {NSURL=file://localhost/Volumes/WD_Backup/Jazzbook.sparsebundle/, NSFilePath=/Volumes/WD_Backup/Jazzbook.sparsebundle, NSUnderlyingError=0x7fa553101530 "The operation couldn’t be completed. No such file or directory"}.
Disk image /Volumes/WD_Backup/Jazzbook.sparsebundle mounted at: /Volumes/Time Machine Backups
Backing up to: /Volumes/Time Machine Backups/Backups.backupdb
Network destination already mounted at: /Volumes/WD_Backup
Ownership is disabled on the backup destination volume. Enabling.
Forcing deep traversal on source: "Macintosh HD" (mount: '/' fsUUID: 95006285-5C79-3F83-A602-7E1F34A880A8 eventDBUUID: B9F80CBA-6506-4FFA-A542-44247E5038FF)
Disk image already attached: /Volumes/WD_Backup/Jazzbook.sparsebundle, DIHLDiskImageAttach returned: 35
Disk image /Volumes/WD_Backup/Jazzbook.sparsebundle mounted at: /Volumes/Time Machine Backups
Backup content size: 414.6 GB excluded items size: 8.65 GB for volume Macintosh HD
Found 936300 files (405.95 GB) needing backup
487.14 GB required (including padding), 1.21 TB available
Waiting for index to be ready (100)
Copied 4.64 GB of 405.95 GB, 1 of 936300 items
Copied 7.88 GB of 405.95 GB, 90085 of 936300 items
Copied 10.65 GB of 405.95 GB, 244278 of 936300 items
Copied 13.99 GB of 405.95 GB, 327686 of 936300 items
Copied 17.93 GB of 405.95 GB, 438898 of 936300 items
Copied 21.94 GB of 405.95 GB, 469320 of 936300 items
Copied 25.93 GB of 405.95 GB, 482815 of 936300 items
Copied 29.55 GB of 405.95 GB, 507353 of 936300 items

Hi there,
I had the same problem yesterday on my old MacBook Pro 15". I have a 2TB Western Digital harddisc connected to my Airport Extreme, so it is actually nearly the same as the Time Capsule, with the only difference that my hdd's are external and not built in. This 2 TB disc is divided into two partitions, one is the time machine partition from my newer macbook pro 13" and the other one for the older 15".
This configuration was working perfectly via WiFi for nearly two years now, at the beginning with Snow Leopard, then with Lion and now with Mountain Lion.
So to cut a long story short, yesterday the old MacBook reported, that the last update is already more than 11 days ago and that it has todo a full backup with over 120GB. As this surprised me completely I checked the backup disc and noticed that it was nearly empty. It seems that the complete image file (in case of WiFi backup the backups are placed in an image file) for the time machine backup was deleted and a new one was started.
I even checked the console logs and it was stated there, that there was a partially deleted file found, which was afterwards deleted and then a one was created. I haven't got the logs here now, but it was nearly the same as in the log from maz100 with the only difference that it did no report me "runtime corruption" on the image file, it reported me a "partially deleted file" found.
I checked also the other partition on that disc and the backups from my 13" book are still there. So I got no clue why the complete image file of my 15" book has been deleted and a new one has been created, it's running now since yesterday to make the new full backup.
For me it seems as the image file of the TM backup got currupted somehow and was replaced by a new one. It is a bit strange for me, that this is done without stating any information to the user as you actually loose all your backups. Till now I felt quite secure with the backups, it was good to now that there are still backups, when you delete something accidentally, but if complete backups are disappearing I'm loosing my trust in these TM backups a bit, not speaking about the time it takes to perform a complete new backup via Wifi.
....and it seems, I'm not the only one around here. I'm afraid it has to do with my recent Mountain Lion Backup as it did not come up for years with SL or Lion.
Greetings
Bernhard

My avast! antivirus software is identifying two Trojan viruses on my MacBookPro (Max OSX 10.7.5) that seem to be related to my Outlook for Mac. An example of one of the file names is: /.MobileBackups/Computer/2014-06-22-151618/Volume/Us

My avast! antivirus software is identifying two Trojan viruses on my MacBookPro (Max OSX 10.7.5) that seem to be related to my Outlook for Mac.
An example of one of the file names is: /.MobileBackups/Computer/2014-06-22-151618/Volume/Users/stevekreitner/Documents /Microsoft User Data/Office 2011 Identities/Main Identity [Backed up 2014-06-22 12.48.35]/Data Records/Message Attachments/0T/0B/0M/9K/x26_9605.olk14MsgAttach
Any suggestions on how to locate and remove these virsues?

Actually, you can delete the entire Main Identity folder for Outlook that has a backup date in brackets [xxx] as part of its name since that was created when you used the Microsoft Database Utility to rebuild your email database. The folder that is only named Main Identity is the one in use. The other is now nothing.
That should be true but sometimes users are in the wrong Identity. Outlook 'forgets' what is supposed to be the main default Identity and opens in the wrong one. You need to check the database file in the Identity to see date modified to know for sure.
Typically, after rebuilding you delete the rebuild after a bit when you are satisfied with the rebuild. There should only be one Identity in the Identities folder. However, most users don't understand what to do with the copy that is made and never deletes anything.

TC not found after reboot (and other problems)

Hi there,
After I have gone through the Airport utility to setup my new TimeCapsule (TC) as router (connected with a DSL-modem), Airport utility rebooted TC, but then an error occurred, saying TC could not be found after reboot. This is the last in a series of strange behaviours and occurred directly after I reset TC to factory settings.
I also had tried adding TC to an existing network. This appeared to work (no error message, green LED). However, I could not select TC as TimeMachine's backup drive. TimeMachine did find TC, asked me for the password and verified the password, however immediately switched back to the status "not configured".
Any ideas? Thanks in advance
-mat

Dear fellow sufferers,
it is solved! I decided to wait with a return and meanwhile the solution in another thread. All problems went away after I turned all security off from my network (do do this, I had to temporarily connect my TC by wire). This may be related to the fact that I am using a slightly aged PowerBook (latest Titanium model). Using fixed channel instead of automatic further accelerated the connection.
Well, it is not really solved since I want to use some security in my network, but I suppose that will come with the next Leopard update (Cupertino, do you hear me!!!????).
...Cupertino, do you hear me!!???

URGENT-Does Erase all Data and restoring from a previously made backup permanently delete text messages after that backup??

Does restoring from a previously made backup permanently delete text messages after that backup?
I made a Icloud back up two days ago. I have text messaged and sent emails since. I haven't backed up again yet and I was wondering that if I erase my phone and back up to that Icloud Back up made two days ago, the texts and emails I have sent SINCE then will be permanently deleted? AKA they can never be found again by anyone?

That is correct you can only get back data that was backed up.

"Found Partially Deleted Backup - Trying Again to Delete"

Has anyone encountered a message like this in system.log? If so, any suggestions as to how to find and delete the problem "partially deleted backup?"
/System/Library/CoreServices/backupd[443]: Starting post-backup thinning
com.apple.backupd[443]: Found partially deleted backup - trying again to delete: 2007-12-01-211848
Time Machine has been stuck displaying the barber pole of doom for two hours, with the accompanying message "Finishing backup..." It appears that TM is choking on a backup that was for some reason only partially deleted earlier (probably when I forced a shut down after a couple of hours of similar nonsense with TM). FWIW, my TM disk is an internal 1 TB SATA drive with over half the space still free.
Cheers!

Hi Barry:
Thanks for the suggestion. I hadn't realized that I could navigate the Time Machine disk that way.
I deleted the offending folder, and then emptied the Trash. Interestingly, this caused the same "churning" sound from my hard drive that I was getting when Time Machine was stalled. The Trash was taking a long time to empty, and it occurred to me that the problem might be related to Compost, a utility that I installed to keep my Trash at a manageable size. So I stopped Compost, my Trash then emptied out quickly, and I assumed that all would be well.
Well, not quite. I restarted TM, it ran a quick little backup, and then according to system.log it began the post-backup thinning. TM promptly stalled with the barber pole of doom, and the hard drive churning sound resumed. I'm getting the following message repeating endlessly in system.log:
Dec 3 17:02:42 macpro kernel[0]: HFS resolvelink: can't find iNode3324704
Dec 3 17:03:06 macpro kernel[0]: disk3s2: 0xe0030005 (UNDEFINED).
Dec 3 17:03:06 macpro kernel[0]:
The message appears every 20 seconds or so, and after a few of the same messages the iNode number changes. I've Googled the error message, but didn't find anything that would shed light on what it means. I'm going to leave TM running for a few hours to see if it eventually works its way through these errors. If not, then I'll probably just erase the **** drive and start again with a fresh backup.
Cheers!

Please help: How to replace all data on mid-2010 MacBook Pro 15 with Timemachine backup from 2009 MBP 13

OK so I bought a mid-2010 MacBook pro 15 from a friend and he did not erase anything before he gave it to me. I was previously working on a 2009 MacBook pro 13 and have a Timemachine backup from that which I would like to install on the MBP 15 replacing all of the current data.
I have tried rebooting using the OSX disc that came with the MBP 15 but that won't work - I am assuming that is because the OSX disc is version 10.6.3 while the current OS on the MBP 15 is 10.7.4
What is the best/easiest way to use the Timemachine backup of my MBP 13" to replace all info on the MBP 15"?
This seems like something that should be easy but I have been trying to do it since last night and haven't found relevant info in the discussion forums. Any help would be greatly appreciated!!
Thanks!

MacBook Pro 15" 2010
Intel Core i7 2.8GHz M 640 Arrandale Cores 2 (2867)
8GB max RAM 2 - 204-pin PC3-8500 (1066 MHz) DDR3 SO-DIMM
NVIDIA GeForce GT 330M 512MB (15.85) (369) and Intel HD Graphics 3000 (10) (309)
MacBook Pro 13" Mid 2012
Intel Core i7 3520M Ivy Bridge Cores 2 (4519)*
16GB RAM max actual (8GB Apple) 2 - 204-pin PC3-12800 (1600 MHz) DDR3 SO-DIMM
Intel HD Graphics 4000 (unknown) (465)*
The 13" is a more powerful machine and it has more RAM capacity.

I am running a MacBook Pro with 10.7.5 and I downloaded the OS X 10.10.2 Update Combo, however when I try and open the package the error message "This volume is used for TimeMachine-backups". Which is not true. I´m using TimeCapsule.

I am running a MacBook Pro with 10.7.5 and I downloaded the OS X 10.10.2 Update Combo.
When I try and open the package after accepting the lincence-agreement and upon choosing the install-volume the error message appears: "This volume is used for TimeMachine-backups".
Which is not true. I´m using a timecapsule for backups.
How can I proceed?

I am using a MacBook Pro (2010) with 2.53 GHz Intel Core i5, 4GB, 1067 MHz, DDR3, Startvolume Macintosh HD.
After downloading the package and starting upgrading it asks acceptance of the license-agreement. After that it asks for the volume were to install. And when I click on the Startvolume Macintosh HD (which is the only available on the machine) it says: "The volume is already being used for Time Machine-Backups".
It doesn´t offer to skip that point or to reconfigure the Time Machine settings.
The point is that my Time machine is not and has never used the Mac HD for Backups. In the past I have used an external drive and since 05/2014 I am using a Time Capsule which is appropriately addressed in the Time Machine settings.

Urgent 2nd request CS6 photoshop not found after downloading and putting in valid serial #

CS6 photoshop not found after downloading and putting in valid serial number. Only extended version shows up as available. How do I just download CS6 photoshop only?? only the CS6 PS extended version shows up as downloaded.
I have no idea how this forum works or weather or not this has been posted let alone answered. Can someone from Adobe please help me asap
Thanks!

check your duplicate post. there are two responses.

Two Trojans found after TimeMachine backup?

Similar Messages

Maybe you are looking for