Malware (?) report by OS X 10.10

Over many months, I have lost vast quantities of data (files, folders and contents, contents of folders but folders remain etc.) and have not known where the problem was coming from.

I recently reinstalled "4Media DVD Creator" after losing it and countless other programs and data over many episodes. After completing using the program to combine/burn several mp4 clips to DVD, I selected the program's 'Quit' menu item and the program DID NOT quit but immediately stalled and started deleting files. Upon 'Finder/Force Quit', OS X noted that the program had been forced quit and generated a report of the file that caused the problems and deletions. I forwarded the report to Apple.

A small part of the malware's text includes
"Date/Time: 2014-10-28 09:07:31 +1100
OS Version: 10.10 (Build 14A389)
Architecture: x86_64
Report Version: 21

Command: 4Media DVD Creator
Path: /Applications/4Media DVD Creator.app/Contents/MacOS/dvdcreator
Version: ??? (???)
Parent: launchd [1]
PID: 1307

Event: hang
Duration: 2.90s (process was unresponsive for 27 seconds before sampling)
Steps: 30 (100ms sampling interval) ....
30 DVDGenerateProgressDialog::qt_metacall(QMetaObject::Call, int, void**) + 79 (dvdcreator + 1931241) [0x1d87e9]
30 DVDGenerateProgressDialog::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 200 (dvdcreator + 1930488) [0x1d84f8]
30 DVDGenerateProgressDialog:n_btnFinish_clicked() + 61 (dvdcreator + 1140693) [0x1177d5]
30 DVDGenerateProgressDialog::closeEvent(QCloseEvent*) + 296 (dvdcreator + 1141532) [0x117b1c]
30 DVDGenerateProgressDialog::cleantempfolder() + 49 (dvdcreator + 1930963) [0x1d86d3]
30 ??? (<728E2209-3988-39D5-861D-31EB4002162A> + 1253073) [0x4557ed1]
30 MainWindow::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 1848 (dvdcreator + 1876200) [0x1cb0e8]
30 MainWindow::makeTempFolderClean() + 442 (dvdcreator + 69866) [0x120ea]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]" and much much more.

I have removed the program from "Applications" and Library/AppSupport etc.

Is there a way to discover if this malware file is still on my iMac somewhere, please?

In desperation, PaulRanger1.

P.S. I can email the entire report content which I copy/pasted into a new draft "Mail" draft.

What version of OS X are you running? And what makes you think that the 4Media DVD Creator application is malware? You realize that this software is not compatible with Mavericks or Yosemite?

Check out the developer's website for more information: LINK

chscag said:

What version of OS X are you running? And what makes you think that the 4Media DVD Creator application is malware? You realize that this software is not compatible with Mavericks or Yosemite?

Check out the developer's website for more information: LINK

Click to expand...

Thank chscag for your swift and generous reply. I am now running 10.10 Yosemite and now that you mention it, the data erasures only started when I updated to Mavericks 10.9.2. I may not have used this program when my OS X was 10.9.1 as no problems of mass deletions occurred at that time. I would have installed 10.9.2 update around mid to late March 2014. Is that timeline correct, please?

What makes me think that 4Media DVD Creator is responsible is that when the program was open, after using it, when I selected Quit from the program's own menu, the program froze (i.e. it would not quit nor respond in anyway whatsoever. AND icons (files) immediately started disappearing from the desktop screen as I was watching them vanish.

Only by clicking on Finder and Force Quitting did the carnage cease (immediately).

In addition, after I Forced Quit the program, OS X generated a report of the cause and I sent it to Apple. I have the entire text of the OS X report and it nominates
"/Applications/4Media DVD Creator.app/Contents/MacOS/dvdcreator" as the culprit"

and further on

"30 MainWindow::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 1848 (dvdcreator + 1876200) [0x1cb0e8]
30 MainWindow::makeTempFolderClean() + 442 (dvdcreator + 69866) [0x120ea]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]". The pseudo text instructions (?) "ClearDirContents..." seem very convincing.

The deletion episode also generates a "Temp" folder on the desktop with one or two (apparent ly) Photoshop "Var" files which I cannot open. Am I on the right track, please.

Gratefully, PaulRanger1.

P.S. 4Media DVD Creator for Mac is Version 7. Xilisoft now markets this program.

P.P.S. No other programs whose licences I purchased and installed before Mavericks and/or Yosemite have failed to work following relevant program updates. Only 4Media DVD Creator.

P.P.P.S. I'm about to click the LINK you kindly provided as I finish editing my reply. Thank you.

Hello again chscag,

Thank you for your responding email of 4 November. The "temp" folder which execution of DVDCreator's deletion actions creates contains four (4) Photoshop VAR. files all of which have a ".avs" extension.

Double clicking any of those files brings up a window "Could not complete your request because Photoshop does not recognise this type of file."

Does this help clarify the situation at all, please?

Gratefully, PaulRanger1.