Help needed. Do I have a virus or malware?

[acroll]

I sat down at my computer last night and the console window was open and stuff was scrolling by. I hadn't opened the console. Something is trying to access Timbuktu Pro (which I had dl'ed from a pirate site but no long have) in a folder that once existed but is no longer there. I'm thinking that the copy of Timbuktu Pro that I dl'ed had some malware in it that could open a back door into my computer. The attacking app keeps recursively trying the same thing but with a different port number (I think) each time. My questions are: is there something on my computer trying to get out or something outside trying to get in? And how do I stop it. I've turned on the Firewall in the Security settings and started up Little Snitch but it hasn't stopped the messages on the Console. Here are examples of what's on the Console:

10-02-20 3:07:35 AM com.apple.launchd.peruser.503[176] (com.netopia.timbuktu.pro.host[377]) posix_spawn("/Users/username/Desktop/Movie Downloads/Timbuktu Pro/Timbuktu Pro.app/Contents/SharedSupport/Timbuktu Host.app/Contents/MacOS/Timbuktu Host", ...): No such file or directory

10-02-20 3:09:15 AM com.apple.launchd.peruser.503[176] (com.netopia.timbuktu.pro.host) Throttling respawn: Will start in 10 seconds

10-02-20 3:09:35 AM com.apple.launchd.peruser.503[176] (com.netopia.timbuktu.pro.host[402]) Exited with exit code: 1

Thanks.

 

[Slydude]

When I read your post it sounded to me like there were some parts of the program still scattered on the drive. Some programs , by the very nature of what they do, scatter files all over the drive.

I found a post on the Apple Discussion board that leads me to think there may still be Netopia/Timbucktu files in /Library/LaunchAgents and ~/Library/Preferences. The first file is probably what is causing the program to attempt to reopen.

 

[Doug b]

So. You downloaded a pirated copy of software you were too cheap to pay for.
The rest is, as they say: History.

Awesome, thanks for playing.

Doug

 

[harryb2448]

And pirate downloads are reported as frequently including malware and/or trojans. After you do what Sly has suggested, also have a look at log in items and then do a Spotlight for any remaining files.

 

[Slydude]

Thanks harry I completely forgot about checking the accounts login items for anything there.

 

[acroll]

Problem solved. Thanks very much for your help.

I checked the folders mentioned by Slydude and, sure enough, there was a netopia/timuktu file in the LaunchAgents folder. I removed it, restarted and, voila, problem gone. Thanks for your help. I feel better now, knowing that someone hadn't made it into my computer.

I know I shouldn't have dl'ed pirated software. I was just comparing Timbuktu with LogMeIn. Timbuktu was very complicated while LogMeIn was really simple and the free version does everything I want. I only had Timbuktu for a couple of days before I trashed it. BTW, I DO pay shareware fees for programs I use. I wouldn't cheat the small developers who work hard to give us good apps at reasonable prices.

 

[Slydude]

Glad you got that problem resolved. I wouldn't have thought about suggesting the LaunchAgents folder but I stumbled upon that suggestion at the Discussion section of the Apple site.

BTW If you want to avoid the pirate sites when testing a program check the manufacturers' websites. Now that broadband is becoming more common many are offering demos. Some demos are full-featured for a limited time and others may have some limitations. You might still have had the same problem with Timbuktu but at least you would be less worried about a viruses.