Malware (?) report by OS X 10.10

Joined
Nov 7, 2013
Messages
73
Reaction score
1
Points
8
Over many months, I have lost vast quantities of data (files, folders and contents, contents of folders but folders remain etc.) and have not known where the problem was coming from.

I recently reinstalled "4Media DVD Creator" after losing it and countless other programs and data over many episodes. After completing using the program to combine/burn several mp4 clips to DVD, I selected the program's 'Quit' menu item and the program DID NOT quit but immediately stalled and started deleting files. Upon 'Finder/Force Quit', OS X noted that the program had been forced quit and generated a report of the file that caused the problems and deletions. I forwarded the report to Apple.

A small part of the malware's text includes
"Date/Time: 2014-10-28 09:07:31 +1100
OS Version: 10.10 (Build 14A389)
Architecture: x86_64
Report Version: 21

Command: 4Media DVD Creator
Path: /Applications/4Media DVD Creator.app/Contents/MacOS/dvdcreator
Version: ??? (???)
Parent: launchd [1]
PID: 1307

Event: hang
Duration: 2.90s (process was unresponsive for 27 seconds before sampling)
Steps: 30 (100ms sampling interval) ....
30 DVDGenerateProgressDialog::qt_metacall(QMetaObject::Call, int, void**) + 79 (dvdcreator + 1931241) [0x1d87e9]
30 DVDGenerateProgressDialog::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 200 (dvdcreator + 1930488) [0x1d84f8]
30 DVDGenerateProgressDialog::eek:n_btnFinish_clicked() + 61 (dvdcreator + 1140693) [0x1177d5]
30 DVDGenerateProgressDialog::closeEvent(QCloseEvent*) + 296 (dvdcreator + 1141532) [0x117b1c]
30 DVDGenerateProgressDialog::cleantempfolder() + 49 (dvdcreator + 1930963) [0x1d86d3]
30 ??? (<728E2209-3988-39D5-861D-31EB4002162A> + 1253073) [0x4557ed1]
30 MainWindow::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 1848 (dvdcreator + 1876200) [0x1cb0e8]
30 MainWindow::makeTempFolderClean() + 442 (dvdcreator + 69866) [0x120ea]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]" and much much more.

I have removed the program from "Applications" and Library/AppSupport etc.

Is there a way to discover if this malware file is still on my iMac somewhere, please?

In desperation, PaulRanger1.

P.S. I can email the entire report content which I copy/pasted into a new draft "Mail" draft.
 
Last edited:

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,249
Reaction score
1,829
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
What version of OS X are you running? And what makes you think that the 4Media DVD Creator application is malware? You realize that this software is not compatible with Mavericks or Yosemite?

Check out the developer's website for more information: LINK
 
Joined
Nov 7, 2013
Messages
73
Reaction score
1
Points
8
What version of OS X are you running? And what makes you think that the 4Media DVD Creator application is malware? You realize that this software is not compatible with Mavericks or Yosemite?

Check out the developer's website for more information: LINK

Thank chscag for your swift and generous reply. I am now running 10.10 Yosemite and now that you mention it, the data erasures only started when I updated to Mavericks 10.9.2. I may not have used this program when my OS X was 10.9.1 as no problems of mass deletions occurred at that time. I would have installed 10.9.2 update around mid to late March 2014. Is that timeline correct, please?

What makes me think that 4Media DVD Creator is responsible is that when the program was open, after using it, when I selected Quit from the program's own menu, the program froze (i.e. it would not quit nor respond in anyway whatsoever. AND icons (files) immediately started disappearing from the desktop screen as I was watching them vanish.

Only by clicking on Finder and Force Quitting did the carnage cease (immediately).

In addition, after I Forced Quit the program, OS X generated a report of the cause and I sent it to Apple. I have the entire text of the OS X report and it nominates
"/Applications/4Media DVD Creator.app/Contents/MacOS/dvdcreator" as the culprit"

and further on

"30 MainWindow::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 1848 (dvdcreator + 1876200) [0x1cb0e8]
30 MainWindow::makeTempFolderClean() + 442 (dvdcreator + 69866) [0x120ea]
30 ClearDirContents(QString, bool, bool, QString, QString) + 519 (dvdcreator + 1272167) [0x137967]". The pseudo text instructions (?) "ClearDirContents..." seem very convincing.

The deletion episode also generates a "Temp" folder on the desktop with one or two (apparent ly) Photoshop "Var" files which I cannot open. Am I on the right track, please.

Gratefully, PaulRanger1.

P.S. 4Media DVD Creator for Mac is Version 7. Xilisoft now markets this program.

P.P.S. No other programs whose licences I purchased and installed before Mavericks and/or Yosemite have failed to work following relevant program updates. Only 4Media DVD Creator.

P.P.P.S. I'm about to click the LINK you kindly provided as I finish editing my reply. Thank you.
 
Last edited:
Joined
Nov 7, 2013
Messages
73
Reaction score
1
Points
8
Hello again chscag,

Thank you for your responding email of 4 November. The "temp" folder which execution of DVDCreator's deletion actions creates contains four (4) Photoshop VAR. files all of which have a ".avs" extension.

Double clicking any of those files brings up a window "Could not complete your request because Photoshop does not recognise this type of file."

Does this help clarify the situation at all, please?

Gratefully, PaulRanger1.
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top