# How do I tell if my Mac has a virus?



## Farmgirl22

I know, it's a weird couple of questions, so bear with me--hopefully it's nothing major...*grimace*

1) I am wondering about a virus because Firefox is acting all wonky on me--and it started when I was on the blogger website. The exact link is HERE. I don't know if it's a direct correlation or not. Sorry. 

2) Part of Firefox's wonkiness was that I would click on a hyperlink in Mail (for TSG) and instead of pulling up the page, it would think for a while and then load a blank tab--sometimes I would get lucky and it would load the page, most times it wouldn't. Whenever it started to act up, I couldn't get either FF or Mail to close--I'd just get that spinning circle thingy and a couple of hours later I'd just hard reboot it (no, I didn't sit and watch it for a couple of hours, in case you were concerned! ).

I thought at first it was just FF having add-on issues, until Mail started being goofy as well...

Thanks for the help guys--I'd have posted this in security, but it seems as though most times it's just Windows they troubleshoot over there.


----------



## TD912

It's most likely not a virus. I'm not saying Macs can't get them, but it is highly unlikely visiting a webpage in Firefox allowed a Mac-specific virus to install.

The beachball may mean that something else is causing the problem, anything from a bad hard-disk or RAM to a broken plug-in.

Try making a new user account, and see if anything happens in that account. Don't transfer any files to the new account, just see if the same problems happen there. If it's fine, it narrows the problem down to something in your user account. If it isn't fine, you probably have a bigger problem.

Open "Disk Utility" in /Applications/Utilities, and do a "Verify Disk" (NOT Permissions) to check if your disk is OK. If it comes back without any errors, it should be fine. Also check the "SMART Status" near the bottom of the Disk Utility window.

Open the "Console" also in /Applications/Utilities, and search the logs for anything suspicious. Usually the system.log and console.log are the most important. Note that the lines should be marked with a timestamp, so try to find something in the logs at a time you were experiencing the problem, and copy/paste the results back here.

Also, whatever you do, do NOT buy anything called "MacScan" or "Intego AV". These companies are trying to scare Mac users into purchasing worthless software by running large PR campaigns saying things basically like "Mac trojan found! Experts says Macs are not safe from viruses! Buy MacScan today and feel confident your Mac is safe!". As long as you aren't stupid and download random programs from 'bad' sites, you are fine.


----------



## Farmgirl22

Something that looked different from most of the "posts": From System.log.

Jun 26 09:54:27 Macintosh kernel[0]: pages 116772, wire 26505, act 9856, inact 25026, zf 10720, could discard act 21463 inact 23202

Jun 26 09:54:27 Macintosh kernel[0]: IOUSBWorkLoop::closeGate - interrupt Thread being held offEnabling XMM register save/restore and SSE/SSE2 opcodes

Jun 26 09:54:29 Macintosh kernel[0]: 11D beacon causing regdomain change to CC 840
Jun 26 09:54:29 Macintosh kernel[0]: en1: 802.11d country code set to 'US'.
Jun 26 09:54:29 Macintosh kernel[0]: en1: Supported channels 1 2 3 4 5 6 7 8 9 10 11 36 40 44 48 52 56 60 64 149 153 157 161 165
Jun 26 09:54:30 Macintosh /usr/sbin/rpc.net: messageType e0000300, arg 14063bb0\n

Jun 26 09:54:31 Macintosh launchd: Server 613b in bootstrap 1103 uid 0: "/usr/sbin/lookupd"[269]: exited abnormally: Hangup

Jun 26 09:54:31 Macintosh configd[37]: posting notification com.apple.system.config.network_change *This happened twice--once before this one.*

Jun 26 09:54:31 Macintosh launchd: Server 0 in bootstrap 1103 uid 0: "/usr/sbin/lookupd"[271]: exited abnormally: Hangup

Jun 26 11:17:42 Macintosh kernel[0]: 11D beacon causing regdomain change to CC 840

Jun 26 11:17:42 Macintosh kernel[0]: en1: 802.11d country code set to 'US'. *This happened several times too...*

Jun 26 13:14:52 Macintosh /usr/sbin/rpc.net: Set -I Callback for 6/26/2008 23:25.\n

Jun 26 13:14:52 Macintosh kernel[0]: IOUSBWorkLoop::closeGate - interrupt Thread being held offEnabling XMM register save/restore and SSE/SSE2 opcodes

Jun 26 13:26:59 localhost kernel[0]: HFS: Removed 1 orphaned unlinked files
Jun 26 13:26:59 localhost kernel[0]: Jettisoning kernel linker.
Jun 26 13:26:59 localhost kernel[0]: Resetting IOCatalogue.
Jun 26 13:26:59 localhost kernel[0]: display: family specific matching fails

Jun 26 13:26:59 localhost kernel[0]: Previous Shutdown Cause: 3
Jun 26 13:26:59 localhost kernel[0]: display: family specific matching fails

Those are all probably pretty common things, but since I've never looked at one of those logs, I have no idea what to look for.


----------



## Farmgirl22

I'm guessing that by "bad" you mean like porn sites??? I don't visit those, and I don't download much of anything most of the time--I do the add-ons from Mozilla once in a great while, the occasional assignment for class in PDF form, and that's pretty much it.


----------



## TD912

"Bad" basically means any site that is full of malware, which I guess would include some porn sites. It could also be those "free screensaver" websites, or "download cool smilies" websites.

I'm not that great with logs, but I *think* the problem has something to do with networking, because of the "com.apple.system.config.network_change" message, as well as "Jun 26 09:54:29 Macintosh kernel[0]: en1". "en" usually means a wireless network connection.

This is just a guess, but it looks like something is wrong with your wireless connection. I'm not exactly sure what. Sorry.

Are you sure you have the latest software updates from Apple? I think there was a recent update that fixed some wireless networking problems. You can check for updates by going "Apple" menu>"Software Update...".

Seems like a few other people are having similar problems.


----------



## Adrianking99

No need to wait 2 hours and reboot. If you get the spinning beachball of irritation again, you can just quit the application in which it appears and then relaunch it. Or you can 'Force Quit' the application. It's halfway down the Apple menu (or hit Command-option-Escape). This will bring up a window showing all open applications. If, next to Firefox (or Mail, or any errant app) there is a message saying, in brackets '(not responding)' then Force Quit, and relaunch the application. By the way, do you get the same probs in Safari? Or Camino (also free)? If you do, then the problem is likely to be with your wireless network as you have already learned, or with the server at the Firefox blog site.


----------



## Remag1234

Just clicked and it opens to Jeff's Home Renovation page. It works fine.


----------



## ferrija1

I wouldn't worry, Firefox has acted oddly for me many times, wrongly leading me to believe there's something seriousily wrong with my system. Try running Fx in Safe Mode for a day.


----------

