[Lewbo]

some history over the last two months
was getting funny security stuff when repaired permissions - checked on macworld forum and was told to - restart with install dvd and repair permissions from there which caused crashes - wasnt sure if related to new ram or airport card - did archive and install - continued crashes - took out new ram and airport card - continued crashes - took it to apple who advised erase and install - less crashes - but continues - got an email from a user who had found similar permissions repair stuff on google that linked to my posts on macworld and advised me that I had something called the moab 15 permissions repair exploit - i get a system crash when attempting to start up since the upgrade to 10.4.9 - cannot isolate it to anything as seems somewhat random - today after attempting to start up in safe mode I was able to get past the apple logo but crashed at the blue screen - power off and back on got a successful boot in safe mode - I then
Open Console to this
~

[Lewbo]

Not sure why but my original post of about 10 days ago was truncated by someone - the crash logs and questions I posted are now gone with the steps I have taken so far to try to diagnose the problem - 80 views and no replies - I am still concerned about the moab exploit - in addition have noticed recently - when I quit an app or hide it - the next app I click on in the doc immediately brings up the last app in the menu bar - the last app does not launch and the clicked app from the doc may or may not launch - in addition - mostly with iTunes - it will sometimes while still playing music not respond to any hide or show commands - quiting and restarting fixes it - having removed the new ram and replaced the original ram - it seems like this is a ram issue altho again - the hardware test - disc util - techtool pro report no problems and they all report 768 of ram including system profiler - I cannot restart without at least one but up to 5 or 6 crashes even in safe mode - having taken it to apple and erased and installed I cannot figure out whats going on or what else to try - please if a moderator cuts info from a post can we be notified and can someone smarter than I please advise on the next steps in diagnosis of this perplexing repetitive crash and poor performance of my iMac g4 - I am a happy mac user since the mac plus in 87 and am still - I know this is something that will be worked out - I am just lost where to go from here and if the moab exploit could still be messing with me - I have a cloned system without the security updates on an external drive but cannot start up from it - have been taking things from it to the internal drive in trying to get stuff back to functionality - please help - thanks in advance.

[Tom_Diola]

We need more information: Type of machine - how old is the machine, originally how much ram did you have and where did you get the ram and what's attached. Remember this is a forum not Apple Tech Support.

[Lewbo]

I bought the iMac g4 1ghz with 768 of ram in july of 03 - I thought I was having problems with permissions repairs - security stuff - logs and keychain stuff - at the same time I was getting tired of how slow the machine was and thought upgrading it would help - I got two 1gig modules from ramjet while looking here about the permissions issues - someone here suggested repairing permission from the install disks - doing so crashed the machine - after many removals and reinstalls of the various modules - I returned the ram for a refund and put both the original modules back in - having gone thru the archive and install which didnt help and upgrading to 10.4.9 in the process and seeing a bunch of posts re blue screen crashes etc after the update - I took it to apple who said I needed to erase and install - I still get crashes when restarting with nothing but the keyboard and mouse plugged in - the computer is so slow - I can drag the mouse across the screen and watch each button turn bright and then dim before it gets to the menu I selected several (15) seconds later - as noted in previous post now when I guit mail or any app - click the desktop - and then click on another app in the doc the previous app shows in the menu bar until the clicked app launches - the slowness and frequent pinwheel seem like ram issues but everything says 768 and tests ok - since the erase and install someone I dont know googled the permissions stuff like what I was having and came up with the moab permissions exploit and said that google linked to my posts here - didnt make sense to me but - if I had the exploit erasing and reinstalling should have fixed it - so - having an external drive with my old cloned system on it - could the exploit being on that drive somehow have infected the newly installed one - is there a better way to test the ram or figure out if that is why I am getting crashes on restart - even in safe mode with nothing plugged in - I have done so much that I cant remember everything and need someone elses perspective - once started - sometimes takes up to 5 or 6 attempts at power off and on to get it started it seems to work ok without KP'S - just very slow - thanks in advance for any help or ideas you might have - sincerely - K OH - I did get the external started once and used techtool pro to check the internal - could that have spread the exploit back to a patched system?
PS I posted the crash logs here but someone cut my initial post 10 days ago or so and didnt reply (80 views-no replys till you) so they arent there - I havnt restarted in a while so am pretty sure the logs have rolled - any advice will be much appreciated.

[Tom_Diola]

I have a mini with only 512 MB RAM it's a 1.42 GHz PowerPC G4. I am running the latest os 10.4.9 without any problems. I see a lot of words on the screen from your post but I'm not getting a clear message about what exactly you have done. Most people put programs on their macs that foul up the basic operating system - Have you any extraneous programs that are not from the simple install? Your machine seems to you like it's new but an 03' machine is getting kind of old. So you've returned the RAM and put back the original RAM (every time you handle RAM you take the chance of zapping it - were you grounded when you handled the ram?). And you talk about an external drive and a clone - this makes me nervous. I wouldn't mind you talking about an external drive if it was cloned a long time ago (when things actually worked) with something like SuperDuper. I just did an archive and install because I thought the DVD burner was bad. Turns out it was just the media - but the archive and install only took about 2 hours to complete. We need to get your machine up and running but I'm concerned that the RAM might still be a problem: I know RAM is expensive but not having your machine up and running is bad right? What to do What to do What would I do? I'd get me a good ground strap 1st off and maybe try swapping the ram (did you say iMac? - Isn't it very very hard to open iMacs and service them? )hmmm... If you can do the lowest format on the drive and reinstall. Something you never mentioned and is near and dear to my heart is the file checking routine called fsck. After you've done the disk utility check you need to let us know if you've done the fsck routine - this checks the volume integrity of the file system. There are many ways to accomplish an fsck e.g. understanding the mac tutorial . Knowledge is everything and Apple has some nice tutorials. You can view this on another machine if need be. Well that's my 2 cents for now. Disclaimer: Your machine may be suffering some hardware problems i.e. hard disk might be failing on you, RAM might have been damaged or your motherboard may be damaged. In your case you need to get back to the basic system - no external drives, read the tutorials and understand the system. May the force be with you... And nevermind pasting in those logs they're hard to read and take up a lot of space. . .

[Lewbo]

Thanks for your input Tom - I have done everything you suggest - the erase and install didnt help - I do think altho I was grounded that one of the original ram modules was zapped somehow - even tho everything says I have 768 of ram and hardware test and tech tool say its ok - the machine is running like it has less than half that - on a positive note - I have had significant improvement since the most recent airport update - much less spinning beachball stuff - I also in trying to trouble shoot the restart crash - think it is related to a usb hub or my printer - I updated the printer software when installing the airport extreme trying to get wireless printing to work - after everything - HP says my printer is too old - altho again - it may have been the updated software for wireless that is causing the restart crash as it appears that without the printer plugged at restart there is no crash - altho I have to do some more testing on that - I do get a crash that appears to be repeatable other than the restart one - I have itunes, safari & mail running most of the time - when I go to bed I take mail offline - when I get up in the morning with itunes in coverflow as my screensaver - I quite using the screensaver as waking it from power saver frequently caused a crash - now - when I click the little x in cover flow to get to the desktop - occasionally - once every two weeks or so - it locks on a black screen and I have to power off to restart. That is the only KP - if thats what its called that I get now - I did do an fsck check before I took it to apple who recommended the erase and install way back - other than that the machine runs fine - albeit slow - altho - again - for some reason - when I have whatever program running for too long - days - it will suddenly become unresponsive - will not hide or show when asked - iTunes can be restarted with no problem but when you have open windows in safari or mail quiting to restart the program is sometimes problematic - I have to try to remember to restart the program frequently and so solve the problem that way
The only other thing re slowness that I havnt figured out yet or gotten any info about is the permissions repair exploit - moab 15 or something like that - google gave vary little info on it - apples site doesnt say much about it either - do you know anything about that - it appears I had it - I am not sure what it did or could do - if it reinfected me from the external clone even tho the internal boot drive has been updated security wise - after the erase and install - could that be causing the slowdown - it appears that the exploit affected the secure logs - the keychain and several other things including activity monitor - if thats the case could a trojan of some sort along with the exploit be doing stuff that activity monitor doesnt show and the logs do not show that could be causing the slowdown - if so - how do you diagnose it?
Thanks again for your help as the only one to respond to these questions.
Sincerely,
Kevin S. Lewis, PA-C

[Tom_Diola]

I can see why folks don't want to respond - you machine is almost 4 years old and seems like it has many many problems. I had an old iMac kind of like that and had to do all sorts of crazy things like install a firmware update through the usb port and finally got Panther running on it but it was very painful to work on those beasts from long ago. But a lot of the time is the RAM and certainly those are the symptoms. Aside from my last post I don't have anything to offer except - Time to upgrade?

[Lewbo]

Hmmm - I must take offense at your ability to right it off as the age of the macine - I have two other macs that run fine when I choose to use them altho they are both system 9 - they are both older than age so to speak - I would also point out since this started with the permissions repair issues I think in march - no one on the forum has even tried to answer any questions I have posed re the exploit - I had to be told about that by someone who googled the repair problems that in my case started with what is pasted below and then progressed to include the keychain, activity monitor and various other logs - this is what I get today - and AGAIN - this is how it started back in march
Permissions differ on ./private/var/log/secure.log, should be -rw------- , they are -rw-r-----
Owner and group corrected on ./private/var/log/secure.log
Permissions corrected on ./private/var/log/secure.log
I have updated religiously when security updates become available and after an update repairing permissions always is clear for a few days maybe - then - for no reason like today - I get this repair problem - to have had 6 different macs over the years and have given them all away while STILL working when I upgrade - that is a great advertisement - then - to have someone from a forum tell me my machine is too old and its time to updrade without addressing the REAL likely issue that I have someone who is repeatedly assaulting my machine is to say the least BYASSED - if there is an exploit that changes my permissions and who knows what else and there is no info about it at apple and the forums are no help either - 6 or 7 different people all ignore the same stuff - what is one to do? Certainly not by a new machine and expose it to the same thing - until they figure out what its doing and how to prevent it.
Tried to get more info via google - this came from a moab user group today - it appears this is an ongoing problem - that is changing as time goes on
"Not unless by "reinstall" you mean formatting the drive. Just
overwriting the OS X files wouldn't be sufficient to clean the system
off. As long as the home directory is in tact, the user account will
still be just as compromised as it was before, and commands can be
executed to try to escalate privilege again. "
SO - AGAIN - does ANYONE know what the moab permissions repair exploit is and what it is capable of doing - and or - how to detect it and prevent it from replicating? It appears that in erase and install - dragging over stuff from my old user folder may indeed have re compromised my system - If that is what is causing my problems wouldnt it be prudent to figure that out before I get a new machine and hook it up to this one to get my stuff over from it to the new one - if I cannot do that I am in some real trouble - figuring out what files to remove for this exploit is not really clear via the forums I have looked at. PLEASE - someone who is knowledable re the exploit - point me in the direction of information that can allow me to clean the user folder so that when I do upgrade it doesnt affect the new machine.
PS any permanent fix involves downloading and installing unsanitys application enhancer and the moab pgp file - I am wary of installing anything at the recomendation of someone who formed the group and produced the fix - please advise.