Page 1 of 1
has my mac been attacked?
Posted: Fri Mar 05, 2010 7:45 am
by martian
someone was using my laptop in the studio..
I had created a non sensitive data account - unable to admin etc etc..
the next day - my finder is screwy from the get go..
I tried to repair permissions -
get this -
Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.
also the dock has disappeared -
and apple tab between apps is over..
what do I need to repair?
thanks!
Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 8:33 am
by Phil O
martian wrote:Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.
http://support.apple.com/kb/TS1448?viewlocale=en_US" onclick="window.open(this.href);return false;
Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 9:02 am
by FMiguelez
.
If the account was not an "administration" account, they shouldn't have been able to even modify the preferences in that special account you created.
Are you 100% it was a regular account?
Could they somehow have logged in as the "root user"?
I know this won't help you now, but next time enable the special "guest" account. This is supposed to be easy and avoid many headaches. Everything gets deleted in that account as soon as they log out.
Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 9:04 am
by MIDI Life Crisis
As for the dock, either under the apple logo (top left of your screen) or system prefs and have it appear again. They probably hid the dock to work "more efficiently" but rule #1 of using someone else's computer is: don't change anything w/o asking permission. Rule # 2: never let anyone use your computer unattended. Rule #3 (should be rule #1): Never let anyone use your computer, especially if you use of for work or financial records!!!
Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 9:05 am
by MIDI Life Crisis
You might want to change the admin password as well...
Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 9:23 am
by Dan Walsh
Phil O wrote:martian wrote:Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.
http://support.apple.com/kb/TS1448?viewlocale=en_US" onclick="window.open(this.href);return false;
This one shows up on my system every time I repair permissions. It has never caused me any trubs......

Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 9:42 am
by martian
phew thats re-assuring gents ...
actually it happened after i got a DVD from protools - cos thats why I opened the lappy up..
and the finder was like treacle -
MLC - i tried the dock pop out to right in the apple menu -
but everytime was no go.. only go slow - and cant apple tab -
something is a miss!
actually I gotta take the new macbookpro back - cos the glass screen is falling off!
naybe it's time to back it up and start again? ( i thought that was a purely windows experience?)
Re: has my mac been attacked?
Posted: Fri Mar 05, 2010 9:49 am
by MIDI Life Crisis
Trash your dock.plist from your home directory and restart. If that doesn't do it, trash the finder.plist and repeat.