Sunday, March 4, 2012

Environment Corruption Causes Strange Finder Menus

Here is an interesting tale of a problem that I ran into last week. The client was running Snow Leopard 10.6.8, and some of the menus in the Finder had replaced the names of the actions (Cut, Copy, Paste, Clear, Print, etc.) with short letter strings that didn't mean anything: H13, H14, A20. There didn't seem to be any pattern or reason for it, and selecting the menu still performed the action.

Initially I had thought I could just reboot from my own Snow Leopard drive and replace their Finder with mine. Same version and all. Surprise: the Finder is not an application. You cannot "find" it to delete it.

When I created a new user account and logged out of the main one and into that, the problem was not there. That meant it was something in the user's Home folder.

First thing I did was toss the Finder preferences file in /Home/Library/Preferences (com.apple.finder.plist). No luck. I figured the system was corrupt so I reinstalled Snow Leopard and ran the updates. The problem remained.

After a few other tries, such as booting in Safe Mode, zapping PRAM and running Disk Warrior produced no results, I gave up and we called AppleCare.

The level-1 tech who took the call made a couple of suggestions but noted that I had already done most of what he would have had me do. He had never heard of this problem. Finally he too gave up and kicked me upstairs to a Level 2 tech. This guy had seen the problem so he had me drop the Go menu, select Go To Folder... and type in /Users/(user home folder)/.MacOSX. I did and it opened an invisible folder in the Home folder.

(New Mac users: The Home folder is the one with the little house icon in the sidebar of any Finder window. Its name is usually a lower-case version of the user's name, and holds Documents, Desktop, Library, Music, Movies, Pictures and a couple of other things. There are also a lot of normally-invisible files and folders in there.)

In that folder was a file called environment.plist. He said, "Take it to the Desktop and then Restart." I did and lo, the problem went away. What happened? "This file can get corrupted for some reason and cause the odd menu display. A new one was created on restart." This is unique to 10.6 and does not happen in Tiger, Leopard or Lion.

So there it is - even after more than 20 years fixing Macs, there can be a surprise around the corner. Now I will know what to do if I ever see this again, but that is probably unlikely, because I had never seen it before. This is what keeps the job interesting.

1 comment:

MacGirl.DC said...

Word of warning: that's most likely the Flashback.G trojan.

http://blog.intego.com/flashback-mac-trojan-horse-infections-increasing-with-new-variant/

There's most like a few more files you need to remove.