Safari plugin keeps crashing -- is it hidden malware?

Discussion in 'Mac OS X Lion (10.7)' started by vocaro, Apr 12, 2012.

  1. vocaro macrumors regular

    Mar 5, 2004
    I've been experiencing frequent Safari crashes. The logs reference a plugin:

    PlugIn Path: /Applications/
    PlugIn Identifier: .KeepitCompact.png
    PlugIn Version: ??? (???)

    I have no idea what this plugin is. A Google search turned up nothing.

    But note the location: It's embedded into itself, not the Library folder. And why does it have a PNG extension? It's not an image file but is in fact a Mach-O universal binary. Even weirder: In the same directory there's another file called .KeepitCompact.xsl. This isn't a style sheet but also a Mach-O executable.

    The fact that these executables are disguised as data files, slightly hidden (using the "." prefix), and placed in the Resources folder -- where executables are not supposed to be -- makes me very suspicious. Is this some kind of malware? Has my machine been infected?
  2. Jasoco macrumors 6502

    May 28, 2006
    All I can turn up through Google is some music cataloging software that has nothing to do with Apple.

    These files are NOT normally there. Delete them. They are probably not required and who knows where they came from. At worst case you can always reinstall Safari if it breaks, which it probably won't.

    Very suspicious where it would come from though.
  3. vocaro thread starter macrumors regular

    Mar 5, 2004
    I deleted the files. Now Safari won't run because it crashes on launch:

    Dyld Error Message:
    could not load inserted library: /Applications/

    Guess I'll have to restore the original somehow. Sure wish I knew what those files are about.

Share This Page