Help about Tojan or malware

Question

Hi,
I probably downloaded and executed a malware-virus-trojan in my Mac book Pro Yosemite 10.10 (not proud of it)
I could supply ba copy of it if usefull.
It generates a fake? Adobe Flash player pop up asking permission for storage on my computer.
Scanned with Sophos and Clamxav with issues detected but no threaths found.
Hi have a pre-download and pre-problem clean time machine external HD backup available.
I booted witn the ALT key down and restored from the time machine the backup
It seem that the system files are not replaced since the cache has same data as the pre restore one.
so I think I still have my problem.
Did the restore replaced also thew system files or only everything else.
In other words, how can I use my good system files on my time machine and bring them in my running computer OR what shoul I do?
Thanks in advance

Answer 1

hi
version 2 from my every day user logged in with  password
here is the result
Start time: 12:36:21 11/05/14
Model Identifier: MacBookPro10,2
System Version: OS X 10.10 (14A389)
Kernel Version: Darwin 14.0.0
Time since boot: 30 minutes
USB
   USB Optical Mouse (Logitech Inc.)
Diagnostic reports
   2014-11-04 Google Drive crash
   2014-11-05 Color crash
   2014-11-05 Finder crash*
   2014-11-05 Google Drive crash
   2014-11-05 SophosAVAgent crash
    * Code injection
Log
   Nov  3 23:46:26 process backupd[597] thread 15760 caught burning CPU! It used more than 50% CPU (Actual recent usage: 50%) over 180 seconds. thread lifetime cpu usage 248.063141 seconds, (91.663516 user, 156.399625 system) ledger info: balance: 90004265973 credit: 247983235885 debit: 157978969912 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 176757670068
   Nov  4 00:55:03 jnl: disk2s2: do_jnl_io: strategy err 0x6
   Nov  4 00:55:03 jnl: disk2s2: end_transaction: only wrote 0 of 184832 bytes to the journal!
   Nov  4 00:55:03 jnl: disk2s2: close: journal 0xffffff801adb1c20, is invalid.  aborting outstanding transactions
   Nov  4 00:58:11 process Creative Cloud[1107] caught causing excessive wakeups. Observed wakeups rate (per sec): 182; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45101
   Nov  4 01:57:59 PM notification timeout (pid 1107, Creative Cloud)
   Nov  4 01:57:59 PM notification timeout (pid 1160, Adobe CEF Helper)
   Nov  4 09:10:06 jnl: b(1, 4): replay_journal: from: 3739648 to: 9994240 (joffset 0xe89000)
   Nov  4 09:10:06 jnl: b(1, 4): journal replay done.
   Nov  4 09:11:09 process SGProtocolServic[30] caught causing excessive wakeups. Observed wakeups rate (per sec): 715; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45187
   Nov  4 09:15:30 process Creative Cloud[328] caught causing excessive wakeups. Observed wakeups rate (per sec): 181; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45009
   Nov  4 13:27:49 process SGProtocolServic[30] caught causing excessive wakeups. Observed wakeups rate (per sec): 694; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45589
   Nov  4 13:31:58 process Creative Cloud[308] caught causing excessive wakeups. Observed wakeups rate (per sec): 183; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45054
   Nov  4 15:59:32 wl0: Roamed or switched channel, reason #2, bssid 00, last RSSI -57
   Nov  4 16:30:21 PM notification timeout (pid 308, Creative Cloud)
   Nov  4 16:30:21 PM notification timeout (pid 359, Adobe CEF Helper)
   Nov  5 10:48:38 process SGProtocolServic[30] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
   Nov  5 10:52:05 process Creative Cloud[306] caught causing excessive wakeups. Observed wakeups rate (per sec): 182; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45128
   Nov  5 11:17:59 process SGProtocolServic[32] caught causing excessive wakeups. Observed wakeups rate (per sec): 666; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45119
   Nov  5 11:21:44 process Creative Cloud[304] caught causing excessive wakeups. Observed wakeups rate (per sec): 177; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45023
   Nov  5 12:06:26 jnl: b(1, 4): replay_journal: from: 1467904 to: 9360896 (joffset 0xe89000)
   Nov  5 12:06:26 jnl: b(1, 4): journal replay done.
   Nov  5 12:07:42 process SGProtocolServic[32] caught causing excessive wakeups. Observed wakeups rate (per sec): 611; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45804
   Nov  5 12:07:49 process webfilterDNSd[284] caught causing excessive wakeups. Observed wakeups rate (per sec): 698; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 47652
   Nov  5 12:10:41 process Creative Cloud[309] caught causing excessive wakeups. Observed wakeups rate (per sec): 190; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45437
kexts
   com.digidesign.iokit.DigiDal (10.3.2f47)
   com.waves.driver.soundgrid (2.0.0)
   tc.tctechnologies.driver.TCNear (3.5.6 11675)
   com.sophos.nke.swi (9.2.50)
   com.paceap.kext.pacesupport.snowleopard (5.9)
   com.sophos.kext.sav (9.2.50)
Daemons
   com.sophos.webd
   com.paceap.pacesupport
   com.sophos.scan
   com.sophos.intercheck
   com.sophos.common.servicemanager
   com.apple.installer.osmessagetracing
   com.google.keystone.daemon
   com.oracle.java.Helper-Tool
   com.sophos.autoupdate
   com.sophos.sxld
   com.sophos.notification
   com.sophos.configuration
   com.waves.daemon.SoundGridProtocolService
   com.paceap.eden.licensed
Agents
   com.digidesign.mboxpro.helper
   com.adobe.AdobeCreativeCloud
   com.adobe.ARM.UUID
   com.google.keystone.system.agent
   com.sophos.uiserver
   com.apple.photostream-agent
   com.oracle.java.Java-Updater
   com.adobe.ARM.UUID
   com.apple.AirPortBaseStationAgent
Startup items
   /Library/StartupItems/DigidesignLoader/DigidesignLoader
   /Library/StartupItems/DigidesignLoader/StartupParameters.plist
   /Library/StartupItems/PACESupport/PACESupport
   /Library/StartupItems/PACESupport/Resources/PACESupport.plist
   /Library/StartupItems/PACESupport/StartupParameters.plist
   /Library/StartupItems/Qmaster/Qmaster
   /Library/StartupItems/Qmaster/StartupParameters.plist
Bundles
   /System/Library/Extensions/AvidMboxPro.kext
   - com.avid.driver.firewire.mboxpro
   /System/Library/Extensions/DigiDal.kext
   - com.digidesign.iokit.DigiDal
   /System/Library/Extensions/JMicronATA.kext
   - com.jmicron.JMicronATA
   /System/Library/Extensions/PACESupportFamily.kext
   - com.paceap.kext.pacesupport.master
   /System/Library/Extensions/SoundGrid.kext
   - com.waves.driver.soundgrid
   /System/Library/Extensions/TCNear.kext
   - tc.tctechnologies.driver.TCNear
   /Library/Audio/MIDI Drivers/Avid Mbox Pro MIDI.plugin
   - com.avid.firewire.midi.mboxpro
   /Library/Audio/MIDI Drivers/TCNearMIDIDriver.plugin
   - tc.tctechnologies.TCNear.midiplugin
   /Library/Audio/MIDI Drivers/WaveRiderDriver.plugin
   - com.quitearts.waverider.midi
   /Library/Audio/Plug-Ins/Components/Assimilator Native.component
   - N/A
   /Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component
   - net.telestream.wmv.import
   /Library/Audio/Plug-Ins/Components/Integrator.component
   - com.tcelectronic.Integrator
   /Library/Audio/Plug-Ins/Components/M40 Reverb.component
   - N/A
   /Library/Audio/Plug-Ins/Components/ResFilter Native.component
   - N/A
   /Library/Audio/Plug-Ins/Components/WaveShell-AU 8.0.component
   - com.WavesAudio.WaveShell-AU.8.0.0
   /Library/Audio/Plug-Ins/HAL/Avid CoreAudio.plugin
   - com.avid.avid.AvidCoreAudioPlugIn
   /Library/Audio/Plug-Ins/HAL/DVCPROHDAudio.plugin
   - com.apple.DVCPROHDAudio
   /Library/Audio/Plug-Ins/VST/TC Electronic/Assimilator Native.vst
   - N/A
   /Library/Audio/Plug-Ins/VST/TC Electronic/Integrator.vst
   - com.tcelectronic.Integrator
   /Library/Audio/Plug-Ins/VST/TC Electronic/M40 Reverb.vst
   - N/A
   /Library/Audio/Plug-Ins/VST/TC Electronic/ResFilter Native.vst
   - N/A
   /Library/Audio/Plug-Ins/VST/WaveShell-VST 8.0.vst
   - com.WavesAudio.WaveShell-VST.8.0.0
   /Library/Audio/Plug-Ins/VST3/WaveShell-VST 8.0.vst3
   - com.WavesAudio.WaveShell-VST.8.0.0
   /Library/Extensions/SophosNetworkInterceptor.kext
   - com.sophos.nke.swi
   /Library/Extensions/SophosOnAccessInterceptor.kext
   - com.sophos.kext.sav
   /Library/Internet Plug-Ins/AdobeAAMDetect.plugin
   - com.AdobeAAMDetectLib.AdobeAAMDetect
   /Library/Internet Plug-Ins/AdobePDFViewer.plugin
   - com.adobe.acrobat.pdfviewer
   /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
   - com.adobe.acrobat.pdfviewerNPAPI
   /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
   - net.telestream.wmv.plugin
   /Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
   - com.google.googletalkbrowserplugin
   /Library/Internet Plug-Ins/JavaAppletPlugin.plugin
   - com.oracle.java.JavaAppletPlugin
   /Library/Internet Plug-Ins/o1dbrowserplugin.plugin
   - com.google.o1dbrowserplugin
   /Library/Internet Plug-Ins/Silverlight.plugin
   - com.microsoft.SilverlightPlugin
   /Library/PreferencePanes/Avid Mbox Pro.prefPane
   - com.avid.prefpane.{UUID}
   /Library/PreferencePanes/Flip4Mac WMV.prefPane
   - net.telestream.wmv.prefpane
   /Library/PreferencePanes/JavaControlPanel.prefPane
   - com.oracle.java.JavaControlPanel
   /Library/QuickTime/AppleHDVCodec.component
   - com.apple.AppleHDVCodec
   /Library/QuickTime/AppleProRes422.component
   - com.apple.AppleProRes422
   /Library/QuickTime/AvidAV1xCodec.component
   - com.avid.qtcodecs.AvidAV1xCodec
   /Library/QuickTime/AvidAVd1Codec.component
   - com.avid.qtcodecs.AvidAVd1Codec
   /Library/QuickTime/AvidAVDJCodec.component
   - com.avid.qtcodecs.AvidAVDJCodec
   /Library/QuickTime/AvidAVdnCodec.component
   - com.avid.qtcodecs.AvidAVdnCodec
   /Library/QuickTime/AvidAVdvCodec.component
   - com.avid.qtcodecs.AvidAVdvCodec
   /Library/QuickTime/AvidAVpkCodec.component
   - com.avid.qtcodecs.AvidAVpkCodec
   /Library/QuickTime/AvidAVrpCodec.component
   - com.avid.qtcodecs.AvidAVrpCodec
   /Library/QuickTime/AvidAVUICodec.component
   - com.avid.qtcodecs.AvidAVUICodec
   /Library/QuickTime/DesktopVideoOut.component
   - com.apple.DesktopVideoOut
   /Library/QuickTime/DVCPROHDCodec.component
   - com.apple.DVCPROHDCodec
   /Library/QuickTime/DVCPROHDMuxer.component
   - com.apple.DVCPROHDMuxer
   /Library/QuickTime/DVCPROHDVideoDigitizer.component
   - com.apple.DVCPROHDVideoDigitizer
   /Library/QuickTime/DVCPROHDVideoOutput.component
   - com.apple.DVCPROHDVideoOutput
   /Library/QuickTime/DVCPROHDVideoOutputClock.component
   - com.apple.DVCPROHDVideoOutputClock
   /Library/QuickTime/DVCPROHDVideoOutputCodec.component
   - com.apple.DVCPROHDVideoOutputCodec
   /Library/QuickTime/Flip4Mac WMV Advanced.component
   - net.telestream.wmv.advanced
   /Library/QuickTime/Flip4Mac WMV Export.component
   - net.telestream.wmv.export
   /Library/QuickTime/Flip4Mac WMV Import.component
   - net.telestream.wmv.import
   /Library/QuickTime/IMXCodec.component
   - com.apple.IMXCodec
   /Library/QuickTime/LiveType.component
   - com.apple.LiveType.component
   /Library/QuickTime/Motion.component
   - com.apple.motion.component
   Library/Address Book Plug-Ins/SkypeABDialer.bundle
   - com.skype.skypeabdialer
   Library/Address Book Plug-Ins/SkypeABSMS.bundle
   - com.skype.skypeabsms
   Library/Caches/com.apple.Safari/Extensions/iSkyDeluxe.safariextension
   - com.wondershare.iskyvc
   Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
   - com.Google.GoogleEarthPlugin.plugin
Apps
   /Applications/Google Drive.app
Contents of /etc/sysctl.conf (checksum 1254711194)
   kern.ipc.maxsockbuf=512000
   net.inet.tcp.sendspace=131072
   net.inet.tcp.recvspace=358400
Contents of /etc/mach_init.d/IIDCVideoAssistant.plist (checksum 71678559)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Command</key>
    <string>/System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/ Versions/A/Resources/IIDCVideoAssistant</string>
    <key>OnDemand</key>
    <true/>
    <key>ServiceName</key>
    <string>com.apple.mio.IIDCVideoAssistant</string>
   </dict>
   </plist>
Contents of /etc/mach_init.d/VDCAssistant.plist (checksum 790003408)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Command</key>
    <string>/System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/ Versions/A/Resources/VDCAssistant</string>
    <key>OnDemand</key>
    <true/>
    <key>ServiceName</key>
    <string>com.apple.mio.VDCAssistant</string>
   </dict>
   </plist>
Contents of /Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist (checksum 461455494)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.AdobeCreativeCloud</string>
    <key>Program</key>
    <string>/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud</string>
    <string>--showwindow=false</string>
          <string>--onOSstartup=true</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
   </dict>
   </plist>
Contents of /Library/LaunchAgents/com.avid.mboxpro.helper.plist (checksum 425244676)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>KeepAlive</key>
    <true/>
    <key>Label</key>
    <string>com.digidesign.mboxpro.helper</string>
    <key>OnDemand</key>
    <false/>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Application Support/Avid/{UUID}/LaunchdDaemon</string>
    <string>start</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
   </dict>
   </plist>
Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 3543662088)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
           <key>Label</key>
           <string>com.oracle.java.Java-Updater</string>
           <key>ProgramArguments</key>
    <array>
           <string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
           <string>-bgcheck</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
    <key>Hour</key>
    <integer>21</integer>
    <key>Minute</key>
    <integer>21</integer>
    <key>Weekday</key>
    <integer>5</integer>
    </dict>
    <key>StandardErrorPath</key>
           <string>/dev/null</string>
           <key>StandardOutPath</key>
           <string>/dev/null</string>
   </dict>
   ...and 1 more line(s)
Contents of /Library/LaunchAgents/com.sophos.uiserver.plist (checksum 40276757)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>KeepAlive</key>
    <true/>
    <key>Label</key>
    <string>com.sophos.uiserver</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Sophos Anti-Virus/SophosUIServer.app/Contents/MacOS/SophosUIServer</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
   </dict>
   </plist>
Contents of /Library/LaunchDaemons/PACESupport.plist (checksum 1658798800)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
            "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.paceap.pacesupport</string>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/Extensions/PACESupportFamily.kext/Contents/Resources/pa ceload</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    </dict>
   </plist>
Contents of /Library/LaunchDaemons/com.paceap.eden.licensed.plist (checksum 3699316858)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.paceap.eden.licensed</string>
    <key>KeepAlive</key>
    <true/>
    <key>RunAtLoad</key>
    <true/>
    <key>Program</key>
    <string>/Library/PrivilegedHelperTools/licenseDaemon.app/Contents/MacOS/license Daemon</string>
    <key>ProgramArguments</key>
    <array>
    <string> </string>
    </array>
    <key>SoftResourceLimits</key>
    <dict>
    <key>NumberOfFiles</key>
    <integer>1024</integer>
    </dict>
    <key>HardResourceLimits</key>
    <dict>
    <key>NumberOfFiles</key>
    <integer>1024</integer>
   ...and 15 more line(s)
Contents of /Library/LaunchDaemons/com.sophos.common.servicemanager.plist (checksum 1792128556)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
    <key>Label</key>
    <string>com.sophos.common.servicemanager</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Sophos Anti-Virus/SophosServiceManager.bundle/Contents/MacOS/SophosServiceManager</str ing>
    </array>
    <key>KeepAlive</key>
    <true/>
   </dict>
   </plist>
Contents of /Library/LaunchDaemons/com.waves.daemon.SoundGridProtocolService.plist (checksum 1106189678)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.waves.daemon.SoundGridProtocolService</string>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/Extensions/SoundGrid.kext/Contents/MacOS/SGProtocolServ ice</string>
    <string>runasservice</string>
    </array>
    <key>ServiceDescription</key>
    <string>Waves SoundGrid Protocol Service</string>
    <key>OnDemand</key>
    <false/>
    <key>RunAtLoad</key>
    <true/>
   </dict>
   </plist>
Contents of /Library/LaunchDaemons/tc.tctechnologies.TCNear.plist (checksum 775818042)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>tc.tctechnologies.daemon.TCNear</string>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <false/>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Application Support/TCNear/TCNearDaemon</string>
    <string>--onDemand</string>
    </array>
    <key>Sockets</key>
    <dict>
    <key>MasterSocket</key>
    <dict>
    <key>SockFamily</key>
    <string>Unix</string>
    <key>SockPathMode</key>
    <integer>438</integer>
    <key>SockPathName</key>
    <string>/var/run/tc.tctechnologies.daemon.TCNear</string>
   ...and 6 more line(s)
Contents of Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist (checksum 4071182229)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
    <dict>
     <key>Label</key>
     <string>com.adobe.AAM.Scheduler-1.0</string>
     <key>Program</key>
     <string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>
     <key>ProgramArguments</key>
     <array>
        <string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>
        <string>-mode=scheduled</string>
     </array>
     <key>StartCalendarInterval</key>
     <dict>
       <key>Minute</key>
       <integer>0</integer>
       <key>Hour</key>
       <integer>2</integer>
     </dict>
    </dict>
   </plist>
Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (checksum 408149527)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARM.UUID</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>12600</integer>
   </dict>
   </plist>
Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (checksum 4116814193)
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARM.UUID</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/Adobe Acrobat XI Pro/Adobe Acrobat Pro.app/Contents/MacOS/Updater/Adobe Acrobat Updater Helper.app/Contents/MacOS/Adobe Acrobat Updater Helper</string>
    <string>semi-auto</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>12600</integer>
   </dict>
   </plist>
Bad plists
   Library/Preferences/com.Fastoid.Chowder.plist
   Library/Preferences/com.xiconsinc.linesupreme.plist
Firewall: On
DNS: 24.201.245.77
User login items
   iTunesHelper
   - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
   AdobeResourceSynchronizer
   - /Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app
   Google Drive
   - /Applications/Google Drive.app
   Eye-Fi Helper
   - /Applications/Eye-Fi/Eye-Fi Helper.app
Safari extensions
   iMedia Converter Deluxe 
Widgets
   iCal
Restricted files: 504
Elapsed time (s): 142