No log-in pop ups
Recently, I can no longer access my banks using log-in pop ups. I have safari and chrome in my iMac and both do not show the pop up every time I press the log in button. It can't be my pop up settings because I've tried turning on and off and still the button remained unresponsive. I couldn't be sure, but this probably happened after the automatic update prompted by the system severals days ago. Any insights?
Try a restart.
Do a backup, using either Time Machine or a cloning program, to ensure files/data can be recovered. Two backups are better than one.
Try setting up another admin user account to see if the same problem continues. If Back-to-My Mac is selected in System Preferences, the Guest account will not work. The intent is to see if it is specific to one account or a system wide problem. This account can be deleted later.
Isolating an issue by using another user account
Similar Messages
-
Keychain log box keeps popping up repeatedly fir different things.
How do I fix?Have you tried going to Keychain access menu > keychain first aid > and run that.
-
ICloud log in pop ups & can't turn off find my iphone
I Keep getting iCloud sign in popups.
I Have gone to icloud.com and I have a valid Apple id but says my iCloud is not set up.
ive changed my password so I know my password is correct.
I try to sign out of find my iPhone but it says incorrect password or Apple id.If you are unable to remember your password, security questions, don’t have access to your rescue address or are unable to reset your password for whatever reason, your only option is to contact Apple ID Support, upon speaking to an operator you should explain that your problem is related to your Apple ID, this way you will not be charged for assistance, even if you don’t have an AppleCare plan.
You will need to show patience with the procedure and be prepared to demonstrate without question that the account belongs to you. Don’t expect access to be restored immediately and if you aren’t the owner of the Apple ID registered to the device the account won’t be reset.
This is answer is provided from my own database of boilerplate responses and the content was last reviewed and/or tested on: 2014/12/18 -
I removed Creative Cloud but I still get pop-ups asking me to log in....why and how do I get rid of it?
Looks like you didn't uninstall; you just logged out. Go to the Windows Control Panel, Programs and Features (in Win7; may be different in your version of Windows). right click on each Adobe CC app you want to uninstall and select "uninstall". Then uninstall CC itself.
-
I am receiving pop ups to security sites to secure my files etc. I assume I have a virus but not sure how to fix it.
There is no need to download anything to solve this problem.
You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.
Make sure you don't repeat the mistake that led you to install the malware. It may have come from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked. -
Every time i log into my computer, i get bombarded with pop ups asking me for numerous passwords, i enter the CORRECT ones in for my email accounts and they keep coming up, i cant do anything to get this off. Keychains suck i dont know why anyone would have made these.
I go to the keychain preferences in finder and i try to unlock the local items keychain but it wont because i dont know the password, ive tried any password it could possibly be and it wont go through. I also cant reset it becasue it says "invalid aegument" every time i try to do that in First Aid.
Everything anyone has said to do wont help. I cant even get my mail accounts to come online but they still work in my phone. I even downloaded the newest version 10.9 or whatever and it doesnt work. My mail accounts are all screwed up, so is icloud, and messages app i cant even use it. ive restarted my computer a million times so dont suggest that either.
Oh and for those of you who are going to tell me to go to /library/keychain or anything like that, my computer says that the file or folder doestn exist.Please follow the directions in this support article. If there's no change, see below.
Back up all data. Open the iCloud preference pane and uncheck the Keychain box. You'll be prompted to keep or delete the keychain items. Choose to delete and confirm. Then re-check the box. Follow one of the procedures described in this support article to set up iCloud Keychain on an additional device. Test. -
Pop-ups in certain sites, can't contain the problem:
Hi!! I would like to submit a problem to the apple community. When I open certain websites, i get redirected to another web site, 'adultyum.info' containing adult material. This is really really annoying. I've got AdBlock Plus both on Chrome and Safari. But i'm only being redirected when using Safari. In Chrome, I haven't experienced the problem so far. CLAMXAV and ADWAREMEDIC both did not detect any problem. Please please do help.. I also tried changing router, and I still experienced it on Safari..
So i have several questions:
1) What is the solution to this problem?
2) Is this dangerous? Does it maybe steal private information like passwords or surfing habits?
I saw this discussion: Unwanted pop-up: unusual problem
And I performed a diagnostic test too. The results are as follows:
Start time: 10:57:10 03/24/15
Revision: 1241
Model Identifier: MacBookPro8,1
System Version: OS X 10.10.2 (14C1514)
Kernel Version: Darwin 14.1.0
Time since boot: 3:33
UID: 501
SerialATA
ST9500325ASG
Activity
CPU: user 15%, system 4%
CPU usage (%)
clamscan (UID 501): 25.0
I/O wait time (ms/s)
Google Chrome (UID 501): 12
I/O requests (KiB/s)
clamscan (UID 501): 14698
Firewall: On
Listeners
cupsd: ipp
kdc: kerberos
launchd: afpovertcp
launchd: microsoft-ds
System caches/logs
3155 MB: /System/Library/Caches/com.apple.coresymbolicationd/data
Diagnostic reports
2015-02-24 VLC crash x3
2015-02-24 com.apple.AmbientDisplayAgent crash
2015-02-25 VLC crash
2015-03-02 com.apple.AmbientDisplayAgent crash
2015-03-02 fontd crash
2015-03-04 Finder hang
2015-03-04 VLC hang
2015-03-12 com.apple.internetaccounts crash
2015-03-12 taskgated crash
2015-03-17 VLC crash
2015-03-24 Finder crash
System log
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:33 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:33 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:57:59 WindowServer disable_update_timeout: UI updates were forcibly disabled by application "ClamXav" for over 1.00 seconds. Server has re-enabled them.
Console log
Mar 23 08:12:06 nsurlstoraged The read-connection to the DB=/Users/USER/Library/Caches/qlmanage/Cache.db is NOT valid. Unable to determine schema version.
Mar 23 08:12:06 nsurlstoraged Process 327 does not have access to path /Users/USER/Library/Caches/qlmanage/Cache.db
Mar 23 08:12:06 nsurlstoraged Process 327 does not have access to path /Users/USER/Library/Caches/qlmanage/Cache.db
Mar 23 10:54:56 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 23 10:55:22 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 23 11:05:15 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 11:42:56 ReportCrash Invoking spindump for pid=1209 wakeups_rate=163 duration=277 because of excessive wakeups
Mar 23 17:02:09 ReportCrash Invoking spindump for pid=1061 wakeups_rate=194 duration=232 because of excessive wakeups
Mar 23 18:06:59 ReportCrash Invoking spindump for pid=1145 wakeups_rate=412 duration=110 because of excessive wakeups
Mar 23 18:16:43 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 18:16:52 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 18:36:40 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 18:36:56 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:42:22 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:42:24 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:54:55 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:56:54 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 08:14:52 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 08:40:17 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 09:07:02 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 10:31:32 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 10:40:30 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 24 10:41:05 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 24 10:41:16 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 24 10:41:28 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Loaded kernel extensions
com.rim.driver.BlackBerryUSBDriverInt (0.0.74)
com.squirrels.airparrot.framebuffer (3)
com.squirrels.driver.AirParrotSpeakers (1.8)
com.wavtap.driver.WavTap (0.4.0)
Daemons
com.apple.Kerberos.kdc
- status: 1
com.apple.awdd
com.apple.ctkd
com.apple.icloud.findmydeviced
com.apple.iconservices.iconservicesagent
com.apple.ifdreader
com.apple.installer.osmessagetracing
com.apple.secinitd
com.apple.watchdogd
com.apple.wdhelper
com.microsoft.office.licensing.helper
com.oracle.java.Helper-Tool
com.oracle.java.JavaUpdateHelper
com.rim.BBDaemon
Agents
com.adobe.ARM.UUID
com.adobe.CS5ServiceManager
com.apple.AirPortBaseStationAgent
com.apple.Finder
- status: -11
com.google.keystone.user.agent
com.hp.devicemonitor
com.hp.messagecenter.launcher
com.oracle.java.Java-Updater
com.paragon.ntfs.trial
com.paragon.ntfs.upd
com.rim.BBLaunchAgent
com.rim.RimAlbumArtDaemon
net.culater.SIMBL.Agent
org.glimmerblocker.updater
User overrides
com.adobe.AAM.Scheduler-1.0
com.marketcircle.BPSyncHelper
com.fiplab.MenuTabHelper
com.spotify.webhelper
Startup items
/Library/StartupItems/HWNetMgr/HWNetCfg
/Library/StartupItems/HWNetMgr/HWNetMgr
/Library/StartupItems/HWNetMgr/StartupParameters.plist
/Library/StartupItems/HWPortDetect/HWPortCfg
/Library/StartupItems/HWPortDetect/HWPortDetect
/Library/StartupItems/HWPortDetect/StartupParameters.plist
User login items
Android File Transfer Agent
- /Users/USER/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app
Safari extensions
Adblock Plus
- org.adblockplus.adblockplussafari
iCloud errors
bird 38
CallHistorySyncHelper 13
Continuity errors
sharingd 3
Restricted files: 51
Lockfiles: 157
Contents of /Library/LaunchAgents/com.hp.devicemonitor.plist
- mod date: May 27 04:04:05 2012
- checksum: 77374180
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Program</key>
<string>/Library/Printers/hp/hpio/HP Device Monitor.app/Contents/MacOS/HP Device Monitor</string>
<key>Label</key>
<string>com.hp.devicemonitor</string>
<key>KeepAlive</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.hp.messagecenter.launcher.plist
- mod date: Jan 19 20:58:23 2010
- checksum: 3424434743
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.hp.messagecenter.launcher</string>
<key>Program</key>
<string>/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks /LaunchServices.framework/Versions/A/Support/lsregister</string>
<key>ProgramArguments</key>
<array>
<string>-lazy</string>
<string>30</string>
<string>/Library/Printers/hp/Utilities/HPPU Plugins/Message Center.task/Contents/Resources/HPMessageCenterBridge.app</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
- mod date: Dec 11 08:53:58 2013
- checksum: 142207891
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.oracle.java.Java-Updater</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
<string>-bgcheck</string>
</array>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>15</integer>
<key>Minute</key>
<integer>24</integer>
<key>Weekday</key>
<integer>3</integer>
</dict>
</dict>
...and 1 more line(s)
Contents of /Library/LaunchAgents/com.rim.BBAlbumArtCacher.plist
- mod date: Feb 9 06:31:27 2012
- checksum: 2868431736
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.rim.RimAlbumArtDaemon</string>
<key>OnDemand</key>
<false/>
<key>Program</key>
<string>/Library/Application Support/BlackBerry/RimAlbumArtDaemon</string>
<key>ProgramArguments</key>
<array>
<string>RimAlbumArtDaemon</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.rim.BBLaunchAgent.plist
- mod date: Feb 9 06:31:28 2012
- checksum: 908705504
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.rim.BBLaunchAgent</string>
<key>OnDemand</key>
<false/>
<key>Program</key>
<string>/Library/Application Support/BlackBerry/BBLaunchAgent.app</string>
<key>ProgramArguments</key>
<array>
<string>BBLaunchAgent</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/net.culater.SIMBL.Agent.plist
- mod date: Dec 24 13:02:52 2013
- checksum: 1107421619
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>net.culater.SIMBL.Agent</string>
<key>Program</key>
<string>/Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent</string>
<key>RunAtLoad</key>
<false/>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>OnDemand</key>
<false/>
</dict>
</plist>
Contents of /Library/LaunchAgents/org.glimmerblocker.updater.plist
- mod date: Dec 24 12:31:49 2013
- checksum: 4132589395
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE plist PUBLIC '-//Apple Computer//DTD PLIST 1.0//EN' 'http://www.apple.com/DTDs/PropertyList-1.0.dtd'>
<plist version='1.0'>
<dict>
<key>Disabled</key>
<false/>
<key>Label</key>
<string>org.glimmerblocker.updater</string>
<key>InitGroups</key>
<true/>
<key>ProgramArguments</key>
<array>
<string>/Library/PreferencePanes/GlimmerBlocker.prefPane/Contents/GlimmerBlocke rUpdater.app/Contents/MacOS/GlimmerBlockerUpdater</string>
<string>--background</string>
</array>
<key>Umask</key>
<integer>18</integer>
<key>StartInterval</key>
<integer>86400</integer>
<key>KeepAlive</key>
<false/>
<key>WorkingDirectory</key>
<string>/Library/PreferencePanes/GlimmerBlocker.prefPane/Contents/GlimmerBlocke rUpdater.app/Contents/Resources</string>
<key>StandardErrorPath</key>
<string>/Library/Logs/GlimmerBlocker/Launchd.log</string>
...and 2 more line(s)
Contents of /Library/LaunchDaemons/com.rim.BBDaemon.plist
- mod date: Feb 9 06:31:28 2012
- checksum: 4059782046
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN
http://www.apple.com/DTDs/PropertyList-1.0.dtd >
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.rim.BBDaemon</string>
<key>Program</key>
<string>/Library/Application Support/BlackBerry/BBDaemon</string>
<key>ProgramArguments</key>
<array>
<string>BBDaemon</string>
</array>
<key>KeepAlive</key>
<true/>
<key>OnDemand</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>Sockets</key>
<dict>
<key>Listeners</key>
<dict>
<key>SockType</key>
<string>stream</string>
...and 8 more line(s)
Contents of /System/Library/LaunchAgents/com.paragon.NTFS.trial.plist
- mod date: May 5 18:01:50 2011
- checksum: 3466880614
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.paragon.ntfs.trial</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Application Support/Paragon NTFS for Mac OS X/NTFS for Mac OS X.app/Contents/MacOS/NTFS for Mac OS X</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
</dict>
</plist>
Contents of /System/Library/LaunchAgents/com.paragon.NTFS.upd.plist
- mod date: May 5 18:01:50 2011
- checksum: 1029391047
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.paragon.ntfs.upd</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/Paragon NTFS for Mac OS X/ParagonUpdateChecker.app/Contents/MacOS/ParagonUpdateChecker</string>
<string>service</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
</dict>
</plist>
Contents of /System/Library/Security/authorization.plist
- mod date: Oct 9 17:17:00 2014
- checksum: 2720110640
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>comment</key>
<string>The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction.
allow rule: this is always allowed
<key>com.apple.TestApp.benign</key>
<string>allow</string>
deny rule: this is always denied
<key>com.apple.TestApp.dangerous</key>
<string>deny</string>
user rule: successful authentication as a user in the specified group(5) allows the associated right.
The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified.
The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule.
The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified.
See remaining rules for examples.
</string>
<key>rights</key>
<dict>
<key></key>
<dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
...and 1850 more line(s)
Contents of /private/etc/authorization.deprecated
- mod date: Oct 9 12:30:47 2013
- checksum: 1982440893
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>comment</key>
<string>The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction.
allow rule: this is always allowed
<key>com.apple.TestApp.benign</key>
<string>allow</string>
deny rule: this is always denied
<key>com.apple.TestApp.dangerous</key>
<string>deny</string>
user rule: successful authentication as a user in the specified group(5) allows the associated right.
The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified.
The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule.
The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified.
See remaining rules for examples.
</string>
<key>rights</key>
<dict>
<key></key>
<dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
...and 9717 more line(s)
Contents of /private/etc/hosts
- mod date: Dec 14 13:17:51 2011
- checksum: 2498082492
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 hl2rcv.adobe.com
255.255.255.255 broadcasthost
::1 localhost
fe80::1%lo0 localhost
Contents of /private/etc/pam.d/prl_disp_service
- mod date: Sep 8 19:03:17 2010
- checksum: 1160556194
auth required pam_nologin.so
auth optional pam_afpmount.so
auth sufficient pam_securityserver.so nullok
auth sufficient pam_unix.so nullok
auth required pam_deny.so
account required pam_permit.so
password required pam_deny.so
session required pam_permit.so
session optional pam_afpmount.so
Contents of /private/etc/pam.d/prl_disp_service.snow_leopard
- mod date: Sep 8 19:03:17 2010
- checksum: 1656795023
auth optional pam_mount.so
auth sufficient pam_serialnumber.so serverinstall legacy
auth required pam_opendirectory.so nullok
account required pam_nologin.so
account required pam_opendirectory.so
password required pam_deny.so
session required pam_launchd.so
session required pam_uwtmp.so
session optional pam_mount.so
Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist
- mod date: Dec 6 17:02:32 2011
- checksum: 408149527
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.adobe.ARM.UUID</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>12600</integer>
</dict>
</plist>
Contents of Library/LaunchAgents/com.google.keystone.agent.plist
- mod date: Mar 4 08:33:04 2015
- checksum: 2825338244
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.google.keystone.user.agent</string>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>ProgramArguments</key>
<array>
<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>
<string>-runMode</string>
<string>ifneeded</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>3523</integer>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
</dict>
</plist>
Extensions
/Library/Extensions/APExtFramebuffer.kext
- com.squirrels.airparrot.framebuffer
/Library/Extensions/AirParrotDriver.kext
- com.squirrels.driver.AirParrotSpeakers
/System/Library/Extensions/APExtFramebuffer.kext
- com.squirrels.airparrot.framebuffer
/System/Library/Extensions/AirParrotDriver.kext
- com.squirrels.driver.AirParrotSpeakers
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardACMControl.kext
- com.huawei.driver.HuaweiDataCardACMControl
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardACMData.kext
- com.huawei.driver.HuaweiDataCardACMData
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardActivateDriver.kext
- com.huawei.driver.HuaweiDataCardActivateDriver
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardECMControl.kext
- com.huawei.driver.HuaweiDataCardECMControl
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardECMData.kext
- com.huawei.driver.HuaweiDataCardECMData
/System/Library/Extensions/HuaweiDataCardDriver.kext
- com.huawei.driver.HuaweiDataCardDriver
/System/Library/Extensions/JMicronATA.kext
- com.jmicron.JMicronATA
/System/Library/Extensions/RIMBBUSB.kext
- com.rim.driver.BlackBerryUSBDriverInt
/System/Library/Extensions/RIMBBVSP.kext
- com.rim.driver.BlackBerryUSBDriverVSP
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateDriveIcons.kext
- com.seagate.driver.SeagateDriveIcons
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateLeafPowSecDriver_10_4.kext
- com.seagate.driver.PowSecLeafDriver_10_4
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateLeafPowSecDriver_10_5.kext
- com.seagate.driver.PowSecLeafDriver_10_5
/System/Library/Extensions/Seagate Storage Driver.kext
- com.seagate.driver.PowSecDriverCore
/System/Library/Extensions/USBExpressCardCantWake_Huawei.kext
- com.apple.dts.driver.USBExpressCardCantWake
/System/Library/Extensions/WavTap.kext
- N/A
/System/Library/Extensions/hp_Inkjet8_io_enabler.kext
- com.hp.print.hpio.inkjet8.kext
Applications
/Applications/Adobe Media Player.app
- com.adobe.amp.UUID.1
/Applications/Adobe/Adobe Help.app
- chc.UUID.1
/Applications/AppZapper.app
- com.appzapper.AppZapper
/Applications/ChartNexus.app
- N/A
/Applications/Hewlett-Packard/Device Utilities/HP Firmware Updater.app
- com.hp.FirmwareUpdater
/Applications/Hewlett-Packard/Device Utilities/HP Setup Assistant.app
- com.hp.SetupAssistant
/Applications/Hewlett-Packard/HP Scan 3.app
- com.hp.scan.app
/Applications/Hewlett-Packard/HP Uninstaller.app
- com.hp.Uninstaller
/Applications/MacTubes.app
- jp.MacTubes.MacTubesApp
/Applications/Microsoft Communicator.app
- com.microsoft.Communicator
/Applications/Microsoft Messenger.app
- com.microsoft.Messenger
/Applications/Microsoft Office 2011/Additional Tools/Microsoft Language Register/Microsoft Language Register.app
- com.microsoft.language_register
/Applications/Microsoft Office 2011/Microsoft Document Connection.app
- com.microsoft.DocumentConnection
/Applications/Microsoft Office 2011/Microsoft Excel.app
- com.microsoft.Excel
/Applications/Microsoft Office 2011/Microsoft Outlook.app
- com.microsoft.Outlook
/Applications/Microsoft Office 2011/Microsoft PowerPoint.app
- com.microsoft.Powerpoint
/Applications/Microsoft Office 2011/Microsoft Word.app
- com.microsoft.Word
/Applications/Microsoft Office 2011/Office/Alerts Daemon.app
- com.microsoft.AlertsDaemon
/Applications/Microsoft Office 2011/Office/Equation Editor.app
- com.microsoft.EquationEditor
/Applications/Microsoft Office 2011/Office/Microsoft Chart Converter.app
- com.microsoft.openxml.chart.app
/Applications/Microsoft Office 2011/Office/Microsoft Clip Gallery.app
- com.microsoft.ClipGallery
/Applications/Microsoft Office 2011/Office/Microsoft Database Daemon.app
- com.microsoft.outlook.database_daemon
/Applications/Microsoft Office 2011/Office/Microsoft Database Utility.app
- com.microsoft.outlook.database_utility
/Applications/Microsoft Office 2011/Office/Microsoft Graph.app
- com.microsoft.Graph
/Applications/Microsoft Office 2011/Office/Microsoft Office Reminders.app
- com.microsoft.outlook.office_reminders
/Applications/Microsoft Office 2011/Office/Microsoft Office Setup Assistant.app
- com.microsoft.office.setupassistant
/Applications/Microsoft Office 2011/Office/Microsoft Query
- N/A
/Applications/Microsoft Office 2011/Office/Microsoft Upload Center.app
- com.microsoft.office.uploadcenter
/Applications/Microsoft Office 2011/Office/My Day.app
- com.microsoft.myday
/Applications/Microsoft Office 2011/Office/Open XML for Excel.app
- com.microsoft.openxml.excel.app
/Applications/Microsoft Office 2011/Office/SyncServicesAgent.app
- com.microsoft.SyncServicesAgent
/Applications/OnyX.app
- com.titanium.OnyX
/Applications/Paragon NTFS for Mac OS X/ParagonUpdateChecker.app
- com.yourcompany.ParagonUpdateChecker
/Applications/Paragon NTFS for Mac OS X/Register NTFS for Mac OS X.app
- com.paragon-software.filesystems.ntfs.Register
/Applications/Remote Desktop Connection.app
- com.microsoft.rdc
/Applications/Seagate Dashboard 2.0.app
- com.seagate.dashboard
/Applications/Simple Comic.app
- com.tsst.simplecomic
/Applications/StuffIt Expander.app
- com.stuffit.StuffIt-Expander
/Applications/Utilities/Adobe AIR Application Installer.app
- com.adobe.air.ApplicationInstaller
/Applications/doubleTwist.app
- com.doubleTwist.desktop
/Applications/iFunBox.app
- com.iFunBoxDevTeam.iFunBox
/Incompatible Software/Parallels Service.app
- com.parallels.desktop.dispatcher
/Library/Application Support/Adobe/CS5ServiceManager/CS5ServiceManager.app
- com.adobe.csi.CS5ServiceManager
/Library/Application Support/Adobe/SwitchBoard/SwitchBoard.app
- com.adobe.switchboard-2.0
/Library/Application Support/BlackBerry/BBLaunchAgent.app
- N/A
/Library/Application Support/BlackBerry/BlackBerry Device Manager.app
- com.rim.blackberrydevicemanager
/Library/Application Support/BlackBerry/BlackBerryMobileMediaServer.app
- com.rim.BlackBerryMobileMediaServer
/Library/Application Support/BlackBerry/IPModemPasswordDialog.app
- com.rim.IPModemPasswordHelper
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Add to iPhoto Library.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Email Image.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Email PDF.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Open HP Scan.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Open PDF in Preview.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Open in Preview.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Save PDF in Documents.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Save in Pictures.app
- N/A
/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app
- com.microsoft.autoupdate2
/Library/Application Support/Microsoft/MERP2.0/Microsoft Error Reporting.app
- com.microsoft.error_reporting
/Library/Application Support/Microsoft/MERP2.0/Microsoft Ship Asserts.app
- com.microsoft.netlib.shipassertprocess
/Library/Application Support/Paragon NTFS for Mac OS X/NTFS for Mac OS X.app
- com.paragon-software.TrialExpiredNotification
/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app
- com.apple.ScriptEditor.id.cocoa-applet-template
/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app
- com.apple.ScriptEditor.id.droplet-with-settable-properties-template
/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app
- com.apple.ScriptEditor.id.file-processing-droplet-template
/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app
- com.apple.ScriptEditor.id.image-file-processing-droplet-template
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR Application Installer.app
- com.adobe.air.ApplicationInstaller
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Template.app
- com.adobe.air.Template
/Library/Image Capture/Devices/HP Scanner 3.app
- com.hp.scanModule3
/Library/Parallels/Parallels Mounter.app
- com.parallels.desktop.mounter
/Library/Parallels/Parallels Transporter.app
- com.parallels.desktop.transporter
/Library/Parallels/Uninstaller/Parallels Hypervisor/DockPlistEdit.app
- com.parallels.DockPlistEdit
/Library/Printers/hp/Frameworks/HPDeviceModel.framework/Versions/4.0/Runtime/hp dot4d.app
- com.hp.devicemodel.hpdot4d
/Library/Printers/hp/Utilities/HP Alerts.app
- com.hp.events.hpalerts
/Library/Printers/hp/Utilities/HP Utility.app
- com.hp.printerutility
/Library/Printers/hp/cups/filters/commandtohp.filter
- com.hp.print.cups.filter.commandtohp
/Library/Printers/hp/cups/filters/pdftopdf.filter
- com.hp.print.cups.filter.pdftopdf
/Library/Printers/hp/cups/tools/autosetup.tool
- com.hp.print.autosetup
/Library/Printers/hp/hpio/HP Device Monitor.app
- com.hp.devicemonitor
/Users/USER/Applications/Chrome Apps.localized/app_list.app
- com.google.Chrome.app.Default-app_list
/Users/USER/Documents/MAC Apps/AirParrot v 1.5.2/Crack/AirParrot Keygen.app
- Linezer0.Lz0-Keygen
/Users/USER/Documents/MAC Apps/AirParrot v 1.5.2/Crack/KG for OS X 10.6/Lz0 Keygen.app
- Linezer0.Lz0-Keygen
/Users/USER/Documents/MAC Apps/Stata 12/Stata.app
- com.stata.stata12
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_aiahmijlpehemcpleichkcokhegllfjl/Default aiahmijlpehemcpleichkcokhegllfjl.app
- com.google.Chrome.app.Default-aiahmijlpehemcpleichkcokhegllfjl-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_aohghmighlieiainnegkcijnfilokake/Default aohghmighlieiainnegkcijnfilokake.app
- com.google.Chrome.app.Default-aohghmighlieiainnegkcijnfilokake-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_apdfllckaahabafndbhieahigkjlhalf/Default apdfllckaahabafndbhieahigkjlhalf.app
- com.google.Chrome.app.Default-apdfllckaahabafndbhieahigkjlhalf-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_blpcfgokakmgnkcojhhkbfbldkacnbeo/Default blpcfgokakmgnkcojhhkbfbldkacnbeo.app
- com.google.Chrome.app.Default-blpcfgokakmgnkcojhhkbfbldkacnbeo-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_gighmmpiobklfepjocnamgkkbiglidom/Default gighmmpiobklfepjocnamgkkbiglidom.app
- com.google.Chrome.app.Default-gighmmpiobklfepjocnamgkkbiglidom-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_nmmhkkegccagdldgiimedpiccmgmieda/Default nmmhkkegccagdldgiimedpiccmgmieda.app
- com.google.Chrome.app.Default-nmmhkkegccagdldgiimedpiccmgmieda-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_pjkljhegncpnkpknbcohdijeoejaedia/Default pjkljhegncpnkpknbcohdijeoejaedia.app
- com.google.Chrome.app.Default-pjkljhegncpnkpknbcohdijeoejaedia-internal
/usr/local/hw_mobile_userdata/HWSleepNotify.app
- com.huawei.HWSleepNotify
Frameworks
/Library/Frameworks/Adobe AIR.framework
- com.adobe.AIR
/Library/Frameworks/HPSmartPrint.framework
- com.hp.print.HPSmartPrint
/Library/Frameworks/RIM_VSP.framework
- com.rim.vsp
/Library/Frameworks/RimBlackBerryUSB.framework
- com.rim.RimBlackBerryUSB
PrefPane
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.pref Pane
- com.oracle.java.JavaControlPanel
/Library/PreferencePanes/Flash Player.prefPane
- com.adobe.flashplayerpreferences
/Library/PreferencePanes/Growl.prefPane
- com.growl.prefpanel
/Library/PreferencePanes/MacFUSE.prefPane
- com.google.MacFUSE
/Library/PreferencePanes/NTFSforMacOSX.prefPane:® OS X:
- N/A
/Library/PreferencePanes/Perian.prefPane
- org.perian.PerianPane
/Library/PreferencePanes/YAMAHA-USBMIDIPatch.prefPane
- jp.co.yamaha.USBMIDIPatch
Bundles
/Library/Application Support/Adobe/APE/3.1/adbeapecore.framework/Versions/A/Resources/Flash Player.plugin
- com.macromedia.FlashPlayer-10.4-10.5.plugin
/Library/Application Support/Adobe/Plug-Ins/CS5/File Formats/Camera Raw.plugin
- com.adobe.CameraRaw
/Library/Audio/MIDI Drivers/YAMAHA-USBMIDIDriver.plugin
- jp.co.yamaha.USBMIDIDriver
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/AdobeCP15.plugin
- com.adobe.adobecp
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin
- com.macromedia.FlashPlayer-10.6.plugin
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
- com.adobe.acrobat.pdfviewer
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
- com.adobe.acrobat.pdfviewerNPAPI
/Library/Internet Plug-Ins/Flash Player.plugin
- com.macromedia.Flash
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
- com.oracle.java.JavaAppletPlugin
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
- com.microsoft.sharepoint.browserplugin
/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkIOM.plugin
- jp.co.Canon.ij.print.iom.CIJNP
/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkPBM.plugin
- jp.co.Canon.ij.print.pbm.CIJNP
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBIOM.plugin
- jp.co.canon.bj.print.bjusbiom
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBPBM.plugin
- jp.co.canon.bj.print.pbm.USB
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver.plugin
- jp.co.canon.ij.print.CIJUSBClassDriver
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver2.plugin
- jp.co.canon.ij.print.CIJUSBClassDriver2
/Library/Printers/Canon/BJPrinter/Plugins/IJBluetooth/IJBluetoothIOM.plugin
- jp.co.canon.ij.print.ijbluetoothiom
/Library/Printers/Canon/IJScanner/Plugins/ag07_09.plugin
- jp.co.canon.scangear.ag07.09
/Library/Printers/Canon/IJScanner/Plugins/ag08_09.plugin
- jp.co.canon.scangear.ag08.09
/Library/Printers/Canon/IJScanner/Plugins/cncl09_09.plugin
- jp.co.canon.scangear.lld09.09
/Library/Printers/Canon/IJScanner/Plugins/cnq2413_09.plugin
- jp.co.canon.scanner.cnq2413.09
/Library/Printers/Canon/IJScanner/Plugins/cnq2414_09.plugin
- jp.co.canon.scanner.cnq2414.09
/Library/Printers/Canon/IJScanner/Plugins/cnq4807_09.plugin
- jp.co.canoI also ran EtreCheck. Here are the results:
Problem description:
Pop-ups when opening some websites. Redirecting to adultyum.info
EtreCheck version: 2.1.8 (121)
Report generated March 24, 2015 at 12:03:26 PM GMT+8
Download EtreCheck from http://etresoft.com/etrecheck
Click the [Click for support] links for help with non-Apple products.
Click the [Click for details] links for more information about that line.
Hardware Information: ℹ️
MacBook Pro (13-inch, Late 2011) (Technical Specifications)
MacBook Pro - model: MacBookPro8,1
1 2.4 GHz Intel Core i5 CPU: 2-core
4 GB RAM Upgradeable
BANK 0/DIMM0
2 GB DDR3 1333 MHz ok
BANK 1/DIMM0
2 GB DDR3 1333 MHz ok
Bluetooth: Old - Handoff/Airdrop2 not supported
Wireless: en1: 802.11 a/b/g/n
Battery Health: Normal - Cycle count 957
Video Information: ℹ️
Intel HD Graphics 3000 - VRAM: 384 MB
Color LCD 1280 x 800
System Software: ℹ️
OS X 10.10.2 (14C1514) - Time since boot: 0:3:51
Disk Information: ℹ️
ST9500325ASG disk0 : (500.11 GB)
EFI (disk0s1) <not mounted> : 210 MB
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
Macintosh HD (disk1) / : 498.88 GB (126.04 GB free)
Core Storage: disk0s2 499.25 GB Online
OPTIARC DVD RW AD-5970H
USB Information: ℹ️
Apple Inc. FaceTime HD Camera (Built-in)
Apple Inc. BRCM2070 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Inc. Apple Internal Keyboard / Trackpad
Apple Computer, Inc. IR Receiver
Thunderbolt Information: ℹ️
Apple Inc. thunderbolt_bus
Configuration files: ℹ️
/etc/hosts - Count: 15
Gatekeeper: ℹ️
Mac App Store and identified developers
Kernel Extensions: ℹ️
/Incompatible Software/Parallels Service.app
[not loaded] com.parallels.kext.prl_hid_hook (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_hypervisor (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_netbridge (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_usb_connect (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_vnic (6.0 11820.602974) [Click for support]
/Library/Extensions
[loaded] com.squirrels.driver.AirParrotSpeakers (1.8 - SDK 10.8) [Click for support]
/System/Library/Extensions
[loaded] com.rim.driver.BlackBerryUSBDriverInt (0.0.74) [Click for support]
[not loaded] com.rim.driver.BlackBerryUSBDriverVSP (0.0.74) [Click for support]
[not loaded] com.seagate.driver.PowSecDriverCore (5.2.4 - SDK 10.4) [Click for support]
[loaded] com.squirrels.airparrot.framebuffer (3 - SDK 10.8) [Click for support]
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns
[not loaded] com.seagate.driver.PowSecLeafDriver_10_4 (5.2.4 - SDK 10.4) [Click for support]
[not loaded] com.seagate.driver.PowSecLeafDriver_10_5 (5.2.4 - SDK 10.5) [Click for support]
[not loaded] com.seagate.driver.SeagateDriveIcons (5.2.4 - SDK 10.4) [Click for support]
Startup Items: ℹ️
HWNetMgr: Path: /Library/StartupItems/HWNetMgr
HWPortDetect: Path: /Library/StartupItems/HWPortDetect
Startup items are obsolete in OS X Yosemite
Problem System Launch Agents: ℹ️
[loaded] com.paragon.NTFS.trial.plist [Click for support]
[loaded] com.paragon.NTFS.upd.plist [Click for support]
Launch Agents: ℹ️
[not loaded] com.adobe.AAM.Updater-1.0.plist [Click for support]
[loaded] com.adobe.CS5ServiceManager.plist [Click for support]
[running] com.hp.devicemonitor.plist [Click for support]
[loaded] com.hp.messagecenter.launcher.plist [Click for support]
[loaded] com.oracle.java.Java-Updater.plist [Click for support]
[running] com.rim.BBAlbumArtCacher.plist [Click for support]
[running] com.rim.BBLaunchAgent.plist [Click for support]
[running] net.culater.SIMBL.Agent.plist [Click for support]
[loaded] org.glimmerblocker.updater.plist [Click for support]
Launch Daemons: ℹ️
[loaded] com.adobe.SwitchBoard.plist [Click for support]
[loaded] com.microsoft.office.licensing.helper.plist [Click for support]
[loaded] com.oracle.java.Helper-Tool.plist [Click for support]
[loaded] com.oracle.java.JavaUpdateHelper.plist [Click for support]
[running] com.rim.BBDaemon.plist [Click for support]
User Launch Agents: ℹ️
[loaded] com.adobe.ARM.[...].plist [Click for support]
[loaded] com.google.keystone.agent.plist [Click for support]
User Login Items: ℹ️
Android File Transfer Agent Application (/Users/[redacted]/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app)
Internet Plug-ins: ℹ️
iPhotoPhotocast: Version: 7.0 - SDK 10.8
FlashPlayerDebugger-10.6: Version: 11.5.502.149 [Click for support]
AdobePDFViewerNPAPI: Version: 10.1.13 [Click for support]
AdobePDFViewer: Version: 10.1.13 [Click for support]
Flash Player: Version: 11.5.502.149 Outdated! Update
Default Browser: Version: 600 - SDK 10.10
QuickTime Plugin: Version: 7.7.3
SharePointBrowserPlugin: Version: 14.0.0 [Click for support]
JavaAppletPlugin: Version: Java 8 Update 40 Check version
User internet Plug-ins: ℹ️
iGetterScriptablePlugin: Version: 2.9.2 [Click for support]
RealPlayer Plugin: Version: Unknown
Safari Extensions: ℹ️
Adblock Plus
3rd Party Preference Panes: ℹ️
Flash Player [Click for support]
Growl [Click for support]
Java [Click for support]
MacFUSE [Click for support]
Paragon NTFS for Mac ® OS X [Click for support]
Perian [Click for support]
YAMAHA-USBMIDIPatch [Click for support]
Time Machine: ℹ️
Time Machine not configured!
Top Processes by CPU: ℹ️
5% WindowServer
4% mds
1% mds_stores
1% BBLaunchAgent
0% fontd
Top Processes by Memory: ℹ️
103 MB ocspd
82 MB Finder
60 MB mds_stores
52 MB WindowServer
39 MB softwareupdated
Virtual Memory Information: ℹ️
1.53 GB Free RAM
1.25 GB Active RAM
386 MB Inactive RAM
1.12 GB Wired RAM
915 MB Page-ins
0 B Page-outs
Diagnostics Information: ℹ️
Mar 24, 2015, 11:57:52 AM Self test - passed
Mar 24, 2015, 08:49:09 AM /Users/[redacted]/Library/Logs/DiagnosticReports/Finder_2015-03-24-084909_[reda cted].crash -
What antivirus protection should I purchase for my MacBook Pro? MacSecurity.app appeared on my desktop, and I downloaded that. Since then, it has said my computer is infected and pop-ups have been appearing.
You've been infected by a scam trojan. You don't need any anti-virus software on your Mac. See the following about getting rid of the trojan.
Trojan War
If you discover a trojan program is running on your computer then look to the following information for assistance:
1. A recent discussion on the Apple Support Communities: MacDefender Trojan.
2. An excellent site devoted to Mac Malware: Macintosh Virus Guide
3. Another site for removing MacDefende, et.al.: MAC Defender Rogue Anti-Virus analysis and Removal
4. A new removal utility - MacDefenderKiller
Removing strange software can be a task. The following outlines various ways of uninstalling software:
Uninstalling Software: The Basics
Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.
Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.
Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.
Some applications may install a Startup item or a Log In item. Startup items are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the Delete [-] button to delete it from the list.
Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.
If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, Easy Find, instead. Download Easy Find at VersionTracker or MacUpdate.
Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.
There are many utilities that can uninstall applications. Note that you must have this software installed before you install software you may need to uninstall. Uninstallers won't work if you install them after the fact. Here is a selection:
AppZapper
Automaton
Hazel
CleanApp
Yank
SuperPop
Uninstaller
Spring Cleaning
Look for them and others at VersionTracker or MacUpdate.
For more information visit The XLab FAQs and read the FAQs on removing software and dealing with spyware and malware.
After removing all the components of the software you may have to restart the computer to fully disable the software. This will be the case when removing software that has installed a daemon. After the daemon has been removed you need to restart the computer to stop the daemon. Alternatively, you can kill the daemon process using the Terminal application or Activity Monitor. -
How to allow pop-ups in Safari for all users
How do you allow Safari pop-ups for all users? After rolling out 50 Mac OSX with Safari comes default with Safari pop-ups disabled, now I must allow pop-ups for all users logging in.
Good day!Do you have an Exchange (e.g. a work) email account set up on the iPad ? If you do then it's possible that the account profile is preventing you turning popups 'on', in which case you would need to contact the email account administrator
-
Pop ups don't always work correctly
I am having problems with pop ups on some sites. I do not have pop ups blocked and I do have javascript enabled. I am using Firefox 6.0.2 on Windows XP 32-bit (I first noticed the problem with an older version of Firefox but upgrading didn't help).
To see an example of the problem, visit one of the StackExchange sites eg Stackoverflow.com (you might need to create an account or log in with Open ID). If you click on a question you should see some options underneath the question text:
link|edit|close|flag
(You may not see edit or close if you are a new user as I think these require some "reputation" to be enabled).
Clicking on "close" or "flag" is supposed to pop up a dialog asking for the close / flag reason to be selected from radio buttons. This works fine for me in Chrome or if I start Firefox in Safe Mode, but not if I start Firefox normally (even if I disable all plug ins and extensions manually).
I asked about this on Meta Stack Overflow (my question is here: http://meta.stackoverflow.com/questions/106405/close-link-doesnt-work-for-me ) but they were unable to help beyond "it's probably one of your browser settings". I've looked through all the settings under Tools -> Options and can't see anything odd.
I actually have a similar issue on an internal work web server which displays pop ups OK but they have no text in them. I can't point you at this as it's inside our firewall but I am hopeful that the resolution to the first issue will also resolve the second :-)I have now solved this issue.
I had a "userContent.css" file in %APP_DATA%\Mozilla\Firefox\Profiles\y06a2da6.default\chrome\userContent.css
which contained some pop up blocking code for iframes incorporating various strings such as "/ad", "/banner", "/splash" etc.
It looks as though the "close" dialog on StackOverflow was somehow getting caught in this. I've removed the userContent.css file and it now all works fine. -
How to get rid or pop-ups like mackeeper
I continue to get pop-ups like mackeeper and others almost every time I log in. also words are highlighted in the text of websites such as Apple and others.
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
Pop-Ups ALWAYS opening new tabs in Safari 8.0
I was recently helping my boyfriend and had downloaded "unsafe" downloads onto my MacBook Pro Mid 2012 on Safari 8.0 and directly after downloading these links there are continuous pop ups showing up that are opening new tabs and they usually pertain to what I am looking up. Such as when I was logging into Apple Support MacKeeper and other various websites for virus protecting programs pop up. Also my home page is changed to a different site (the name is something along the lines of "Only" and their home page looks JUST LIKE Googles). Pop ups are happening ALL the time and it's getting very frustrating. I downloaded MacKeeper awhile back but I believe I was successfully able to uninstall it. Even when I am clicking on a link on Google or I accidentally tap my mouse pad and it clicks on my current website a pop up opens a new tab. I have cleared my caches, history, and cookies. My firewall, firevault, and all other precautions are turned on. What can I do to fix this problem I am having? ANY help would be GREATLY appreciated!! Thank you in advance (:
Ok, here are my results. I hope I deleted all pertinent information.
Start time: 15:23:29 11/14/14
Model Identifier: MacBookPro9,2
System Version: OS X 10.10 (14A389)
Kernel Version: Darwin 14.0.0
Time since boot: 1 day4:41
SATA
- S.M.A.R.T. status: Not Supported
Diagnostic reports
2014-11-11 PluginProcess crash x20
2014-11-11 com.apple.WebKit.Networking crash
2014-11-11 java crash
2014-11-13 DivX Player crash x3
Log
Nov 13 00:24:45 wl0: Beacon Loss Event, last RSSI[-63]
Nov 13 04:56:11 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
Nov 13 04:56:11 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
Nov 13 04:56:11 com.apple.WebKit.Networking.UUID: Service exited with abnormal code: 1
Nov 13 09:07:49 process DesktopServicesH[1678] thread 277760 caught burning CPU! It used more than 50% CPU (Actual recent usage: 88%) over 180 seconds. thread lifetime cpu usage 90.026410 seconds, (0.077722 user, 89.948688 system) ledger info: balance: 90000928450 credit: 90000928450 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 102252795370
Nov 13 10:52:36 process DesktopServicesH[359] thread 5568 caught burning CPU! It used more than 50% CPU (Actual recent usage: 60%) over 180 seconds. thread lifetime cpu usage 90.014004 seconds, (0.172339 user, 89.841665 system) ledger info: balance: 90002549795 credit: 90002549795 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 149443955111
Nov 13 11:50:36 process iTunes[515] thread 18792 caught burning CPU! It used more than 50% CPU (Actual recent usage: 80%) over 180 seconds. thread lifetime cpu usage 91.233813 seconds, (66.228858 user, 25.004955 system) ledger info: balance: 90005860660 credit: 90009683131 debit: 3822471 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 111867856755
Nov 13 23:04:21 PM notification timeout (pid 515, iTunes)
Nov 13 23:04:25 wl0: Beacon Loss Event, last RSSI[-40]
Nov 13 23:34:41 utun_start: ifnet_disable_output returned error 12
Nov 13 23:39:25 USBF: 45335.400 AppleUSBEHCI::Found a transaction which hasn't moved in 5000 milliseconds on bus 0x1d, timing out! (Addr: 7, EP: 2)
Nov 14 02:29:00 process iTunes[1166] caught causing excessive wakeups. Observed wakeups rate (per sec): 347; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 93404
Nov 14 02:30:35 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
Nov 14 02:37:38 process iTunes[1166] thread 452465 caught burning CPU! It used more than 50% CPU (Actual recent usage: 73%) over 180 seconds. thread lifetime cpu usage 549.084149 seconds, (415.644778 user, 133.439371 system) ledger info: balance: 90003772807 credit: 334480047833 debit: 244476275026 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 123203216992
Nov 14 02:49:21 process WindowServer[115] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
Nov 14 03:03:44 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
Nov 14 03:32:41 0 0 dgroot: start - initDevice failed
Nov 14 03:32:43 0 0 AppleUSBCDC: start - initDevice failed
Nov 14 03:32:45 USBF: 57977. 8 The USB Family found a device at port 1 of hub @ 0x1d100000 with a bad USB device descriptor (0x200, 0x0 )
Nov 14 03:32:54 USBF: 57986.116 AppleUSBEHCI::Found a transaction which hasn't moved in 5000 milliseconds on bus 0x1d, timing out! (Addr: 0, EP: 0)
Nov 14 05:04:48 com.apple.WebKit.Networking.UUID: Service exited with abnormal code: 1
Nov 14 14:04:03 com.apple.WebKit.Networking.UUID: Service exited with abnormal code: 1
Nov 14 14:04:03 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
Nov 14 14:05:08 AppleKeyStore: operation failed (pid: 196 sel: 15 ret: e00002ce)
Nov 14 15:08:19 process DesktopServicesH[2009] thread 578059 caught burning CPU!; EXC_RESOURCE supressed due to audio playback
Activity
CPU: user 0%, system 25%
CPU per process: DesktopServicesH (UID 0) is using 100 %
I/O per process: coresymbolicati (UID 0) is using 15 MB/s
Daemons
com.apple.installer.osmessagetracing
Agents
com.genieo.completer.ltvbit
com.apple.PTPCamera.4008.UUID
com.adobe.ARM.UUID
com.genieo.completer.download
com.appgeneration.iTunerOSxFreeHelper
com.genieo.completer.update
com.coupons.coupond
com.oracle.java.Java-Updater
com.apple.FolderActions.folders
com.spotify.webhelper
com.zeobit.MacKeeper.Helper
com.divx.update.agent
com.apple.AirPortBaseStationAgent
com.apple.FolderActions.enabled
com.divx.dms.agent
Bundles
/System/Library/Extensions/BJUSBMP.kext
- jp.co.canon.bj.kext.BJUSBMP
/System/Library/Extensions/heimdall.kext
- au.com.glassechidna.heimdall_usb_shield
/System/Library/Extensions/JMicronATA.kext
- com.jmicron.JMicronATA
/System/Library/Extensions/ssuddrv.kext
- com.devguru.driver.SamsungComposite
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
- com.adobe.acrobat.pdfviewer
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
- com.adobe.acrobat.pdfviewerNPAPI
/Library/Internet Plug-Ins/CouponPrinter-FireFox_v2.plugin
- com.coupons.plugin.mozilla-plugin
/Library/Internet Plug-Ins/CouponPrinterPluginMac1.0.0.7.plugin
- com.CouponPrinterPluginMacLib.CouponPrinterPluginMac
/Library/Internet Plug-Ins/DivX Web Player.plugin
- com.divx.DivXWebPlayer
/Library/Internet Plug-Ins/Flash Player.plugin
- N/A
/Library/Internet Plug-Ins/OVSHelper.plugin
- com.divx.OVSHelper
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
- com.microsoft.sharepoint.browserplugin
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
- com.microsoft.sharepoint.webkitplugin
/Library/Internet Plug-Ins/Silverlight.plugin
- com.microsoft.SilverlightPlugin
/Library/PreferencePanes/Flash Player.prefPane
- com.adobe.flashplayerpreferences
/Library/PreferencePanes/JavaControlPanel.prefPane
- com.oracle.java.JavaControlPanel
Library/Address Book Plug-Ins/SkypeABDialer.bundle
- com.skype.skypeabdialer
Library/Address Book Plug-Ins/SkypeABSMS.bundle
- com.skype.skypeabsms
Library/Address Book Plug-Ins/YMsgrCallABPlugin.bundle
- com.yahoo.YMsgrCallABPlugin
Library/Address Book Plug-Ins/YMsgrMsnABPlugin.bundle
- com.yahoo.YMsgrMsnABPlugin
Library/Address Book Plug-Ins/YMsgrSmsABPlugin.bundle
- com.yahoo.YMsgrSmsABPlugin
Library/Address Book Plug-Ins/YMsgrYimABPlugin.bundle
- com.yahoo.YMsgrYimABPlugin
dylibs
/usr/lib/libimckit.dylib
/usr/lib/libusb-1.0.dylib
Apps
/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app
/Incompatible Software/GenieoExtra.framework/Contents/Resources/Payload.bundle
/Incompatible Software/GenieoExtra.framework/Contents/Frameworks/gen_ext_bundle.framework
/Incompatible Software/GenieoExtra.framework
Contents of /Library/LaunchAgents/com.coupons.coupond.plist (checksum 371175040)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.coupons.coupond</string>
<key>Debug</key>
<true/>
<key>ProgramArguments</key>
<array>
<string>/Library/Application Support/Coupons/coupond</string>
<string>launchd</string>
</array>
<key>Sockets</key>
<dict>
<key>SecondaryListeningSocket</key>
<dict>
<key>SockServiceName</key>
<string>26876</string>
<key>SockNodeName</key>
<string>localhost</string>
<key>SockFamily</key>
<string>IPv4</string>
</dict>
<key>PrimaryListeningSocket</key>
...and 11 more line(s)
Contents of /Library/LaunchAgents/com.divx.dms.agent.plist (checksum 637650676)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.divx.dms.agent</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Application Support/DivX/DivXMediaServer.app/Contents/MacOS/DivXMediaServer</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.divx.update.agent.plist (checksum 3867571547)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.divx.update.agent</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Application Support/DivX/DivXUpdate.app/Contents/MacOS/DivXUpdate</string>
<string>/silent</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>10800</integer>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 1676147703)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.oracle.java.Java-Updater</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
<string>-bgcheck</string>
</array>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>12</integer>
<key>Minute</key>
<integer>40</integer>
<key>Weekday</key>
<integer>1</integer>
</dict>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
</dict>
...and 1 more line(s)
Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (checksum 394026997)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.adobe.ARM.UUID</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>
<string>semi-auto</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>12600</integer>
</dict>
</plist>
Contents of Library/LaunchAgents/com.apple.FolderActions.folders.plist (checksum 1189540302)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.FolderActions.folders</string>
<key>Program</key>
<string>/usr/bin/osascript</string>
<key>ProgramArguments</key>
<array>
<string>osascript</string>
<string>-e</string>
<string>tell application "Folder Actions Dispatcher" to tick</string>
</array>
<key>WatchPaths</key>
<array/>
</dict>
</plist>
Contents of Library/LaunchAgents/com.genieo.completer.download.plist (checksum 3910221569)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.genieo.completer.download</string>
<key>ProgramArguments</key>
<array>
<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>
<string>-trigger</string>
<string>download</string>
<string>-isDev</string>
<string>0</string>
<string>-installVersion</string>
<string>16742</string>
<string>-firstAppId</string>
<string>13730001</string>
</array>
<key>WatchPaths</key>
<array>
<string>/Users/USER/Downloads</string>
</array>
</dict>
</plist>
Contents of Library/LaunchAgents/com.genieo.completer.ltvbit.plist (checksum 2796257317)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.genieo.completer.ltvbit</string>
<key>ProgramArguments</key>
<array>
<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>
<string>-trigger</string>
<string>ltvbit</string>
<string>-isDev</string>
<string>0</string>
<string>-installVersion</string>
<string>16742</string>
<string>-firstAppId</string>
<string>13730001</string>
</array>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>4</integer>
<key>Minute</key>
<integer>51</integer>
</dict>
...and 2 more line(s)
Contents of Library/LaunchAgents/com.genieo.completer.update.plist (checksum 1505112507)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.genieo.completer.update</string>
<key>ProgramArguments</key>
<array>
<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>
<string>-trigger</string>
<string>update</string>
<string>-isDev</string>
<string>0</string>
<string>-installVersion</string>
<string>16742</string>
<string>-firstAppId</string>
<string>13730001</string>
</array>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>4</integer>
<key>Minute</key>
<integer>21</integer>
</dict>
...and 2 more line(s)
Contents of Library/LaunchAgents/com.spotify.webhelper.plist (checksum 3516019301)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.spotify.webhelper</string>
<key>KeepAlive</key>
<dict>
<key>NetworkState</key>
<true/>
</dict>
<key>RunAtLoad</key>
<true/>
<key>Program</key>
<string>/Users/USER/Library/Application Support/Spotify/SpotifyWebHelper</string>
<key>SpotifyPath</key>
<string>/Applications/Spotify.app</string></dict>
</plist>
Contents of Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist (checksum 4085373812)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Disabled</key>
<false/>
<key>EnvironmentVariables</key>
<dict>
<key>ZBTimeStamp</key>
<string>20140808195320</string>
</dict>
<key>Label</key>
<string>com.zeobit.MacKeeper.Helper</string>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>OnDemand</key>
<false/>
<key>Program</key>
<string>/Applications/MacKeeper.app/Contents/Resources/MacKeeper Helper.app/Contents/MacOS/MacKeeper Helper</string>
</dict>
</plist>
Bad plists
/Library/Preferences/com.gen.framework.plist
Library/Preferences/com.apple.WebFoundation.plist
Firewall: On
Restricted files: 61677
Lockfiles: 14
Elapsed time (s): 508
I print coupons fairly often... ha but if i need to delete those plug ins I am willing to. What's next?
Oh ans by the way thank you so much for helping me!! I'm so grateful!! (:
PS. I let my boyfriend barrow my computer last night so he could restore his iphone but it looks like he tried to download a few things and was successful at downloading more plug ins for me... Not so great. I've been trying to get rid of genieo forever now aand he reinstalled it again. Looks like I'm the only one using this from now on! -
I constantly have pop-ups on my iMac OS X 10.9.4, even though I blocked pop-ups.
I constantly have pop-ups on my iMac OS X 10.9.4. I blocked pop-ups and reset Safari.
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p) if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|(Bo|PO).+ sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' '" L*/P*/*loginit*' 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,Inter,iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 35 49 61 51;D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D13 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p) if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|(Bo|PO).+ sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' '" L*/P*/*loginit*' 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,Inter,iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 35 49 61 51;D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D13 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p) if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|(Bo|PO).+ sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' '" L*/P*/*loginit*' 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,Inter,iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 35 49 61 51;D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D13 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&- -
Pop Ups still happening after security settings set - HELP!!!
We have a Mac OS-X 10.7.5. I am having pop ups EVERY time I log into Safari even after I've checked "block pop ups" in security in Safari. I've installed Adguard, and now, I will click on a site i want to go to and adguard blocks it, but never opens the page because the malware sites like "mackeeper" are jumping in before the real site is opened. This is getting crazy. And a pornographic pop up happened and I have kids. Thank God it was me on here when it popped up. Something somehow has gotten into this computer. So. My question I guess is, can I uninstall Safari and install Firefox or something else and have this not happen anymore? Or uninstall Safari and re-install?? Thanks so much for any help. This is really awful.
First, you do not need to download unknown software to solve this problem.
You may have installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
Hi,
I have a MacBook Air bought on January 2014. it has the Mavericks operating system.
Since yesterday I can really surf the internet because everytime I open a Facebook, Youtube or Google page the page gets redirected to a FlashPLayer-Update Page, and a lot of pop ups appear. The message is "WARNING! Your Flash Player may be out of date. Please update to continue". I've read about the flashback trojan, but Mavericks isn't supposed to have problems with that. From what I read, the problem was fixex last year.
Do you have any ideas of what could be wrong?
It really is starting to get on my nerves... i cant do anything!!
Thank you so much for your help...
PS: sorry for the writing mistakes, if any. (english is not my native language).1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) on the advice of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed:
Copy a line of text in this window to the Clipboard.
Paste into the window of another application.
Wait for the test to run. It usually takes a few minutes.
Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; AC="com.autodesk.AutoCAD com.evenflow.dropbox com.google.GoogleDrive"; H='^[[:space:]]*((127\.0\.0\.1|::1|fe80::1%lo0)[[:space:]]+local|(255\.){3}255[[:space:]]*broadcast)host[[:space:]]*$'; NS=networksetup; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; AT () { o=`file -b "$1" | egrep -v '^(A.{16}t$|cann)'`; Ps "${1##*/} format"; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"[$((l-25)) more line(s)]"; Pm "$1"; AT "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/(\/Users\/)[^/]+/\1-/g' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed -n 's/^ *//;5p;6p;8p'; h=(`SP Hardware | awk '/ Id/{print $3}; /Mem/{print $2}'`); o=$h; Ps "Model"; o=$((h[1]<4?h[1]:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^O]|x([^08]|0[^2]|8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/{s/^.*://p;}' <<< "$p"`; Ps "Battery condition"; for b in FireWire Thunderbolt USB; do o=`SP $b | sed -En '/:$/{s/ *:$//;x;s/\n//;/Apple|SMSC/d;s/\n.*//;/\)/p;};/^ *(V.+ [0N]|Man).+ /{s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;}'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; fdesetup status | grep -q On && o=on || o=; Ps "FileVault"; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && f="$f *"; echo "$d ${f%%_2*} ${f##*.}"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; grep -lq '*$' <<< "$o" && printf $'\n\t* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'caug|GPU |hfs: Ru|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN' -k Message Ane 'SMC:' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | awk 'NR>1 && !/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|openld|post[fg]|x)/{print $3}'`; Pm "Extrinsic daemons"; o=`launchctl list | awk 'NR>1 && !/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | egrep -v 'com\.apple\.(CSConfig|server)' | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/StartupItems; do M; done`; Pm "Startup items"; sys=`pkgutil --regexp --only-files --files com.apple.pkg.* | sort | uniq | sed 's:^:/:'`; b=`sed -E '/^.+Lib.+\/Contents\/Info.plist$/!d;s/\/Info.plist$//;/Contents\/./d' <<< "$sys"`; l=`egrep '^/usr/lib/.+dylib$' <<< "$sys"`; [[ "$b" && "$l" ]] && { o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | grep -Fv "$b" | while read d; do test -f "$d/Info.plist" || continue; ID=$($PB\ :CFBundleIdentifier "$_") || ID="No bundle ID"; printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; o=`find /usr/lib -type f -name *.dylib | grep -Fv "$l"`; Pm "Extrinsic shared libraries"; :; } || echo $'\nReceipts missing'; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Inserted dylibs"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; i=`route -n get default | awk '/e:/{print $2}'`; I=`$NS -listnetworkserviceorder | sed -En '/ '$i'\)$/{x;s/^\(.+\) //p;q;};x'`; n=`$NS -getdnsservers "$I" | awk '!/^T/{printf "not "; exit}'`; Ps "DNS (${n}from DHCP)"; o=`$NS -getinfo "$I" | awk '/k:/{if ($3 !~ "(255\.){3}0") print}; /v6:/{if ($2 !~ "A") print}'`; Pm "TCP/IP"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; f=/etc/hosts; Pc "hosts" <(egrep -v "$H" $f ); AT $f; Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; LD="$(`find /S*/*/F* -type f -name lsregister | head -n1` -dump)"; o=`for ID in $AC; do [[ "$LD" =~ $ID ]] && echo $ID; done`; Pm "Application check"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \) | wc -l`; Ps "Restricted user files"; cd; o=`find .??* -type d -name *.app -prune`; Pm "Hidden apps"; o=`SP Fonts | egrep 'id: N|te: Y' | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps "UID"; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-
Copy the selected text to the Clipboard by pressing the key combination command-C.
7. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste (command-V). The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "syntax error," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Terms of Use of the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.
Maybe you are looking for
-
My account was closed or disabled recently, I believe from ID theft, I would like to restablish the account or another one.
-
Dumb question #1, how do you save pictures from a webpage?
sorry, but i'm a an x-pc owner and all you had to do is right click on an image and choose save. i'm hoping there's as easy a way to do this with my mac. all i've been able to do is save the whole page. any help would be greatly appreciated, Chris
-
Do I need to cancel the selection key when I close it's socket channel?
I have a non blocking server implementation and I need to know is it mandatory to call SelectionKey#cancel after I have called the SocketChannel#close to it's channel? When I close the channel, will it cancel the key automatically or what if I don't
-
Publishing Causes Modem to Crash
I have a client that I'm trying to set up with inContext Editing. He is hosting his own website and so I connect via FTP to his webserver. When I edit the website in Dreamweaver, I can connect and upload changes without any problems. The same can be
-
Starting slow... Basic installation and configuration
Let me preface by saying that I took the AM class last year about this time... Between the class materials and the online documentation, though, I'm finding that there isn't a single clear and concise "getting started" document out there. There are a