Strange blank disk mounting pop-ups on Finder
Hi,
Lately, i've been getting strange blank pop-ups in Finder with just title of the windows being Google Chrome or Adobe Flash Player (after i uninstalled Google Chrome and started using Safari).
When i check Disk Utility, i can see that a Google Chrome disk image is mounted or Adobe Flash Player disk image mounted (as the case may be). I've also been having problems with installing Adobe Flash Player 11. It gives me a no mountable disk system error even though i've tried downloading the file many times and am quite sure its not a problem with the .dmg
I have a late 2012 Mac Mini running 10.8.2 OSX on a Fusion Drive that i created on my own with the stock Apple 1TB HDD and a 256GB Samsung Pro 840 SSD. I've migrated my apps and data from a 2007 Macbook running Snow Leopard.
Anyone has any ideas on what could have gone wrong?
Thanks!
Bootup holding CMD+r, or the Option/alt key to boot from the Restore partition & use Disk Utility from there to Repair the Disk, then Repair Permissions.
One way to test is to Safe Boot from the HD, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, Test for problem in Safe Mode...
PS. Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive
Reboot, test again.
If it only does it in Regular Boot, then it could be some hardware problem like Video card, (Quartz is turned off in Safe Mode), or Airport, or some USB or Firewire device, or 3rd party add-on, Check System Preferences>Accounts (Users & Groups in later OSX versions)>Login Items window to see if it or something relevant is listed.
Check the System Preferences>Other Row, for 3rd party Pref Panes.
Also look in these if they exist, some are invisible...
/private/var/run/StartupItems
/Library/StartupItems
/System/Library/StartupItems
/System/Library/LaunchDaemons
/Library/LaunchDaemons
Similar Messages
-
Flash Pop-Ups Showing Blank... but only for one user! OS X
Hello,
I am absolutely at my wits end with this one. Here are my specs
My Player Version: MAC 10,1,53,64
Operating System: Mac OS 10.6.3 (Snow Leopard)
Browsers: Safari 5.0, Firefox, Chrome -- same error on all browsers
About a month ago, I noticed some strange behavior with Flash on certain sites -- namely that when I hovered over something that would create a flash pop-up (like the graphs in Google Analytics), the box would pop-up, but it would be empty -- no text, just the blank colored box. Movies played fine, other aspects of Flash played fine, just the pop-ups were broken. This was cross-browser --- didn't matter if I used Safari, Firefox or Chrome -- same broken pop-ups. Since then, I've noticed other things that don't work -- like the Adobe Privacy Settings box! The checkboxes are visible in the settings box, but no text!
As it keeps me from using Google Analytics and other important online apps, this has made me very sad.
What's strange, though, is that it only seems to affect the main user account on my Mac -- when I try to access these sites with my Guest account, everything works perfectly. Baffling.
Here is what I've done to try to troubleshoot it:
Used the Adobe Uninstaller to Uninstall Flash - no errors
Repaired permissions
Installed a fresh copy of Flash Player 10.1 - no errors
I've done this several times, trying restarts and other refreshes in between -- doesn't fix it
I went on a hunt for everything named Macromedia and Flash in my Account and trashed it. Uninstalled Flash CS4. Uninstalled Adobe Air. Used the Adobe Uninstaller again. Repaired permissions again. Restarted again. Reinstalled Flash Player again.
No dice.
I have no idea what to do next. This is driving me crazy. Please, someone, HELP!Hi NorwichUK,
welcome to this fourm
... hmm, the iM version before iM5 did make folders instead of "solid files"/packages....
tell spotlight//apple-f, to list all "iMovie" files... probably, there is somewhere a "hiddin version" iM4 on your disk...? -
Is it possible to share a Mounted Blank Disk Image using WebDav?
I am trying to find a good solution to give individuals the ability to change files in there hosted websites on the Mac Mini Server (10.6.4), but also having a limited folder size. I have seen a few post on using Blank Disk Image as the share folder. I have created the folder and I can see it contents using a WebDav client, but no matter what permissions I put, anytime I try to upload or delete a file from the image I get a 403 error, saying "Forbidden". I can get the WebDav to work on normal shared folders, so I am wondering if it is even possible to share a mounted blank image using WebDav?
It seems if I make an MS-DOS(FAT) image, I can actually make changes to this image file using WebDav, but I cant see how to changer the permissions of the folder. All the methods I have tried do not actually seem to change the file permissions, they default to read and write for everyone.
I am trying to figure out if I am trying to get something to work that is not even possible. I need to be able to limit the size of a folder, share it with specific groups/users in the Open Directory. It also has to be viewable on both Windows and Mac Systems. FTP does not seem to work, since it gives access to the root. I want to be able to have a student/student group post to a wiki, have a website for there project, but they should only have access to this image....
Does anyone know if you can share a mounted image through WebDav, or if there is another way I can setup multiple folders and have websites point to this folder and give only selected users access to the folder for uploading and sharing files?
Any guidance would be greatly appreciated -
Something was hidden in a download and now these double green underlined hyperlinks show up everywhere, and pop ups too whenever I click on ANYTHING. I can't figure out how to find it and get rid of it.
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised the value of Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
How do i get rid of price finder pop ups on my mac?
I am getting price finder pop ups every time in shopping on line or even just browsing the web. Does any body know how to get rid of the price finder pop ups?
Try this: http://www.thesafemac.com/arg/
This is because you installed recently a third party software, please don't install third party software unless you are absolutely sure of its origins and how to get rid of them. Remember, Macs are not inmune to virus, specially adwares -
I have a new iPad and am trying to open my Uni website. I have allowed pop ups but it just opens a new blank page. I'm using a sim not wifi, would this have anything to do with it?
Thanks again ...
This trouble is fairly new as I just got my MacBook Pro. It's been going on for 2 weeks or so. Prior to the MacBook I was using my old PC laptop and never had any difficulty.
Nobody else seems to be having this problem at school and IT is completely unhelpful. I've been told that nothing's wrong with the uni's internet/network, it's my laptop.
Could it be that the uni's network doesn't recognize my new Mac's IP address (I think that's right) and for some reason is blocking access?
As for the VPN idea - I think I get it. Can I set that up myself? -
Can't find the way to prevent pop ups
Can't get to the options tab to control pop ups. Advertising messages etc just keep appearing unsolicited.
Do a malware check with some malware scanning programs on the Windows computer.<br>
Please scan with all programs because each program detects different malware.<br>
All these programs have free versions.
Make sure that you update each program to get the latest version of their databases before doing a scan.
*Malwarebytes' Anti-Malware:<br>http://www.malwarebytes.org/mbam.php
*AdwCleaner:<br>http://www.bleepingcomputer.com/download/adwcleaner/<br>http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
*SuperAntispyware:<br>http://www.superantispyware.com/
*Microsoft Safety Scanner:<br>http://www.microsoft.com/security/scanner/en-us/default.aspx
*Windows Defender: Home Page:<br>http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
*Spybot Search & Destroy:<br>http://www.safer-networking.org/en/index.html
*Kasperky Free Security Scan:<br>http://www.kaspersky.com/security-scan
You can also do a check for a rootkit infection with TDSSKiller.
*Anti-rootkit utility TDSSKiller:<br>http://support.kaspersky.com/5350?el=88446
See also:
*"Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked -
Adware pop ups and redirects to strange websites....
I have the 10.9.3 software on my mac. I recently downloaded the adware removal tool from thesafemac because I had a bunch of pop ups and redirects in safari. Here are a few examples of whats popping up: mackeeperapp2.zeobit.com & unizz.exclusiverewards.dollfield.eu
It also started affecting both my wife’s and my iPhones 5s and ipad air in safari - lots of redirects and taking me to the App Store…
Any idea how to move forward with this?There are two possibilities: either the router has been hacked to direct DNS queries to a malicious server, or it's using the right DNS servers, but those servers have been hacked. The first possibility is more likely.
Follow the manufacturer's instructions to reset the router to the default state. Usually that involves inserting the end of a straightened paper clip or a similar tool into a pinhole somewhere in the back of the device, and pressing a switch inside for about 15 seconds. The pinhole may be marked "RESET."
Repeat the initial setup process. Make sure the router does not allow remote setup from the Internet (WAN port), if it has that feature—most do. The DNS servers should be set automatically by your ISP. If you still have trouble with those servers selected, contact your ISP.
Another option, if your ISP fails to secure its servers promptly, is to use an alternative DNS service such as Google DNS or OpenDNS. I don't recommend either one. Don't believe the marketing hype about OpenDNS, in particular. There are no advantages to using it if your ISP is delivering the service you pay for.
If you have a wireless network, it must be secured with WPA 2 encryption. The passwords for the network and the router must each be a string of at least 10 random upper- and lower-case letters and digits, and they should be different. Any password that you can remember is weak. -
Pop-ups in certain sites, can't contain the problem:
Hi!! I would like to submit a problem to the apple community. When I open certain websites, i get redirected to another web site, 'adultyum.info' containing adult material. This is really really annoying. I've got AdBlock Plus both on Chrome and Safari. But i'm only being redirected when using Safari. In Chrome, I haven't experienced the problem so far. CLAMXAV and ADWAREMEDIC both did not detect any problem. Please please do help.. I also tried changing router, and I still experienced it on Safari..
So i have several questions:
1) What is the solution to this problem?
2) Is this dangerous? Does it maybe steal private information like passwords or surfing habits?
I saw this discussion: Unwanted pop-up: unusual problem
And I performed a diagnostic test too. The results are as follows:
Start time: 10:57:10 03/24/15
Revision: 1241
Model Identifier: MacBookPro8,1
System Version: OS X 10.10.2 (14C1514)
Kernel Version: Darwin 14.1.0
Time since boot: 3:33
UID: 501
SerialATA
ST9500325ASG
Activity
CPU: user 15%, system 4%
CPU usage (%)
clamscan (UID 501): 25.0
I/O wait time (ms/s)
Google Chrome (UID 501): 12
I/O requests (KiB/s)
clamscan (UID 501): 14698
Firewall: On
Listeners
cupsd: ipp
kdc: kerberos
launchd: afpovertcp
launchd: microsoft-ds
System caches/logs
3155 MB: /System/Library/Caches/com.apple.coresymbolicationd/data
Diagnostic reports
2015-02-24 VLC crash x3
2015-02-24 com.apple.AmbientDisplayAgent crash
2015-02-25 VLC crash
2015-03-02 com.apple.AmbientDisplayAgent crash
2015-03-02 fontd crash
2015-03-04 Finder hang
2015-03-04 VLC hang
2015-03-12 com.apple.internetaccounts crash
2015-03-12 taskgated crash
2015-03-17 VLC crash
2015-03-24 Finder crash
System log
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:32 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:33 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:33 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:51:52 Google Chrome Helper CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server
Mar 24 10:57:59 WindowServer disable_update_timeout: UI updates were forcibly disabled by application "ClamXav" for over 1.00 seconds. Server has re-enabled them.
Console log
Mar 23 08:12:06 nsurlstoraged The read-connection to the DB=/Users/USER/Library/Caches/qlmanage/Cache.db is NOT valid. Unable to determine schema version.
Mar 23 08:12:06 nsurlstoraged Process 327 does not have access to path /Users/USER/Library/Caches/qlmanage/Cache.db
Mar 23 08:12:06 nsurlstoraged Process 327 does not have access to path /Users/USER/Library/Caches/qlmanage/Cache.db
Mar 23 10:54:56 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 23 10:55:22 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 23 11:05:15 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 11:42:56 ReportCrash Invoking spindump for pid=1209 wakeups_rate=163 duration=277 because of excessive wakeups
Mar 23 17:02:09 ReportCrash Invoking spindump for pid=1061 wakeups_rate=194 duration=232 because of excessive wakeups
Mar 23 18:06:59 ReportCrash Invoking spindump for pid=1145 wakeups_rate=412 duration=110 because of excessive wakeups
Mar 23 18:16:43 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 18:16:52 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 18:36:40 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 23 18:36:56 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:42:22 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:42:24 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:54:55 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 07:56:54 nsurlstoraged ERROR: unable to get the receiver data from the DB!
Mar 24 08:14:52 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 08:40:17 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 09:07:02 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 10:31:32 nsurlstoraged asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/mh/2bg30cpd1rg0t87v4zkf8gsw0000gn/T/fsCachedData_remove. Errno=2
Mar 24 10:40:30 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 24 10:41:05 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 24 10:41:16 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Mar 24 10:41:28 nsurlstoraged Error: execSQLStatement:onConnection:toCompletionWithRetry - SQL=COMMIT;, error-code=1, error-message=cannot commit - no transaction is active
Loaded kernel extensions
com.rim.driver.BlackBerryUSBDriverInt (0.0.74)
com.squirrels.airparrot.framebuffer (3)
com.squirrels.driver.AirParrotSpeakers (1.8)
com.wavtap.driver.WavTap (0.4.0)
Daemons
com.apple.Kerberos.kdc
- status: 1
com.apple.awdd
com.apple.ctkd
com.apple.icloud.findmydeviced
com.apple.iconservices.iconservicesagent
com.apple.ifdreader
com.apple.installer.osmessagetracing
com.apple.secinitd
com.apple.watchdogd
com.apple.wdhelper
com.microsoft.office.licensing.helper
com.oracle.java.Helper-Tool
com.oracle.java.JavaUpdateHelper
com.rim.BBDaemon
Agents
com.adobe.ARM.UUID
com.adobe.CS5ServiceManager
com.apple.AirPortBaseStationAgent
com.apple.Finder
- status: -11
com.google.keystone.user.agent
com.hp.devicemonitor
com.hp.messagecenter.launcher
com.oracle.java.Java-Updater
com.paragon.ntfs.trial
com.paragon.ntfs.upd
com.rim.BBLaunchAgent
com.rim.RimAlbumArtDaemon
net.culater.SIMBL.Agent
org.glimmerblocker.updater
User overrides
com.adobe.AAM.Scheduler-1.0
com.marketcircle.BPSyncHelper
com.fiplab.MenuTabHelper
com.spotify.webhelper
Startup items
/Library/StartupItems/HWNetMgr/HWNetCfg
/Library/StartupItems/HWNetMgr/HWNetMgr
/Library/StartupItems/HWNetMgr/StartupParameters.plist
/Library/StartupItems/HWPortDetect/HWPortCfg
/Library/StartupItems/HWPortDetect/HWPortDetect
/Library/StartupItems/HWPortDetect/StartupParameters.plist
User login items
Android File Transfer Agent
- /Users/USER/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app
Safari extensions
Adblock Plus
- org.adblockplus.adblockplussafari
iCloud errors
bird 38
CallHistorySyncHelper 13
Continuity errors
sharingd 3
Restricted files: 51
Lockfiles: 157
Contents of /Library/LaunchAgents/com.hp.devicemonitor.plist
- mod date: May 27 04:04:05 2012
- checksum: 77374180
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Program</key>
<string>/Library/Printers/hp/hpio/HP Device Monitor.app/Contents/MacOS/HP Device Monitor</string>
<key>Label</key>
<string>com.hp.devicemonitor</string>
<key>KeepAlive</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.hp.messagecenter.launcher.plist
- mod date: Jan 19 20:58:23 2010
- checksum: 3424434743
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.hp.messagecenter.launcher</string>
<key>Program</key>
<string>/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks /LaunchServices.framework/Versions/A/Support/lsregister</string>
<key>ProgramArguments</key>
<array>
<string>-lazy</string>
<string>30</string>
<string>/Library/Printers/hp/Utilities/HPPU Plugins/Message Center.task/Contents/Resources/HPMessageCenterBridge.app</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
- mod date: Dec 11 08:53:58 2013
- checksum: 142207891
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.oracle.java.Java-Updater</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
<string>-bgcheck</string>
</array>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>15</integer>
<key>Minute</key>
<integer>24</integer>
<key>Weekday</key>
<integer>3</integer>
</dict>
</dict>
...and 1 more line(s)
Contents of /Library/LaunchAgents/com.rim.BBAlbumArtCacher.plist
- mod date: Feb 9 06:31:27 2012
- checksum: 2868431736
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.rim.RimAlbumArtDaemon</string>
<key>OnDemand</key>
<false/>
<key>Program</key>
<string>/Library/Application Support/BlackBerry/RimAlbumArtDaemon</string>
<key>ProgramArguments</key>
<array>
<string>RimAlbumArtDaemon</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.rim.BBLaunchAgent.plist
- mod date: Feb 9 06:31:28 2012
- checksum: 908705504
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.rim.BBLaunchAgent</string>
<key>OnDemand</key>
<false/>
<key>Program</key>
<string>/Library/Application Support/BlackBerry/BBLaunchAgent.app</string>
<key>ProgramArguments</key>
<array>
<string>BBLaunchAgent</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Contents of /Library/LaunchAgents/net.culater.SIMBL.Agent.plist
- mod date: Dec 24 13:02:52 2013
- checksum: 1107421619
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>net.culater.SIMBL.Agent</string>
<key>Program</key>
<string>/Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent</string>
<key>RunAtLoad</key>
<false/>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>OnDemand</key>
<false/>
</dict>
</plist>
Contents of /Library/LaunchAgents/org.glimmerblocker.updater.plist
- mod date: Dec 24 12:31:49 2013
- checksum: 4132589395
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE plist PUBLIC '-//Apple Computer//DTD PLIST 1.0//EN' 'http://www.apple.com/DTDs/PropertyList-1.0.dtd'>
<plist version='1.0'>
<dict>
<key>Disabled</key>
<false/>
<key>Label</key>
<string>org.glimmerblocker.updater</string>
<key>InitGroups</key>
<true/>
<key>ProgramArguments</key>
<array>
<string>/Library/PreferencePanes/GlimmerBlocker.prefPane/Contents/GlimmerBlocke rUpdater.app/Contents/MacOS/GlimmerBlockerUpdater</string>
<string>--background</string>
</array>
<key>Umask</key>
<integer>18</integer>
<key>StartInterval</key>
<integer>86400</integer>
<key>KeepAlive</key>
<false/>
<key>WorkingDirectory</key>
<string>/Library/PreferencePanes/GlimmerBlocker.prefPane/Contents/GlimmerBlocke rUpdater.app/Contents/Resources</string>
<key>StandardErrorPath</key>
<string>/Library/Logs/GlimmerBlocker/Launchd.log</string>
...and 2 more line(s)
Contents of /Library/LaunchDaemons/com.rim.BBDaemon.plist
- mod date: Feb 9 06:31:28 2012
- checksum: 4059782046
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN
http://www.apple.com/DTDs/PropertyList-1.0.dtd >
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.rim.BBDaemon</string>
<key>Program</key>
<string>/Library/Application Support/BlackBerry/BBDaemon</string>
<key>ProgramArguments</key>
<array>
<string>BBDaemon</string>
</array>
<key>KeepAlive</key>
<true/>
<key>OnDemand</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>Sockets</key>
<dict>
<key>Listeners</key>
<dict>
<key>SockType</key>
<string>stream</string>
...and 8 more line(s)
Contents of /System/Library/LaunchAgents/com.paragon.NTFS.trial.plist
- mod date: May 5 18:01:50 2011
- checksum: 3466880614
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.paragon.ntfs.trial</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Application Support/Paragon NTFS for Mac OS X/NTFS for Mac OS X.app/Contents/MacOS/NTFS for Mac OS X</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
</dict>
</plist>
Contents of /System/Library/LaunchAgents/com.paragon.NTFS.upd.plist
- mod date: May 5 18:01:50 2011
- checksum: 1029391047
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.paragon.ntfs.upd</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/Paragon NTFS for Mac OS X/ParagonUpdateChecker.app/Contents/MacOS/ParagonUpdateChecker</string>
<string>service</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
</dict>
</plist>
Contents of /System/Library/Security/authorization.plist
- mod date: Oct 9 17:17:00 2014
- checksum: 2720110640
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>comment</key>
<string>The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction.
allow rule: this is always allowed
<key>com.apple.TestApp.benign</key>
<string>allow</string>
deny rule: this is always denied
<key>com.apple.TestApp.dangerous</key>
<string>deny</string>
user rule: successful authentication as a user in the specified group(5) allows the associated right.
The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified.
The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule.
The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified.
See remaining rules for examples.
</string>
<key>rights</key>
<dict>
<key></key>
<dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
...and 1850 more line(s)
Contents of /private/etc/authorization.deprecated
- mod date: Oct 9 12:30:47 2013
- checksum: 1982440893
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>comment</key>
<string>The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction.
allow rule: this is always allowed
<key>com.apple.TestApp.benign</key>
<string>allow</string>
deny rule: this is always denied
<key>com.apple.TestApp.dangerous</key>
<string>deny</string>
user rule: successful authentication as a user in the specified group(5) allows the associated right.
The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified.
The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule.
The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified.
See remaining rules for examples.
</string>
<key>rights</key>
<dict>
<key></key>
<dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
...and 9717 more line(s)
Contents of /private/etc/hosts
- mod date: Dec 14 13:17:51 2011
- checksum: 2498082492
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 hl2rcv.adobe.com
255.255.255.255 broadcasthost
::1 localhost
fe80::1%lo0 localhost
Contents of /private/etc/pam.d/prl_disp_service
- mod date: Sep 8 19:03:17 2010
- checksum: 1160556194
auth required pam_nologin.so
auth optional pam_afpmount.so
auth sufficient pam_securityserver.so nullok
auth sufficient pam_unix.so nullok
auth required pam_deny.so
account required pam_permit.so
password required pam_deny.so
session required pam_permit.so
session optional pam_afpmount.so
Contents of /private/etc/pam.d/prl_disp_service.snow_leopard
- mod date: Sep 8 19:03:17 2010
- checksum: 1656795023
auth optional pam_mount.so
auth sufficient pam_serialnumber.so serverinstall legacy
auth required pam_opendirectory.so nullok
account required pam_nologin.so
account required pam_opendirectory.so
password required pam_deny.so
session required pam_launchd.so
session required pam_uwtmp.so
session optional pam_mount.so
Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist
- mod date: Dec 6 17:02:32 2011
- checksum: 408149527
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.adobe.ARM.UUID</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>12600</integer>
</dict>
</plist>
Contents of Library/LaunchAgents/com.google.keystone.agent.plist
- mod date: Mar 4 08:33:04 2015
- checksum: 2825338244
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.google.keystone.user.agent</string>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>ProgramArguments</key>
<array>
<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>
<string>-runMode</string>
<string>ifneeded</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>3523</integer>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
</dict>
</plist>
Extensions
/Library/Extensions/APExtFramebuffer.kext
- com.squirrels.airparrot.framebuffer
/Library/Extensions/AirParrotDriver.kext
- com.squirrels.driver.AirParrotSpeakers
/System/Library/Extensions/APExtFramebuffer.kext
- com.squirrels.airparrot.framebuffer
/System/Library/Extensions/AirParrotDriver.kext
- com.squirrels.driver.AirParrotSpeakers
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardACMControl.kext
- com.huawei.driver.HuaweiDataCardACMControl
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardACMData.kext
- com.huawei.driver.HuaweiDataCardACMData
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardActivateDriver.kext
- com.huawei.driver.HuaweiDataCardActivateDriver
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardECMControl.kext
- com.huawei.driver.HuaweiDataCardECMControl
/System/Library/Extensions/HuaweiDataCardDriver.kext/Contents/PlugIns/HuaweiDat aCardECMData.kext
- com.huawei.driver.HuaweiDataCardECMData
/System/Library/Extensions/HuaweiDataCardDriver.kext
- com.huawei.driver.HuaweiDataCardDriver
/System/Library/Extensions/JMicronATA.kext
- com.jmicron.JMicronATA
/System/Library/Extensions/RIMBBUSB.kext
- com.rim.driver.BlackBerryUSBDriverInt
/System/Library/Extensions/RIMBBVSP.kext
- com.rim.driver.BlackBerryUSBDriverVSP
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateDriveIcons.kext
- com.seagate.driver.SeagateDriveIcons
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateLeafPowSecDriver_10_4.kext
- com.seagate.driver.PowSecLeafDriver_10_4
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateLeafPowSecDriver_10_5.kext
- com.seagate.driver.PowSecLeafDriver_10_5
/System/Library/Extensions/Seagate Storage Driver.kext
- com.seagate.driver.PowSecDriverCore
/System/Library/Extensions/USBExpressCardCantWake_Huawei.kext
- com.apple.dts.driver.USBExpressCardCantWake
/System/Library/Extensions/WavTap.kext
- N/A
/System/Library/Extensions/hp_Inkjet8_io_enabler.kext
- com.hp.print.hpio.inkjet8.kext
Applications
/Applications/Adobe Media Player.app
- com.adobe.amp.UUID.1
/Applications/Adobe/Adobe Help.app
- chc.UUID.1
/Applications/AppZapper.app
- com.appzapper.AppZapper
/Applications/ChartNexus.app
- N/A
/Applications/Hewlett-Packard/Device Utilities/HP Firmware Updater.app
- com.hp.FirmwareUpdater
/Applications/Hewlett-Packard/Device Utilities/HP Setup Assistant.app
- com.hp.SetupAssistant
/Applications/Hewlett-Packard/HP Scan 3.app
- com.hp.scan.app
/Applications/Hewlett-Packard/HP Uninstaller.app
- com.hp.Uninstaller
/Applications/MacTubes.app
- jp.MacTubes.MacTubesApp
/Applications/Microsoft Communicator.app
- com.microsoft.Communicator
/Applications/Microsoft Messenger.app
- com.microsoft.Messenger
/Applications/Microsoft Office 2011/Additional Tools/Microsoft Language Register/Microsoft Language Register.app
- com.microsoft.language_register
/Applications/Microsoft Office 2011/Microsoft Document Connection.app
- com.microsoft.DocumentConnection
/Applications/Microsoft Office 2011/Microsoft Excel.app
- com.microsoft.Excel
/Applications/Microsoft Office 2011/Microsoft Outlook.app
- com.microsoft.Outlook
/Applications/Microsoft Office 2011/Microsoft PowerPoint.app
- com.microsoft.Powerpoint
/Applications/Microsoft Office 2011/Microsoft Word.app
- com.microsoft.Word
/Applications/Microsoft Office 2011/Office/Alerts Daemon.app
- com.microsoft.AlertsDaemon
/Applications/Microsoft Office 2011/Office/Equation Editor.app
- com.microsoft.EquationEditor
/Applications/Microsoft Office 2011/Office/Microsoft Chart Converter.app
- com.microsoft.openxml.chart.app
/Applications/Microsoft Office 2011/Office/Microsoft Clip Gallery.app
- com.microsoft.ClipGallery
/Applications/Microsoft Office 2011/Office/Microsoft Database Daemon.app
- com.microsoft.outlook.database_daemon
/Applications/Microsoft Office 2011/Office/Microsoft Database Utility.app
- com.microsoft.outlook.database_utility
/Applications/Microsoft Office 2011/Office/Microsoft Graph.app
- com.microsoft.Graph
/Applications/Microsoft Office 2011/Office/Microsoft Office Reminders.app
- com.microsoft.outlook.office_reminders
/Applications/Microsoft Office 2011/Office/Microsoft Office Setup Assistant.app
- com.microsoft.office.setupassistant
/Applications/Microsoft Office 2011/Office/Microsoft Query
- N/A
/Applications/Microsoft Office 2011/Office/Microsoft Upload Center.app
- com.microsoft.office.uploadcenter
/Applications/Microsoft Office 2011/Office/My Day.app
- com.microsoft.myday
/Applications/Microsoft Office 2011/Office/Open XML for Excel.app
- com.microsoft.openxml.excel.app
/Applications/Microsoft Office 2011/Office/SyncServicesAgent.app
- com.microsoft.SyncServicesAgent
/Applications/OnyX.app
- com.titanium.OnyX
/Applications/Paragon NTFS for Mac OS X/ParagonUpdateChecker.app
- com.yourcompany.ParagonUpdateChecker
/Applications/Paragon NTFS for Mac OS X/Register NTFS for Mac OS X.app
- com.paragon-software.filesystems.ntfs.Register
/Applications/Remote Desktop Connection.app
- com.microsoft.rdc
/Applications/Seagate Dashboard 2.0.app
- com.seagate.dashboard
/Applications/Simple Comic.app
- com.tsst.simplecomic
/Applications/StuffIt Expander.app
- com.stuffit.StuffIt-Expander
/Applications/Utilities/Adobe AIR Application Installer.app
- com.adobe.air.ApplicationInstaller
/Applications/doubleTwist.app
- com.doubleTwist.desktop
/Applications/iFunBox.app
- com.iFunBoxDevTeam.iFunBox
/Incompatible Software/Parallels Service.app
- com.parallels.desktop.dispatcher
/Library/Application Support/Adobe/CS5ServiceManager/CS5ServiceManager.app
- com.adobe.csi.CS5ServiceManager
/Library/Application Support/Adobe/SwitchBoard/SwitchBoard.app
- com.adobe.switchboard-2.0
/Library/Application Support/BlackBerry/BBLaunchAgent.app
- N/A
/Library/Application Support/BlackBerry/BlackBerry Device Manager.app
- com.rim.blackberrydevicemanager
/Library/Application Support/BlackBerry/BlackBerryMobileMediaServer.app
- com.rim.BlackBerryMobileMediaServer
/Library/Application Support/BlackBerry/IPModemPasswordDialog.app
- com.rim.IPModemPasswordHelper
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Add to iPhoto Library.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Email Image.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Email PDF.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Open HP Scan.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Open PDF in Preview.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Open in Preview.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Save PDF in Documents.app
- N/A
/Library/Application Support/Hewlett-Packard/Workflows/Shortcuts/Save in Pictures.app
- N/A
/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app
- com.microsoft.autoupdate2
/Library/Application Support/Microsoft/MERP2.0/Microsoft Error Reporting.app
- com.microsoft.error_reporting
/Library/Application Support/Microsoft/MERP2.0/Microsoft Ship Asserts.app
- com.microsoft.netlib.shipassertprocess
/Library/Application Support/Paragon NTFS for Mac OS X/NTFS for Mac OS X.app
- com.paragon-software.TrialExpiredNotification
/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app
- com.apple.ScriptEditor.id.cocoa-applet-template
/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app
- com.apple.ScriptEditor.id.droplet-with-settable-properties-template
/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app
- com.apple.ScriptEditor.id.file-processing-droplet-template
/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app
- com.apple.ScriptEditor.id.image-file-processing-droplet-template
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR Application Installer.app
- com.adobe.air.ApplicationInstaller
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Template.app
- com.adobe.air.Template
/Library/Image Capture/Devices/HP Scanner 3.app
- com.hp.scanModule3
/Library/Parallels/Parallels Mounter.app
- com.parallels.desktop.mounter
/Library/Parallels/Parallels Transporter.app
- com.parallels.desktop.transporter
/Library/Parallels/Uninstaller/Parallels Hypervisor/DockPlistEdit.app
- com.parallels.DockPlistEdit
/Library/Printers/hp/Frameworks/HPDeviceModel.framework/Versions/4.0/Runtime/hp dot4d.app
- com.hp.devicemodel.hpdot4d
/Library/Printers/hp/Utilities/HP Alerts.app
- com.hp.events.hpalerts
/Library/Printers/hp/Utilities/HP Utility.app
- com.hp.printerutility
/Library/Printers/hp/cups/filters/commandtohp.filter
- com.hp.print.cups.filter.commandtohp
/Library/Printers/hp/cups/filters/pdftopdf.filter
- com.hp.print.cups.filter.pdftopdf
/Library/Printers/hp/cups/tools/autosetup.tool
- com.hp.print.autosetup
/Library/Printers/hp/hpio/HP Device Monitor.app
- com.hp.devicemonitor
/Users/USER/Applications/Chrome Apps.localized/app_list.app
- com.google.Chrome.app.Default-app_list
/Users/USER/Documents/MAC Apps/AirParrot v 1.5.2/Crack/AirParrot Keygen.app
- Linezer0.Lz0-Keygen
/Users/USER/Documents/MAC Apps/AirParrot v 1.5.2/Crack/KG for OS X 10.6/Lz0 Keygen.app
- Linezer0.Lz0-Keygen
/Users/USER/Documents/MAC Apps/Stata 12/Stata.app
- com.stata.stata12
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_aiahmijlpehemcpleichkcokhegllfjl/Default aiahmijlpehemcpleichkcokhegllfjl.app
- com.google.Chrome.app.Default-aiahmijlpehemcpleichkcokhegllfjl-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_aohghmighlieiainnegkcijnfilokake/Default aohghmighlieiainnegkcijnfilokake.app
- com.google.Chrome.app.Default-aohghmighlieiainnegkcijnfilokake-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_apdfllckaahabafndbhieahigkjlhalf/Default apdfllckaahabafndbhieahigkjlhalf.app
- com.google.Chrome.app.Default-apdfllckaahabafndbhieahigkjlhalf-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_blpcfgokakmgnkcojhhkbfbldkacnbeo/Default blpcfgokakmgnkcojhhkbfbldkacnbeo.app
- com.google.Chrome.app.Default-blpcfgokakmgnkcojhhkbfbldkacnbeo-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_gighmmpiobklfepjocnamgkkbiglidom/Default gighmmpiobklfepjocnamgkkbiglidom.app
- com.google.Chrome.app.Default-gighmmpiobklfepjocnamgkkbiglidom-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_nmmhkkegccagdldgiimedpiccmgmieda/Default nmmhkkegccagdldgiimedpiccmgmieda.app
- com.google.Chrome.app.Default-nmmhkkegccagdldgiimedpiccmgmieda-internal
/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_pjkljhegncpnkpknbcohdijeoejaedia/Default pjkljhegncpnkpknbcohdijeoejaedia.app
- com.google.Chrome.app.Default-pjkljhegncpnkpknbcohdijeoejaedia-internal
/usr/local/hw_mobile_userdata/HWSleepNotify.app
- com.huawei.HWSleepNotify
Frameworks
/Library/Frameworks/Adobe AIR.framework
- com.adobe.AIR
/Library/Frameworks/HPSmartPrint.framework
- com.hp.print.HPSmartPrint
/Library/Frameworks/RIM_VSP.framework
- com.rim.vsp
/Library/Frameworks/RimBlackBerryUSB.framework
- com.rim.RimBlackBerryUSB
PrefPane
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.pref Pane
- com.oracle.java.JavaControlPanel
/Library/PreferencePanes/Flash Player.prefPane
- com.adobe.flashplayerpreferences
/Library/PreferencePanes/Growl.prefPane
- com.growl.prefpanel
/Library/PreferencePanes/MacFUSE.prefPane
- com.google.MacFUSE
/Library/PreferencePanes/NTFSforMacOSX.prefPane:® OS X:
- N/A
/Library/PreferencePanes/Perian.prefPane
- org.perian.PerianPane
/Library/PreferencePanes/YAMAHA-USBMIDIPatch.prefPane
- jp.co.yamaha.USBMIDIPatch
Bundles
/Library/Application Support/Adobe/APE/3.1/adbeapecore.framework/Versions/A/Resources/Flash Player.plugin
- com.macromedia.FlashPlayer-10.4-10.5.plugin
/Library/Application Support/Adobe/Plug-Ins/CS5/File Formats/Camera Raw.plugin
- com.adobe.CameraRaw
/Library/Audio/MIDI Drivers/YAMAHA-USBMIDIDriver.plugin
- jp.co.yamaha.USBMIDIDriver
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/AdobeCP15.plugin
- com.adobe.adobecp
/Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin
- com.macromedia.FlashPlayer-10.6.plugin
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
- com.adobe.acrobat.pdfviewer
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
- com.adobe.acrobat.pdfviewerNPAPI
/Library/Internet Plug-Ins/Flash Player.plugin
- com.macromedia.Flash
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
- com.oracle.java.JavaAppletPlugin
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
- com.microsoft.sharepoint.browserplugin
/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkIOM.plugin
- jp.co.Canon.ij.print.iom.CIJNP
/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkPBM.plugin
- jp.co.Canon.ij.print.pbm.CIJNP
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBIOM.plugin
- jp.co.canon.bj.print.bjusbiom
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBPBM.plugin
- jp.co.canon.bj.print.pbm.USB
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver.plugin
- jp.co.canon.ij.print.CIJUSBClassDriver
/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver2.plugin
- jp.co.canon.ij.print.CIJUSBClassDriver2
/Library/Printers/Canon/BJPrinter/Plugins/IJBluetooth/IJBluetoothIOM.plugin
- jp.co.canon.ij.print.ijbluetoothiom
/Library/Printers/Canon/IJScanner/Plugins/ag07_09.plugin
- jp.co.canon.scangear.ag07.09
/Library/Printers/Canon/IJScanner/Plugins/ag08_09.plugin
- jp.co.canon.scangear.ag08.09
/Library/Printers/Canon/IJScanner/Plugins/cncl09_09.plugin
- jp.co.canon.scangear.lld09.09
/Library/Printers/Canon/IJScanner/Plugins/cnq2413_09.plugin
- jp.co.canon.scanner.cnq2413.09
/Library/Printers/Canon/IJScanner/Plugins/cnq2414_09.plugin
- jp.co.canon.scanner.cnq2414.09
/Library/Printers/Canon/IJScanner/Plugins/cnq4807_09.plugin
- jp.co.canoI also ran EtreCheck. Here are the results:
Problem description:
Pop-ups when opening some websites. Redirecting to adultyum.info
EtreCheck version: 2.1.8 (121)
Report generated March 24, 2015 at 12:03:26 PM GMT+8
Download EtreCheck from http://etresoft.com/etrecheck
Click the [Click for support] links for help with non-Apple products.
Click the [Click for details] links for more information about that line.
Hardware Information: ℹ️
MacBook Pro (13-inch, Late 2011) (Technical Specifications)
MacBook Pro - model: MacBookPro8,1
1 2.4 GHz Intel Core i5 CPU: 2-core
4 GB RAM Upgradeable
BANK 0/DIMM0
2 GB DDR3 1333 MHz ok
BANK 1/DIMM0
2 GB DDR3 1333 MHz ok
Bluetooth: Old - Handoff/Airdrop2 not supported
Wireless: en1: 802.11 a/b/g/n
Battery Health: Normal - Cycle count 957
Video Information: ℹ️
Intel HD Graphics 3000 - VRAM: 384 MB
Color LCD 1280 x 800
System Software: ℹ️
OS X 10.10.2 (14C1514) - Time since boot: 0:3:51
Disk Information: ℹ️
ST9500325ASG disk0 : (500.11 GB)
EFI (disk0s1) <not mounted> : 210 MB
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
Macintosh HD (disk1) / : 498.88 GB (126.04 GB free)
Core Storage: disk0s2 499.25 GB Online
OPTIARC DVD RW AD-5970H
USB Information: ℹ️
Apple Inc. FaceTime HD Camera (Built-in)
Apple Inc. BRCM2070 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Inc. Apple Internal Keyboard / Trackpad
Apple Computer, Inc. IR Receiver
Thunderbolt Information: ℹ️
Apple Inc. thunderbolt_bus
Configuration files: ℹ️
/etc/hosts - Count: 15
Gatekeeper: ℹ️
Mac App Store and identified developers
Kernel Extensions: ℹ️
/Incompatible Software/Parallels Service.app
[not loaded] com.parallels.kext.prl_hid_hook (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_hypervisor (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_netbridge (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_usb_connect (6.0 11820.602974) [Click for support]
[not loaded] com.parallels.kext.prl_vnic (6.0 11820.602974) [Click for support]
/Library/Extensions
[loaded] com.squirrels.driver.AirParrotSpeakers (1.8 - SDK 10.8) [Click for support]
/System/Library/Extensions
[loaded] com.rim.driver.BlackBerryUSBDriverInt (0.0.74) [Click for support]
[not loaded] com.rim.driver.BlackBerryUSBDriverVSP (0.0.74) [Click for support]
[not loaded] com.seagate.driver.PowSecDriverCore (5.2.4 - SDK 10.4) [Click for support]
[loaded] com.squirrels.airparrot.framebuffer (3 - SDK 10.8) [Click for support]
/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns
[not loaded] com.seagate.driver.PowSecLeafDriver_10_4 (5.2.4 - SDK 10.4) [Click for support]
[not loaded] com.seagate.driver.PowSecLeafDriver_10_5 (5.2.4 - SDK 10.5) [Click for support]
[not loaded] com.seagate.driver.SeagateDriveIcons (5.2.4 - SDK 10.4) [Click for support]
Startup Items: ℹ️
HWNetMgr: Path: /Library/StartupItems/HWNetMgr
HWPortDetect: Path: /Library/StartupItems/HWPortDetect
Startup items are obsolete in OS X Yosemite
Problem System Launch Agents: ℹ️
[loaded] com.paragon.NTFS.trial.plist [Click for support]
[loaded] com.paragon.NTFS.upd.plist [Click for support]
Launch Agents: ℹ️
[not loaded] com.adobe.AAM.Updater-1.0.plist [Click for support]
[loaded] com.adobe.CS5ServiceManager.plist [Click for support]
[running] com.hp.devicemonitor.plist [Click for support]
[loaded] com.hp.messagecenter.launcher.plist [Click for support]
[loaded] com.oracle.java.Java-Updater.plist [Click for support]
[running] com.rim.BBAlbumArtCacher.plist [Click for support]
[running] com.rim.BBLaunchAgent.plist [Click for support]
[running] net.culater.SIMBL.Agent.plist [Click for support]
[loaded] org.glimmerblocker.updater.plist [Click for support]
Launch Daemons: ℹ️
[loaded] com.adobe.SwitchBoard.plist [Click for support]
[loaded] com.microsoft.office.licensing.helper.plist [Click for support]
[loaded] com.oracle.java.Helper-Tool.plist [Click for support]
[loaded] com.oracle.java.JavaUpdateHelper.plist [Click for support]
[running] com.rim.BBDaemon.plist [Click for support]
User Launch Agents: ℹ️
[loaded] com.adobe.ARM.[...].plist [Click for support]
[loaded] com.google.keystone.agent.plist [Click for support]
User Login Items: ℹ️
Android File Transfer Agent Application (/Users/[redacted]/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app)
Internet Plug-ins: ℹ️
iPhotoPhotocast: Version: 7.0 - SDK 10.8
FlashPlayerDebugger-10.6: Version: 11.5.502.149 [Click for support]
AdobePDFViewerNPAPI: Version: 10.1.13 [Click for support]
AdobePDFViewer: Version: 10.1.13 [Click for support]
Flash Player: Version: 11.5.502.149 Outdated! Update
Default Browser: Version: 600 - SDK 10.10
QuickTime Plugin: Version: 7.7.3
SharePointBrowserPlugin: Version: 14.0.0 [Click for support]
JavaAppletPlugin: Version: Java 8 Update 40 Check version
User internet Plug-ins: ℹ️
iGetterScriptablePlugin: Version: 2.9.2 [Click for support]
RealPlayer Plugin: Version: Unknown
Safari Extensions: ℹ️
Adblock Plus
3rd Party Preference Panes: ℹ️
Flash Player [Click for support]
Growl [Click for support]
Java [Click for support]
MacFUSE [Click for support]
Paragon NTFS for Mac ® OS X [Click for support]
Perian [Click for support]
YAMAHA-USBMIDIPatch [Click for support]
Time Machine: ℹ️
Time Machine not configured!
Top Processes by CPU: ℹ️
5% WindowServer
4% mds
1% mds_stores
1% BBLaunchAgent
0% fontd
Top Processes by Memory: ℹ️
103 MB ocspd
82 MB Finder
60 MB mds_stores
52 MB WindowServer
39 MB softwareupdated
Virtual Memory Information: ℹ️
1.53 GB Free RAM
1.25 GB Active RAM
386 MB Inactive RAM
1.12 GB Wired RAM
915 MB Page-ins
0 B Page-outs
Diagnostics Information: ℹ️
Mar 24, 2015, 11:57:52 AM Self test - passed
Mar 24, 2015, 08:49:09 AM /Users/[redacted]/Library/Logs/DiagnosticReports/Finder_2015-03-24-084909_[reda cted].crash -
What antivirus protection should I purchase for my MacBook Pro? MacSecurity.app appeared on my desktop, and I downloaded that. Since then, it has said my computer is infected and pop-ups have been appearing.
You've been infected by a scam trojan. You don't need any anti-virus software on your Mac. See the following about getting rid of the trojan.
Trojan War
If you discover a trojan program is running on your computer then look to the following information for assistance:
1. A recent discussion on the Apple Support Communities: MacDefender Trojan.
2. An excellent site devoted to Mac Malware: Macintosh Virus Guide
3. Another site for removing MacDefende, et.al.: MAC Defender Rogue Anti-Virus analysis and Removal
4. A new removal utility - MacDefenderKiller
Removing strange software can be a task. The following outlines various ways of uninstalling software:
Uninstalling Software: The Basics
Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.
Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.
Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.
Some applications may install a Startup item or a Log In item. Startup items are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the Delete [-] button to delete it from the list.
Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.
If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, Easy Find, instead. Download Easy Find at VersionTracker or MacUpdate.
Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.
There are many utilities that can uninstall applications. Note that you must have this software installed before you install software you may need to uninstall. Uninstallers won't work if you install them after the fact. Here is a selection:
AppZapper
Automaton
Hazel
CleanApp
Yank
SuperPop
Uninstaller
Spring Cleaning
Look for them and others at VersionTracker or MacUpdate.
For more information visit The XLab FAQs and read the FAQs on removing software and dealing with spyware and malware.
After removing all the components of the software you may have to restart the computer to fully disable the software. This will be the case when removing software that has installed a daemon. After the daemon has been removed you need to restart the computer to stop the daemon. Alternatively, you can kill the daemon process using the Terminal application or Activity Monitor. -
Why am I suddenly seeing pop ups in Chrome and Safari on my MacBook
A couple of weeks ago, I suddenly started seeing pop ups in both my Chrome and Safari browsers. I have pop up ads turned off in both, went so far as to uninstall Chrome and the .dmg for it several times, cleared all histories, cookies, extensions, etc, etc. What's even more maddening is that it happens while just using plain old Google to do a search. I have cleaned out all old pics and documents via Finder that I no longer needed. I have nothing new that has caused this change. So what the heck is happening here??? I have been trying to track this isue down and can't find a solution. Firefox seems to be the only thing unaffected at this point, but I migrated away from Mozilla a long time ago. I've tried searching Google's forums, but the fact it's happening in Safari suggests it's something within my Mac. I've run a virus scan (semi-redundant, I'm aware, but I'm grasping) and all is clear. Do I try a malware search now?
Also, just ran an EtreCheck if this is of any help. The antivirus is AVG that I just installed last week trying to see if anything was there.....
EtreCheck version: 1.9.11 (43) - report generated June 4, 2014 at 9:41:11 AM PDT
Hardware Information:
MacBook Pro (13-inch, Late 2011)
MacBook Pro - model: MacBookPro8,1
1 2.8 GHz Intel Core i7 CPU: 2 cores
8 GB RAM
Video Information:
Intel HD Graphics 3000 - VRAM: 512 MB
System Software:
OS X 10.9.3 (13D65) - Uptime: 0 days 13:0:37
Disk Information:
TOSHIBA MK7559GSXF disk0 : (750.16 GB)
EFI (disk0s1) <not mounted>: 209.7 MB
Macintosh HD (disk0s2) / [Startup]: 749.3 GB (471.33 GB free)
Recovery HD (disk0s3) <not mounted>: 650 MB
MATSHITADVD-R UJ-8A8
USB Information:
Apple, Inc. Keyboard Hub
Logitech USB Receiver
Apple Inc. Apple Keyboard
Apple Inc. BRCM2070 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Inc. Apple Internal Keyboard / Trackpad
Apple Inc. FaceTime HD Camera (Built-in)
HP Photosmart C4100 series
Apple Computer, Inc. IR Receiver
Thunderbolt Information:
Apple Inc. thunderbolt_bus
Configuration files:
/etc/sysctl.conf - Exists
Gatekeeper:
Mac App Store and identified developers
Kernel Extensions:
[not loaded] com.Belcarra.iokit.USBLAN_netpart (2.0.2) Support
[not loaded] com.Belcarra.iokit.USBLAN_usbpart (2.0.2) Support
[not loaded] com.RemoteControl.USBLAN.panther (1.6.1) Support
[not loaded] com.RemoteControl.USBLAN.usbpart (2.0.6) Support
[not loaded] com.belcarra.iokit.netpart.panther (1.6.1) Support
[not loaded] com.belcarra.iokit.usbpart.panther (1.6.1) Support
Startup Items:
HP IO: Path: /Library/StartupItems/HP IO
Launch Daemons:
[running] com.avg.Antivirus.infosd.plist Support
[running] com.avg.Antivirus.services.plist Support
[failed] com.crashplan.engine.plist Support
[loaded] com.google.keystone.daemon.plist Support
[loaded] com.microsoft.office.licensing.helper.plist Support
[not loaded] com.vsearch.daemon.plist Support
[running] com.vsearch.helper.plist Support
Launch Agents:
[running] com.avg.Antivirus.gui.plist Support
[loaded] com.google.keystone.agent.plist Support
[running] com.vsearch.agent.plist Support
[failed] jp.co.canon.UFR2.BG.plist Support
User Launch Agents:
[failed] com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist
[not loaded] com.spotify.webhelper.plist Support
User Login Items:
Google Notifier
iTunesHelper
Music Manager
CrashPlan menu bar
Dropbox
Spotify
Internet Plug-ins:
o1dbrowserplugin: Version: 5.4.1.18709 Support
Default Browser: Version: 537 - SDK 10.9
Flip4Mac WMV Plugin: Version: 2.3.6.5 Support
Silverlight: Version: 5.1.20513.0 - SDK 10.6 Support
DivXBrowserPlugin: Version: 1.4 Support
QuickTime Plugin: Version: 7.7.3
iPhotoPhotocast: Version: 7.0
googletalkbrowserplugin: Version: 5.4.1.18709 Support
SharePointBrowserPlugin: Version: 14.3.1 - SDK 10.6 Support
AdobePDFViewer: Version: 10.1.0 Support
CouponPrinter-FireFox_v2: Version: Version 1.1.7 - SDK 10.5 Support
EPPEX Plugin: Version: 3.0.5.0 Support
ContentUploaderPlugin: Version: 1.2 Support
JavaAppletPlugin: Version: Java 7 Update 21 Check version
Audio Plug-ins:
BluetoothAudioPlugIn: Version: 1.0 - SDK 10.9
AirPlay: Version: 2.0 - SDK 10.9
AppleAVBAudio: Version: 203.2 - SDK 10.9
iSightAudio: Version: 7.7.3 - SDK 10.9
iTunes Plug-ins:
Quartz Composer Visualizer: Version: 1.4 - SDK 10.9
3rd Party Preference Panes:
DivX Support
Flip4Mac WMV Support
MacFUSE Support
MusicManager Support
Time Machine:
Time Machine not configured!
Top Processes by CPU:
3% WindowServer
2% firefox
1% digest-service
0% opendirectoryd
0% kcm
Top Processes by Memory:
311 MB firefox
180 MB Finder
180 MB avgd
180 MB mds_stores
156 MB com.apple.IconServicesAgent
Virtual Memory Information:
1.46 GB Free RAM
3.40 GB Active RAM
1.81 GB Inactive RAM
1.33 GB Wired RAM
1.11 GB Page-ins
0 B Page-outs -
I recently started getting an ENORMOUS amount of pop-ups from flash mall. I followed the steps that a user named Linc posted to delete it from a folder on my computer by copying and pasting a term into finder>go>go to folder. However, this has not helped. The pop-ups typically show up when random words on different websites become blue and bold with a green symbol next to it. When my cursor runs over it 3 pop-ups appear. Someone please help me fix this!!!
1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.
Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.
You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.
In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.
You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.
Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.
4. Here's a summary of what you need to do, if you choose to proceed:
☞ Copy a line of text in this window to the Clipboard.
☞ Paste into the window of another application.
☞ Wait for the test to run. It usually takes a few minutes.
☞ Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.
You may have started up in "safe" mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(1310 ' 0.5 0.25 50 1000 15 5120 1000 25000 6 6 5 1 0 100 ' 51 25600 4 10 25 5120 102400 1000 25 1536 500 40 500 300 85 25 20480 262144 20 2000 524288 604800 5 1024 25 50 );k=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth SerialATA Extensions Applications Frameworks PrefPane Fonts Displays PCI UniversalAccess InstallHistory ConfigurationProfile AirPort 'com\.apple\.' -\\t N\\/A 'AES|atr|udit|msa|dnse|ax|ensh|fami|FileS|fing|ft[pw]|gedC|kdu|etS|is\.|alk|ODSA|otp|htt|pace|pcas|ps-lp|rexe|rlo|rsh|smb|snm|teln|upd-[aw]|uuc|vix|webf' OSBundle{Require,AllowUserLoa}d 'Mb/s:Mb/s:ms/s:KiB/s:%:total:MB:total:lifetime:sampled:per sec' 'Net in:Net out:I/O wait time:I/O requests:CPU usage:Open files:Memory:Mach ports:Energy:Energy:File opens:Forks:Failed forks:System errors' 'tsA|[ST]M[HL]' PlistBuddy{,' 2>&1'}' -c Print' 'Info\.plist' CFBundleIdentifier );f=('\n%s'{': ','\n\n'}'%s\n' '\nRAM details\n%s\n' %s{' ','\n'{"${k[22]}",}}'%s\n' '%.1f GiB: %s\n' '\n ...and %d more line(s)\n' '\nContents of %s\n '"${k[22]}"'mod date: %s\n '"${k[22]}"'size (B): %d\n '"${k[22]}"'checksum: %d\n%s\n' );c=(879294308 4071182229 461455494 216630318 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 2636415542 3694147963 1233118628 2456546649 2806998573 2778718105 842973933 1383871077 1591517921 676087606 1445213025 2051385900 3301885676 891055588 998894468 695903914 1443423563 4136085286 3374894509 1051159591 892310726 1707497389 523110921 2883943871 3873345487 );s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[4]} ' s/:$//;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[9]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of|yc/!{ s/^.+is |\.//g;p;q;} ' ' BEGIN { FS="\f";if(system("A1 42 83 114")) d="^'"${k[21]}"'launch(d\.peruser\.[0-9]+|ctl\.(Aqua|Background|System))$";} { if($2~/[1-9]/) { $2="status: "$2;printf("'"${f[4]}"'",$1,$2);} else if(!d||$1!~d) print $1;} ' ' $1>1{$NF=$NF" x"$1} /\*/{if(!f)f="\n\t* Code injection"} {$1=""} 1;END{print f} ' ' NR==2&&$4<='${p[7]}'{print $4} ' ' BEGIN{FS=":"} ($1~"wir"&&$2>'${p[22]}') {printf("wired %.1f\n",$2/2^18)} ($1~/P.+ts/&&$2>'${p[19]}') {printf("paged %.1f\n",$2/2^18)} ' '/YLD/s/=/ /p' ' { q=$1;$1="";u=$NF;$NF="";gsub(/ +$/,"");print q"\f"$0"\f"u;} ' ' /^ {6}[^ ]/d;s/:$//;/([^ey]|[^n]e):/d;/e: Y/d;s/: Y.+//g;H;${ g;s/ \n (\n)/\1/g;s/\n +(M[^ ]+)[ -~]+/ (\1)/;s/\n$//;/( {8}[^ ].*){2,}/p;} ' 's:^:/:p;' ' !/, .+:/ { print;n++;} END{if(n<'{${p[12]},${p[13]}}')printf("^'"${k[21]}"'.+")} ' '|uniq' ' 1;END { print "/L.+/Scr.+/Templ.+\.app$";print "/L.+/Pri.+\.plugin$";if(NR<'{${p[14]},${p[21]}}') print "^/[Sp].+|'${k[21]}'";} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p;' '&&echo On' '/\.(bundle|component|framework|kext|mdimporter|plugin|qlgenerator|saver|wdgt|xpc)$/p' '/\.dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".","");print $0"$";} END { split("'"${c[*]}"'",c);for(i in c) print "\t"c[i]"$";} ' ' /^\/(Ap|Dev|Inc|Prev)/d;/((iTu|ok).+dle|\.(component|mailbundle|mdimporter|plugin|qlgenerator|saver|wdgt|xpc))$/p;' ' BEGIN{ FS="= "} $2 { gsub(/[()"]/,"",$2);print $2;} !/:/&&!$2{print "'${k[23]}'"} ' ' /^\//!d;s/^.{5}//;s/ [^/]+\//: \//p;' '>&-||echo No' '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[2]}'{$2=$2-1;print}' ' BEGIN { M1='${p[16]}';M2='${p[18]}';M3='${p[8]}';M4='${p[3]}';} !/^A/{next};/%/ { getline;if($5<M1) o["CPU"]="CPU: user "$2"%, system "$4"%";next;} $2~/^disk/&&$4>M2 { o[$2]=$2": "$3" ops/s, "$4" blocks/s";next;} $2~/^(en[0-9]|bridg)/ { if(o[$2]) { e=$3+$4+$5+$6;if(e) o[$2]=o[$2]"; errors "e"/s";next;};if($4>M3||$6>M4) o[$2]=$2": in "int($4/1024)", out "int($6/1024)" (KiB/s)";} END { for(i in o) print o[i];} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' BEGIN{FS=": "} /^ {10}O/ {exit} /^ {0,12}[^ ]/ {next} $1~"Ne"&&$2!~/^In/{print} $1~"Si" { if(a[2]) next;split($2,a," ");if(a[1]-a[4]<'${p[5]}') print;};$1~"T"&&$2<'${p[20]}'{print};$1~"Se"&&$2!~"2"{print};' ' BEGIN { FS="\f";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1;} ' ' BEGIN { split("'"${p[1]}"'",m);FS="\f";} $2<=m[$1]{next} $1==9||$1==10 { "ps -c -ouid -p"$4"|sed 1d"|getline $4;} $1<11 { o[$1]=o[$1]"\n "$3" (UID "int($4)"): "$2;} $1==11&&$5!~"^/dev" { o[$1]=o[$1]"\n "$3" (UID "$4") => "$5" (status "$6"): "$2;} $1==12&&$5 { "ps -c -ocomm -p"$5"|sed 1d"|getline n;if(n) $5=n;o[$1]=o[$1]"\n "$5" => "$3" (UID "$4"): "$2;} $1~/1[34]/ { o[$1]=o[$1]"\n "$3" (UID "$4", error "$5"): "$2;} END { n=split("'"${k[27]}"'",u,":");for(i=n+1;i<n+4;i++)u[i]=u[n];split("'"${k[28]}"'",l,":");for(i=1;i<15;i++) if(o[i])print "\n"l[i]" ("u[i]")\n"o[i];} ' ' /^ {8}[^ ]/{print} ' ' BEGIN { L='${p[17]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"cksum "F|getline C;split(C, A);C=A[1];"stat -f%Sm "F|getline D;"stat -f%z "F|getline S;"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("'"${k[30]}"' "F|getline g) { l++;if(l<=L) f=f"\n "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F"\n '"${k[22]}"'"T;printf("'"${f[8]}"'",F,D,S,C,f);if(l>L) printf("'"${f[7]}"'",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' 's/^.{52}(.+) <.+/\1/p' ' /id: N|te: Y/{i++} END{print i} ' ' /kext:/ { split($0,a,":");p=a[1];k[S]='${k[25]}';k[U]='${k[26]}';v[S]="Safe";v[U]="true";for(i in k) { s=system("'"${k[30]}"'\\ :"k[i]" \""p"\"/*/I*|grep -qw "v[i]);if(!s) a[1]=a[1]" "i;};if(!a[2]) a[2]="'"${k[23]}"'";printf("'"${f[4]}"'",a[1],a[2]);next;} !/^ *$/ { p="'"${k[31]}"'\\ :'"${k[33]}"' \""$0"\"/*/'${k[32]}'";p|getline b;close(p);if(b~/ .+:/||!b) b="'"${k[23]}"'";printf("'"${f[4]}"'",$0,b);} ' '/ en/!s/\.//p' ' NR>=13 { gsub(/[^0-9]/,"",$1);print;} ' ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?'${k[32]}'$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ / [VY]/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' '/^find: /!p;' ' /^p/{ s/.//g;x;s/\nu/'$'\f''/;s/(\n)c/\1'$'\f''/;s/\n\n//;p;};H;' ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;p;' ' s/^.+ |\(.+\)$//g;p;' '1;END{if(NR<'${p[15]}')printf("^/(S|usr/(X|li))")}' ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END{ if(i>1)print n} ' s/{'\.|jnl: ','P.+:'}'//;s/ +([0-9]+)(.+)/\2'$'\t\t''\1/p' ' /es: ./{ /iOS/d;s/^.+://;b0'$'\n'' };/^ +C.+ted: +[NY]/H;/:$/b0'$'\n'' d;:0'$'\n'' x;/: +N/d;s/://;s/\n.+//p;' ' 1d;/:$/b0'$'\n'' $b0'$'\n'' /(D|^ *Loc.+): /{ s/^.+: //;H;};/(B2|[my]): /H;d;:0'$'\n'' x;/[my]: [AM]|m: I.+p$|^\/Vo/d;s/(^|\n) [ -~]+//g;s/(.+)\n(.+)/\2:\1/;s/\n//g;/[ -~]/p;' 's/$/'$'\f''(0|-(4[34])?)$/p' '|sort'{'|uniq'{,\ -c},\ -nr} ' s/^/'{5,6,7,8,9,10}$'\f''/;s/ *'$'\f'' */'$'\f''/g;p;' 's/:.+$//p' '|wc -l' /{\\.{kext,xpc,'(appex|pluginkit)'}'\/(Contents\/)?'Info,'Launch[AD].+'}'\.plist$/p' 's/([-+.?])/\\\1/g;p' 's/, /\'$'\n/g;p' ' BEGIN{FS="\f"} { printf("'"${f[6]}"'",$1/2^30,$2);} ' ' /= D/&&$1!~/'{${k[24]},${k[29]}}'/ { getline d;if(d~"t") print $1;} ' ' BEGIN{FS="\t"} NR>1&&$NF!~/0x|\.([0-9]{3,}|[-0-9A-F]{36})$/ { print $NF"\f"a[split($(NF-1),a," ")];} ' '|tail -n'{${p[6]},${p[10]}} ' s/.+bus /Bus: /;s/,.+[(]/ /;s/,.+//p;' ' { $NF=$NF" Errors: "$1;$1="";} 1 ' ' 1s/^/\'$'\n''/;/^ +(([MNPRSV]|De|Li|Tu).+|Bus): .|d: Y/d;s/:$//;$d;p;' ' BEGIN { RS=",";FS=":";} $1~"name" { gsub(/["\\]/,"",$2);print $2;} ' '|grep -q e:/' '/[^ .]/p' '{ print $1}' ' /^ +N.+: [1-9]/ { i++;} END { if(i) print "system: "i;} ' ' NF { print "'{admin,user}' "$NF;exit;} ' ' /se.+ =/,/[\}]/!d;/[=\}]/!p ' ' 3,4d;/^ +D|Of|Fu| [0B]/d;s/^ |:$//g;$!H;${ x;/:/p;} ' ' BEGIN { FS=": ";} NR==1 { sub(":","");h="\n"$1"\n";} /:$/ { l=$1;next;} $1~"S"&&$2!~3 { getline;next;} /^ {6}I/ { i++;L[i]=l" "$2;} END { if(i) print h;for(j=0;j<'${p[24]}';j++) print L[i-j];} ' ' /./H;${ x;s/\n//;s/\n/, /g;/,/p;} ' ' {if(int($6)>'${p[25]}')printf("swap used %.1f\n",$6/1024)} ' ' BEGIN{FS="\""} $3~/ t/&&$2!~/'{${k[24]},${k[29]}}'/{print $2} ' ' int($1)>13 ' p ' BEGIN{FS="DB="} { sub(/\.db.*/,".db",$2);print $2;} ' {,1d\;}'/r%/,/^$/p' ' NR==1{next} NR>11||!$0{exit} {print $NF"\f"substr($0,1,32)"\f"$(NF-7)} ' '/e:/{print $2}' ' /^[(]/{ s/....//;s/$/:/;N;/: [)]$/d;s/\n.+ ([^ ]+).$/\1/;H;};${ g;p;} ' '1;END { exit "find /var/db/r*/'${k[21]}'*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom -mtime -'${p[23]}'s"|getline;} ' ' NR<='${p[26]}' { o=o"\n"$0;next;} { o="";exit;} END{print o|"sed 1d"} ' ' {o=o"\n"$0} NR==6{p=$1*$5} END{if(p>'${p[27]}'*10^6)print o|"sed 1d"} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab kextfind top pkgutil "${k[30]}\\" echo cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom 'mdfind -onlyin' env pluginkit scutil 'dtrace -q -x aggsortrev -n' security sed\ -En awk 'dscl . -read' networksetup mdutil lsof test osascript\ -e netstat mdls route cat uname powermetrics codesign lockstat lpstat );c2=(${k[21]}loginwindow\ LoginHook ' /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'" 'L*/Ca*/'${k[21]}'Saf*/E* -d 2 -name '${k[32]} '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' -i '-nl -print' '-F \$Sender -k Level Nle 3 -k Facility Req "'${k[21]}'('{'bird|.*i?clou','lsu|sha'}')"' "-f'%N: %l' Desktop {/,}L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message CRne '0xdc008012|(allow|call)ing|Goog|(mplet|nabl)ed|ry HD|safe b|succ|xpm' -k Message CReq 'bad |Can.t l|corru|dead|fail|GPU |hfs: Ru|inval|Limiti|v_c|NVDA[(]|pa(gin|us)|Purg(ed|in)| err|Refus|s ful|TCON|tim(ed? ?|ing )o|trig|WARN' " '-du -n DEV -n EDEV 1 10' 'acrx -o%cpu,comm,ruid' "' syscall::recvfrom:return {@a[execname,uid]=sum(arg0)} syscall::sendto:return {@b[execname,uid]=sum(arg0)} syscall::open*:entry {@c[execname,uid,copyinstr(arg0),errno]=count()} syscall::execve:return, syscall::posix_spawn:return {@d[execname,uid,ppid]=count()} syscall::fork:return, syscall::vfork:return, syscall::posix_spawn:return /arg0<0/ {@e[execname,uid,arg0]=count()} syscall:::return /errno!=0/ {@f[execname,uid,errno]=count()} io:::wait-start {self->t=timestamp} io:::wait-done /self->t/ { this->T=timestamp - self->t;@g[execname,uid]=sum(this->T);self->t=0;} io:::start {@h[execname,uid]=sum(args[0]->b_bcount)} tick-10sec { normalize(@a,2560000);normalize(@b,2560000);normalize(@c,10);normalize(@d,10);normalize(@e,10);normalize(@f,10);normalize(@g,10000000);normalize(@h,10240);printa(\"1\f%@d\f%s\f%d\n\",@a);printa(\"2\f%@d\f%s\f%d\n\",@b);printa(\"11\f%@d\f%s\f%d\f%s\f%d\n\",@c);printa(\"12\f%@d\f%s\f%d\f%d\n\",@d);printa(\"13\f%@d\f%s\f%d\f%d\n\",@e);printa(\"14\f%@d\f%s\f%d\f%d\n\",@f);printa(\"3\f%@d\f%s\f%d\n\",@g);printa(\"4\f%@d\f%s\f%d\n\",@h);exit(0);} '" '-f -pfc /var/db/r*/'${k[21]}'*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f'$'\f''%Sc'$'\f''%N -t%F {} \;' '/S*/*/Ca*/*xpc*' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' /\ kMDItemContentTypeTree=${k[21]}{bundle,mach-o-dylib} :Label "/p*/e*/{auto*,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {/p*,/usr/local}/e*/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*{,/*} .launchd.conf" list '-F "" -k Sender hidd -k Level Nle 3' /Library/Preferences/${k[21]}alf\ globalstate --proxy '-n get default' vm.swapusage --dns -get{dnsservers,info} dump-trust-settings\ {-s,-d,} '~ "kMDItemKind=Package"' '-R -ce -l1 -n5 -o'{'prt -stats prt','mem -stats mem'}',command,uid' -kl -l -s\ / '--regexp --files '${k[21]}'pkg.*' '+c0 -i4TCP:0-1023' ${k[21]}dashboard\ layer-gadgets '-d /L*/Mana*/$USER' '-app Safari WebKitDNSPrefetchingEnabled' '-Fcu +c0 -l' -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' '-F \$Message -k Sender kernel -k Message CReq "'{'n Cause: -','(a und|I/O |gnment |jnl_io.+)err|disk.+abo','USBF:.+bus'}'"' -name\ kMDItem${k[33]} -T\ hfs '-n get default' -listnetworkserviceorder :${k[33]} :CFBundleDisplayName $EUID {'$TMPDIR../C ','/{S*/,}'}'L*/{,Co*/*/*/L*/}{Cache,Log}s -type f -size +'${p[11]}'M -exec stat -f%z'$'\f''%N {} \;' \ /v*/d*/*/*l*d{,.*.$UID}/* '-app Safari UserStyleSheetEnabled' 'L*/A*/Fi*/P*/*/a*.json' users/$USER\ HomeDirectory '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' ' -F "\$Time \$(Sender): \$Message" -k Sender Rne "launchd|nsurls" -k Level Nle 3 -k Facility R'{'ne "user|','eq "'}'console" -k Message CRne "[{}<>]|asser|commit - no t|deprec|done |ect pas|fmfd|Goog|ksho|ndum|obso|realp|rned f|/root|sandbox ex" ' getenv '/ "kMDItemDateAdded>=\$time.now(-'${p[23]}')&&kMDItem'${k[33]}'=*"' -m\ / '' ' -F "\$Time \$(RefProc): \$Message" -k Sender Req launchd -k Level Nle 3 -k Message Rne "asse|bug|File ex|hij|Ig|Jet|key is|lid t|Plea|ship" ' print{,-disabled}\ {system,{gui,user}/$UID} '-n1 --show-initial-usage --show-process-energy' -r ' -F "\$Message" -k Sender nsurlstoraged -k Time ge -1h -k Level Nle 4 -k Message Req "^(ER|IN)" ' '/A* -type d -name *.app -prune ! -user 0' -vv '-D1 -IPRWck -s5 sleep 1' -o );N1=${#c2[@]};for j in {0..20};do c2[N1+j]=SP${k[j]}DataType;done;l=({Restricted\ ,Lock,Pro}files POST Battery {Safari,App,{Bad,Loaded}\ kernel,Firefox}\ extensions System\ load boot\ args FileVault\ {2,1} {Kernel,System,Console,launchd}\ log SMC Login\ hook 'I/O per process' 'High file counts' UID {System,Login,Agent,User}\ services\ {load,disabl}ed {Admin,Root}\ access Font\ issues Firewall Proxies DNS TCP/IP Wi-Fi 'Elapsed time (sec)' {Root,User}\ crontab {Global,User}' login items' Spotlight Memory\ pressure Listeners Widgets Parental\ Controls Prefetching Nets Volumes {Continuity,I/O,iCloud,HID,HCI}\ errors {User,System}\ caches/logs XPC\ cache Startup\ items Shutdown\ codes Heat Diagnostic\ reports Bad\ {plist,cache}s 'VM (GiB)' Bundles{,' (new)'} Trust\ settings Activity Free\ space Stylesheet Library\ paths{,' ('{shell,launchd}\)} Data\ packages Modifications CUPS );N3=${#l[@]};for i in {0..8};do l[N3+i]=${k[5+i]};done;F() { local x="${s[$1]}";[[ "$x" =~ ^([\&\|\<\>]|$) ]]&&{ printf "$x";return;};:|${c1[30]} "$x" 2>&-;printf "%s \'%s\'" "|${c1[30+$?]}" "$x";};A0() { Q=6;v[2]=1;id -G|grep -qw 80;v[1]=$?;((v[1]))||{ Q=7;sudo -v;v[2]=$?;((v[2]))||Q=8;};v[3]=`date +%s`;date '+Start time: %T %D%n';printf '\n[Process started]\n\n'>&4;printf 'Revision: %s\n\n' ${p[0]};};A1() { local c="${c1[$1]} ${c2[$2]}";shift 2;c="$c ` while [[ "$1" ]];do F $1;shift;done`";((P2))&&{ c="sudo $c";P2=;};v=`eval "$c"`;[[ "$v" ]];};A2() { local c="${c1[$1]}";[[ "$c" =~ ^(awk|sed ) ]]&&c="$c '${s[$2]}'"||c="$c ${c2[$2]}";shift 2;local d=` while [[ "$1" ]];do F $1;shift;done`;((P2))&&{ c="sudo $c";P2=;};local a;v=` while read a;do eval "$c '$a' $d";done<<<"$v";`;[[ "$v" ]];};A3(){ v=$((`date +%s`-v[3]));};export -f A1 A2 F;B1() { v=No;! ((v[1]))&&{ v=;P1=1;};};eval "`type -a B1|sed '1d;s/1/2/'`";B3(){ v[$1]="$v";};B4() { local i=$1;local j=$2;shift 2;local c="cat` while [[ "$1" ]];do F $1;shift;done`";v[j]=`eval "{ $c;}"<<<"${v[i]}"`;};B5(){ v="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d$'\e' <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F$'\e' ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`egrep -v "${v[$1]}"<<<"$v"|sort`;};eval "`type -a B7|sed '1d;s/7/8/;s/-v //'`";C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { B4 0 0 63&&C1 1 $1;};C4() { echo $'\t'"Part $((++P)) of $Q done at $((`date +%s`-v[3])) sec">&4;};C5() { sudo -k;pbcopy<<<"$o";printf '\n\tThe test results are on the Clipboard.\n\n\tPlease close this window.\n';exit 2>&-;};for i in 1 2;do eval D$((i-1))'() { A'$i' $@;C0;};';for j in 2 3;do eval D$((i+2*j-3))'() { local x=$1;shift;A'$i' $@;C'$j' $x;};';done;done;trap C5 2;o=$({ A0;D0 0 N1+1 2;D0 0 $N1 1;B1;C2 31;B1&&! B2&&C2 32;D2 22 15 63;D0 0 N1+2 3;D0 0 N1+15 17;D4 3 0 N1+3 4;D4 4 0 N1+4 5;D4 N3+4 0 N1+9 59;D0 0 N1+16 99;for i in 0 1 2;do D4 N3+i 0 N1+5+i 6;done;D4 N3+3 0 N1+8 71;D4 62 1 10 7;D4 10 1 11 8;B2&&D4 18 19 53 67;D2 11 2 12 9;D2 12 3 13 10;D2 13 32 70 101 25;D2 71 6 76 13;D2 45 20 52 66;A1 7 77 14;B3 28;A1 20 31 111;B6 0 28 5;B4 0 0 110;C2 66;B2&&D0 45 90 124;D4 70 8 15 38;D0 9 16 16 77 45;C4;B2&&D0 35 49 61 75 76 78 45;B2&&{ D0 28 17 45;C4;};B2&&{ A1 43 85 117;B3 29;B4 0 0 119 76 81 45;C0;B4 29 0 118 119 76 82 45;C0; };D0 12 40 54 16 79 45;D0 12 39 54 16 80 45;D4 78 46 91;D4 74 25 77 15&&{ B4 0 8 103;B4 8 0;A2 18 74;B6 8 0 3;C3 75;};B2&&D4 19 21 0;B2&&D4 40 10 42;D2 2 0 N1+19 46 84;D2 44 34 43 53;D2 59 22 20 32;D2 33 0 N1+14 51;for i in {0..2};do A1 29 35+i 104+i;B3 25+i;done;B6 25 27 5;B6 0 26 5;B4 0 0 110;C2 69;D2 34 21 28 35;D4 35 27 29 36;A1 40 59 120;B3 18;A1 33 60 121;B8 18;B4 0 19 83;A1 27 32 39&&{ B3 20;B4 19 0;A2 33 33 40;B3 21;B6 20 21 3;};C2 36;D4 50 38 5 68;B4 19 0;D5 37 33 34 42;B2&&D4 46 35 45 55;D4 38 0 N1+20 43;B2&&D4 58 4 65 76 91;D4 63 4 19 44 75 95 12;B1&&{ D4 53 5 55 75 69&&D4 51 6 58 31;D4 56 5 56 97 75 98&&D0 0 N1+7 99;D2 55 5 27 84;D4 61 5 54 75 70;D4 14 5 14 96;D4 15 5 72 96;D4 17 5 78 96;C4;};D4 16 5 73 96;A1 13 44 74 18;C4;B3 4;B4 4 0 85;A2 14 61 89;B4 0 5 19 102;A1 17 41 50;B7 5;C3 8;B4 4 0 88;A2 14 24 89;C4;B4 0 6 19 102;B4 4 0 86;A2 14 61 89;B4 0 7 19 102;B5 6 7;B4 0 11 73 102;A1 42 86 114;j=$?;for i in 0 1 2;do ((i==2&&j==1))&&break;((! j))||((i))||B2&&A1 18 $((79+i-(i+53)*j)) 107+8*j 94 74||continue;B7 11;B4 0 0 11;C3 $((23+i*(1+i+2*j)));D4 $((24+i*(1+i+2*j))) 18-4*j 82+i-16*j $((112+((3-i)*i-40*j)/2));done;D4 60 4 21 24;D4 42 14 1 62;D4 43 37 2 90 48;D4 41 10 42;D2 48 36 47 25;A1 4 3 60&&{ B3 9;A2 14 61;B4 0 10 21;B4 9 0;A2 14 62;B4 0 0 21;B6 0 10 4;C3 5;};D4 9 41 69 100;D2 72 21 68 35;D2 49 21 48 49;B4 4 22 57 102;A1 21 46 56 74;B7 22;B4 0 0 58;C3 47;D4 54 5 7 75 76 69;D4 52 5 8 75 76 69;D4 57 4 64 76 91;D2 0 4 4 84;D2 1 4 51 84;D4 21 22 9 37;D0 0 N1+17 108;D4 76 24 38;A1 23 18 28 89;B4 0 16 22 102;A1 16 25 33;B7 16;B4 0 0 34;D1 31 47;D4 64 4 71 41;D4 65 5 87 116 74;C4;B4 4 12 26 89 23 102;for i in {0..3};do A1 0 N1+10+i 72 74;B7 12;B4 0 0 52;C3 N3+5+i;((i))||C4;done;A1 24 22 29;B7 12;B3 14;A2 39 57 30;B6 14 0 4;C3 67;A1 24 75 74;B4 1 1 122||B7 12;B4 0 0 123;B3 23;A2 39 57 30;B6 23 0 4;C3 68;B4 4 13 27 89 65;A1 24 23;B7 13;C3 73;B4 4 0 87;A2 14 61 89 20;B4 0 17;A1 26 50 64;B7 17;C3 6;A1 4 88;D5 77 44 89;D4 7 11 6;D0 0 N1+18 109;A3;C2 39;C4;} 4>&2 2>/dev/null;);C5
Copy the selected text to the Clipboard by pressing the key combination command-C.
8. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad and start typing the name.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter
exec bash
and press return. Then paste the script again.
10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:
[Process started]
Part 1 of 8 done at … sec
Part 8 of 8 done at … sec
The test results are on the Clipboard.
Please close this window.
[Process completed]
The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.
Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.
12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.
14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you're told to do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.
Copyright © 2014, 2015 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed. -
HT203987 Ad Pop ups coming in all browsers on Mac
Since morning my Mac (running Yosemite) is showing pop ups with on the right bottom of all browsers and at times opens a new tab going to Mackeeper website. I tried various stuff posted on the forum like
searching for various items in Finder as described here by Apple Support
installing & scanning through AdwareMedic
removing all extensions from all browsers
off course rebooting the system
opening URLs in Incognito mode
These obscene pop ups keep showing up in All Browsers. Interestingly they do not appear on some websites or when I doing Google Search or viewing pages on Apple Forums but keep coming on most of the sites I m visiting. I tried visiting the same websites on by MacBook and every thing is clean there.
Only different thing than my usual work I did on this Mac was to download & install Audacity from audacity.sourceforge.net/download/mac. The other thing was I tried downloading Inkscape from https://inkscape.org/en/download/mac-os/ which asked me to install XQuartz from xquartz.macosforge.org which I stopped in between. Not sure if any of these is causing the issue.
More importantly, how do I get rid of these pop ups. Willing to buy any good paid software from Mac Store if that helps.
Thanks1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.
Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.
You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.
In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.
You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.
Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.
4. Here's a summary of what you need to do, if you choose to proceed:
☞ Copy a line of text in this window to the Clipboard.
☞ Paste into the window of another application.
☞ Wait for the test to run. It usually takes a few minutes.
☞ Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.
You may have started up in "safe" mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(1251 ' 0.5 0.25 10 1000 15 5120 1000 25000 1 1 0 100 ' 51 25600 4 10 25 5120 102400 1000 25 1000 225 40 500 300 85 25 20480 262144 20 2000 524288 604800 5 );k=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth SerialATA Extensions Applications Frameworks PrefPane Fonts Displays PCI UniversalAccess InstallHistory ConfigurationProfile AirPort 'com\.apple\.' -\\t N\\/A 'AES|atr|udit|msa|dnse|ax|ensh|fami|FileS|fing|ft[pw]|gedC|kdu|etS|is\.|alk|ODSA|otp|htt|pcas|ps-lp|rexe|rlo|rsh|smb|snm|teln|upd-[aw]|uuc|vix|webf' OSBundle{Require,AllowUserLoa}d 'Mb/s:per sec:ms/s:KiB/s:%:total:MB:total' 'Net in:Net out:I/O wait time:I/O requests:CPU usage:Open files:Memory:Mach ports:File opens:Forks:Failed forks:System errors' 'tsA|[ST]M[HL]' PlistBuddy{,' 2>&1'}' -c Print' 'Info\.plist' CFBundleIdentifier );f=('\n%s'{': ','\n\n'}'%s\n' '\nRAM details\n%s\n' %s{' ','\n'{"${k[22]}",}}'%s\n' '%d MB: %s\n' '\n ...and %s more line(s)\n' '\nContents of %s\n '"${k[22]}"'mod date: %s\n '"${k[22]}"'checksum: %s\n%s\n' );c=(879294308 4071182229 461455494 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 2636415542 3694147963 1233118628 2456546649 2806998573 2778718105 842973933 2051385900 3301885676 891055588 998894468 695903914 1443423563 4136085286 3374894509 1051159591 892310726 1707497389 523110921 2883943871 3873345487 );s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[4]} ' s/:$//;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[9]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' BEGIN { FS="\f";if(system("sw_vers -productVersion|grep -q ^10\.1")) d="^'"${k[21]}"'launch(d\.peruser\.[0-9]+|ctl\.(Aqua|Background|System))$";} { if($2~/[1-9]/) { $2="status: "$2;printf("'"${f[4]}"'",$1,$2);} else if(!d||$1!~d) print $1;} ' ' { sub(/ :/,"");print|"tail -n'${p[10]}'";} ' ' NR==2&&$4<='${p[7]}' { print $4;} ' ' ($1~"wir"&&$2>'${p[22]}')||($1~/P.+ts:/&&$2>'${p[19]}') { print $1" "int($2);} ' '/YLD/s/=/ /p' ' { q=$1;$1="";u=$NF;$NF="";gsub(/ +$/,"");print q"\f"$0"\f"u;} ' ' /^ {6}[^ ]/d;s/:$//;/([^ey]|[^n]e):/d;/e: Y/d;s/: Y.+//g;H;${ g;s/ \n (\n)/\1/g;s/\n +(M[^ ]+)[ -~]+/ (\1)/;s/\n$//;/( {8}[^ ].*){2,}/p;} ' 's:^:/:p;' ' !/, .+:/{print};END{if(NR<'{${p[12]},${p[13]}}')printf("^'"${k[21]}"'.+")} ' '|uniq' ' 1;END { print "/L.+/Scr.+/Templ.+\.app$";print "/L.+/Pri.+\.plugin$";if(NR<'{${p[14]},${p[21]}}') print "^/[Sp].+|'${k[21]}'";} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p;' '&&echo On' '/\.(bundle|component|framework|kext|mdimporter|plugin|qlgenerator|saver|wdgt)$/p' '/\.dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".","");print $0"$";} END { split("'"${c[*]}"'",c);for(i in c) print "\t"c[i]"$";} ' ' /^\/(Ap|Dev|Inc|Prev)/d;/((iTu|ok).+dle|\.(component|mailbundle|mdimporter|plugin|qlgenerator|saver|wdgt))$/p;' ' BEGIN{ FS="= "} $2 { gsub(/[()"]/,"",$2);print $2;} ' ' /^\//!d;s/^.{5}//;s/ [^/]+\//: \//p;' '>&-||echo No' '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[2]}'{$2=$2-1;print}' ' BEGIN { M1='${p[16]}';M2='${p[18]}';M3='${p[8]}';M4='${p[3]}';} !/^A/{next};/%/ { getline;if($5<M1) o["CPU"]="CPU: user "$2"%, system "$4"%";next;} $2~/^disk/&&$4>M2 { o[$2]=$2": "$3" ops/s, "$4" blocks/s";next;} $2~/^(en[0-9]|bridg)/ { if(o[$2]) { e=$3+$4+$5+$6;if(e) o[$2]=o[$2]"; errors "e"/s";next;};if($4>M3||$6>M4) o[$2]=$2": in "int($4/1024)", out "int($6/1024)" (KiB/s)";} END { for(i in o) print o[i];} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' BEGIN{FS=": "} /^ {10}O/ {exit} /^ {0,12}[^ ]/ {next} $1~"Ne"&&$2!~/^In/{print} $1~"Si" { split($2,a," ");if(a[1]-a[4]<'${p[5]}') print;};$1~"T"&&$2<'${p[20]}'{print};$1~"Se"&&$2!~"2"{print};' ' BEGIN { FS="\f";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1;} ' ' BEGIN { split("'"${p[1]}"'",m);FS="\f";} $2<=m[$1]{next} $1<9 { o[$1]=o[$1]"\n "$3" (UID "$4"): "$2;} $1==9&&$5!~"^/dev" { o[$1]=o[$1]"\n "$3" (UID "$4") => "$5" (status "$6"): "$2;} $1==10&&$5 { p="ps -c -ocomm -p"$5"|sed 1d";p|getline n;close(p);if(n) $5=n;o[$1]=o[$1]"\n "$5" => "$3" (UID "$4"): "$2;} $1~/1[12]/ { o[$1]=o[$1]"\n "$3" (UID "$4", error "$5"): "$2;} END { n=split("'"${k[27]}"'",u,":");for(i=n+1;i<n+5;i++)u[i]=u[2];split("'"${k[28]}"'",l,":");for(i in o) print "\n"l[i]" ("u[i]")\n"o[i];} ' ' /^ {8}[^ ]/{print} ' ' BEGIN { L='${p[17]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"cksum "F|getline C;split(C, A);C=A[1];"stat -f%Sm "F|getline D;"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("'"${k[30]}"' "F|getline g) { l++;if(l<=L) f=f"\n "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F"\n '"${k[22]}"'"T;printf("'"${f[8]}"'",F,D,C,f);if(l>L) printf("'"${f[7]}"'",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' 's/^.{52}(.+) <.+/\1/p' ' /id: N|te: Y/{i++} END{print i} ' ' /kext:/ { split($0,a,":");p=a[1];k[S]='${k[25]}';k[U]='${k[26]}';v[S]="Safe";v[U]="true";for(i in k) { s=system("'"${k[30]}"'\\ :"k[i]" \""p"\"/*/I*|grep -qw "v[i]);if(!s) a[1]=a[1]" "i;};if(!a[2]) a[2]="'"${k[23]}"'";printf("'"${f[4]}"'",a[1],a[2]);next;} !/^ *$/ { p="'"${k[31]}"'\\ :'"${k[33]}"' \""$0"\"/*/'${k[32]}'";p|getline b;close(p);if(b~/, .+:/||b=="") b="'"${k[23]}"'";printf("'"${f[4]}"'",$0,b);} ' '/ en/!s/\.//p' ' NR>=13 { gsub(/[^0-9]/,"",$1);print;} ' ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?'${k[32]}'$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ / [VY]/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' '/^find: /!p;' ' /^p/{ s/.//g;x;s/\nu/'$'\f''/;s/(\n)c/\1'$'\f''/;s/\n\n//;p;};H;' ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;p;' ' s/^.+ |\(.+\)$//g;p;' '1;END{if(NR<'${p[15]}')printf("^/(S|usr/(X|li))")}' ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END{ if(i>1)print n} ' s/{'\.|jnl: ','P.+:'}'//;s/ +([0-9]+)(.+)/\2 \1/p' ' /es: ./{ s/^.+://;b0'$'\n'' };/^ +C.+ted: +[NY]/H;/:$/b0'$'\n'' d;:0'$'\n'' x;/: +N/d;s/\n.+//p;' ' 1d;/:$/b0'$'\n'' $b0'$'\n'' /(D|^ *Loc.+): /{ s/^.+: //;H;};/(B2|[my]): /H;d;:0'$'\n'' x;/[my]: [AM]|m: I.+p$|^\/Vo/d;s/(^|\n) [ -~]+//g;s/(.+)\n(.+)/\2:\1/;s/\n//g;/[ -~]/p;' 's/$/'$'\f''(0|-(4[34])?)$/p' '|sort'{'|uniq'{,\ -c},\ -nr} ' s/^/'{5,6,7,8}$'\f''/;s/ *'$'\f'' */'$'\f''/g;p;' '/e:/{print $2}' ' /^[(]/{ s/....//;s/$/:/;N;/: [)]$/d;s/\n.+ ([^ ]+).$/\1/;H;};${ g;p;} ' 's/:.+$//p' '|wc -l' /{\\.{kext,xpc,'(appex|pluginkit)'}'\/(Contents\/)?'Info,'Launch[AD].+'}'\.plist$/p' 's/([-+.?])/\\\1/g;p' 's/, /\'$'\n/g;p' ' BEGIN{FS="\f"} { printf("'"${f[6]}"'",$1/1048576,$2);} ' ' /= D/&&$1!~/'{${k[24]},${k[29]}}'/ { getline d;if(d~"t") D=D"\n"$1;} END { print D;} ' ' NR>1&&$3!~/0x|\.([0-9]{3,}|[-0-9A-F]{36})$/ { print $3"\f"$2;} ' '|tail -n'${p[6]} ' $1>1 { $NF=$NF" x"$1;} /\*/ { if(!f) f="\n\t* Code injection";} { $1="";} 1;END { print f;} ' ' s/.+bus /Bus: /;s/,.+[(]/ /;s/,.+//p;' ' { $NF=$NF" Errors: "$1;$1="";} 1 ' ' 1s/^/\'$'\n''/;/^ +(([MNPRSV]|De|Li).+|Bus): .|d: Y/d;s/:$//;$d;p;' ' BEGIN { RS=",";FS=":";} $1~"name" { gsub("\"","",$2);print $2;} ' '|grep -q e:/' '/[^ .]/p' '{ print $1}' ' /^ +N.+: [1-9]/ { i++;} END { if(i) print "system: "i;} ' ' NF { print "'{admin,user}' "$NF;exit;} ' ' /se.+ =/,/[\}]/!d;/[=\}]/!p ' ' 3,4d;/^ +D|Of|Fu| [0B]/d;s/^ |:$//g;$!H;${ x;/:/p;} ' ' BEGIN { FS=": ";} NR==1 { sub(":","");h="\n"$1"\n";} /:$/ { l=$1;next;} $1~"S"&&$2!~3 { getline;next;} /^ {6}I/ { i++;L[i]=l" "$2;if(i=='${p[24]}') nextfile;} END { if(i) print h;for(j=0;j<i;j++) print L[i-j];} ' ' /./H;${ x;s/\n//;s/\n/, /g;/,/p;} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab kextfind top pkgutil "${k[30]}\\" echo cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom 'mdfind -onlyin' env pluginkit scutil 'dtrace -q -x aggsortrev -n' security sed\ -En awk 'dscl . -read' networksetup mdutil lsof test osascript\ -e netstat mdls route cat );c2=(${k[21]}loginwindow\ LoginHook ' /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'" 'L*/Ca*/'${k[21]}'Saf*/E* -d 2 -name '${k[32]} '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' -i '-nl -print' '-F \$Sender -k Level Nle 3 -k Facility Req "'${k[21]}'('{'bird|.*i?clou','lsu|sha'}')"' "-f'%N: %l' Desktop {/,}L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message CRne '0xdc008012|(allow|call)ing|(mplet|nabl)ed|ry HD|safe b|xpm' -k Message CReq 'bad |Can.t l|corru|dead|fail|GPU |hfs: Ru|inval|Limiti|v_c|NVDA[(]|pagin|Purg(ed|in)|error|Refus|TCON|tim(ed? ?|ing )o|trig|WARN' " '-du -n DEV -n EDEV 1 10' 'acrx -o%cpu,comm,ruid' "' syscall::recvfrom:return {@a[execname,uid]=sum(arg0)} syscall::sendto:return {@b[execname,uid]=sum(arg0)} syscall::open*:entry {@c[execname,uid,copyinstr(arg0),errno]=count()} syscall::execve:return, syscall::posix_spawn:return {@d[execname,uid,ppid]=count()} syscall::fork:return, syscall::vfork:return, syscall::posix_spawn:return /arg0<0/ {@e[execname,uid,arg0]=count()} syscall:::return /errno!=0/ {@f[execname,uid,errno]=count()} io:::wait-start {self->t=timestamp} io:::wait-done /self->t/ { this->T=timestamp - self->t;@g[execname,uid]=sum(this->T);self->t=0;} io:::start {@h[execname,uid]=sum(args[0]->b_bcount)} tick-10sec { normalize(@a,2560000);normalize(@b,2560000);normalize(@c,10);normalize(@d,10);normalize(@e,10);normalize(@f,10);normalize(@g,10000000);normalize(@h,10240);printa(\"1\f%@d\f%s\f%d\n\",@a);printa(\"2\f%@d\f%s\f%d\n\",@b);printa(\"9\f%@d\f%s\f%d\f%s\f%d\n\",@c);printa(\"10\f%@d\f%s\f%d\f%d\n\",@d);printa(\"11\f%@d\f%s\f%d\f%d\n\",@e);printa(\"12\f%@d\f%s\f%d\f%d\n\",@f);printa(\"3\f%@d\f%s\f%d\n\",@g);printa(\"4\f%@d\f%s\f%d\n\",@h);exit(0);} '" '-f -pfc /var/db/r*/'${k[21]}'*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f'$'\f''%Sc'$'\f''%N -t%F {} \;' '/S*/*/Ca*/*xpc*' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' /\ kMDItemContentTypeTree=${k[21]}{bundle,mach-o-dylib} :Label "/p*/e*/{auto*,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {/p*,/usr/local}/e*/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*t .launchd.conf" list '-F "" -k Sender hidd -k Level Nle 3' /Library/Preferences/${k[21]}alf\ globalstate --proxy '-n get default' print\ system --dns -get{dnsservers,info} dump-trust-settings\ {-s,-d,} -n1 '-R -ce -l1 -n5 -o'{'prt -stats prt','mem -stats mem'}',command,uid' -kl -l -s\ / '--regexp --files '${k[21]}'pkg.*' '+c0 -i4TCP:0-1023' ${k[21]}dashboard\ layer-gadgets '-d /L*/Mana*/$USER' '-app Safari WebKitDNSPrefetchingEnabled' '-Fcu +c0 -l' -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' '-F \$Message -k Sender kernel -k Message CReq "'{'n Cause: -','(a und|I/O |jnl_io.+)err','USBF:.+bus'}'"' -name\ kMDItem${k[33]} -T\ hfs '-n get default' -listnetworkserviceorder :${k[33]} :CFBundleDisplayName $EUID {'$TMPDIR../C ','/{S*/,}'}'L*/{,Co*/*/*/L*/}{Cache,Log}s -type f -size +'${p[11]}'M -exec stat -f'%z\f%N' {} \;' \ /v*/d*/*/*l*d{,.*.$UID}/* '-app Safari UserStyleSheetEnabled' 'L*/A*/Fi*/P*/*/a*.json' users/$USER\ HomeDirectory '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' ' -F "\$Time \$(Sender): \$Message" -k Level Nle 3 -k Facility R'{'ne "user|','eq "'}'console" -k Message CRne "[{}<>]|commit - no t|deprec|Goog|realp|sandbox ex|/root" ' getenv '/ "kMDItemDateAdded>=\$time.now(-'${p[23]}')&&kMDItem'${k[33]}'=*"' -m\ / '' );N1=${#c2[@]};for j in {0..20};do c2[N1+j]=SP${k[j]}DataType;done;l=({Restricted\ ,Lock,Pro}files POST Battery {Safari,App,{Bad,Loaded}\ kernel,Firefox}\ extensions System\ load boot\ args FileVault\ {2,1} {Kernel,System,Console}\ log Activity SMC Login\ hook 'I/O per process' 'High file counts' UID Daemons Agents XPC\ cache Startup\ items {Admin,Root}\ access Stylesheet Library\ paths{,' ('{shell,launchd}\)} Font\ issues Firewall Proxies DNS TCP/IP Wi-Fi 'Elapsed time (sec)' {Root,User}\ crontab {Global,User}' login items' Spotlight Memory\ pressure Listeners Widgets Parental\ Controls Prefetching Nets Volumes {Continuity,I/O,iCloud,HID,HCI}\ errors {User,System}\ {caches/logs,overrides} Shutdown\ codes Heat Diagnostic\ reports Bad\ plists Free\ space VM Bundles{,' (new)'} Trust\ settings );N3=${#l[@]};for i in {0..8};do l[N3+i]=${k[5+i]};done;F() { local x="${s[$1]}";[[ "$x" =~ ^([\&\|\<\>]|$) ]]&&{ printf "$x";return;};:|${c1[30]} "$x" 2>&-;printf "%s \'%s\'" "|${c1[30+$?]}" "$x";};A0() { Q=6;v[2]=1;id -G|grep -qw 80;v[1]=$?;((v[1]))||{ Q=7;sudo -v;v[2]=$?;((v[2]))||Q=8;};v[3]=`date +%s`;date '+Start time: %T %D%n';printf '\n[Process started]\n\n'>&4;printf 'Revision: %s\n\n' ${p[0]};};A1() { local c="${c1[$1]} ${c2[$2]}";shift 2;c="$c ` while [[ "$1" ]];do F $1;shift;done`";((P2))&&{ c="sudo $c";P2=;};v=`eval "$c"`;[[ "$v" ]];};A2() { local c="${c1[$1]}";[[ "$c" =~ ^(awk|sed ) ]]&&c="$c '${s[$2]}'"||c="$c ${c2[$2]}";shift 2;local d=` while [[ "$1" ]];do F $1;shift;done`;((P2))&&{ c="sudo $c";P2=;};local a;v=` while read a;do eval "$c '$a' $d";done<<<"$v";`;[[ "$v" ]];};A3(){ v=$((`date +%s`-v[3]));};B1() { v=No;! ((v[1]))&&{ v=;P1=1;};};eval "`type -a B1|sed '1d;s/1/2/'`";B3(){ v[$1]="$v";};B4() { local i=$1;local j=$2;shift 2;local c="cat` while [[ "$1" ]];do F $1;shift;done`";v[j]=`eval "{ $c;}"<<<"${v[i]}"`;};B5(){ v="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d$'\e' <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F$'\e' ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`egrep -v "${v[$1]}"<<<"$v"|sort`;};eval "`type -a B7|sed '1d;s/7/8/;s/-v //'`";C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { B4 0 0 63&&C1 1 $1;};C4() { echo $'\t'"Part $((++P)) of $Q done at $((`date +%s`-v[3])) sec">&4;};C5() { sudo -k;pbcopy<<<"$o";printf '\n\tThe test results are on the Clipboard.\n\n\tPlease close this window.\n';exit 2>&-;};for i in 1 2;do eval D$((i-1))'() { A'$i' $@;C0;};';for j in 2 3;do eval D$((i+2*j-3))'() { local x=$1;shift;A'$i' $@;C'$j' $x;};';done;done;trap C5 2;o=$({ A0;D0 0 N1+1 2;D0 0 $N1 1;B1;C2 27;B1&&! B2&&C2 28;D2 22 15 63;D0 0 N1+2 3;D0 0 N1+15 17;D4 3 0 N1+3 4;D4 4 0 N1+4 5;D4 N3+4 0 N1+9 59;D0 0 N1+16 99; for i in 0 1 2;do D4 N3+i 0 N1+5+i 6;done;D4 N3+3 0 N1+8 71;D4 62 1 10 7;D4 10 1 11 8;B2&&D4 18 19 53 67;D2 11 2 12 9;D2 12 3 13 10;D2 13 32 70 101 25;D2 65 6 76 13;D2 45 20 52 66;D4 66 7 77 14;D4 17 8 15 38;D0 9 16 16 77 45;C4;B2&&D0 35 49 61 75 76 78 45;B2&&{ D0 28 17 45;C4;};D0 12 40 54 16 79 45;D0 12 39 54 16 80 45;D4 31 25 77 15&&{ B4 0 8 103;B4 8 0;A2 18 74;B6 8 0 3;C3 32;};B2&&D4 19 21 0;B2&&D4 40 10 42;D2 2 0 N1+19 46 84;D2 44 34 43 53;D2 25 22 20 32;D2 33 0 N1+14 51;for i in {0..2};do A1 29 35+i 104+i;B3 25+i;done;B6 25 27 5;B6 0 26 5;B4 0 0 110;C2 69;D2 34 21 28 35;D4 35 27 29 36;A1 40 59 81;B3 18;A1 33 60 82;B8 18;B4 0 19 83;A1 27 32 39&&{ B3 20;B4 19 0;A2 33 33 40;B3 21;B6 20 21 3;};C2 36;D4 50 38 5 68;B4 19 0;D5 37 33 34 42;B2&&D4 46 35 45 55;D4 38 0 N1+20 43;B2&&D4 59 4 65 76 91;D4 63 4 19 44 75 95 96;B1&&{ D4 53 5 55 75 69&&D4 51 6 58 31;D4 56 5 56 97 75 98&&D0 0 N1+7 99;D2 55 5 27 84;D4 61 5 54 75 70;D4 14 5 14 12;D4 15 5 72 12;C4;};D4 16 5 73 12;A1 13 44 74 18;C4;B3 4;B4 4 0 85;A2 14 61 89;B4 0 5 19 102;A1 17 41 50;B7 5;C3 8;B4 4 0 88;A2 14 24 89;C4;B4 0 6 19 102;B4 4 0 86;A2 14 61 89;B4 0 7 19 102;B5 6 7;B4 0 11 73 102;A1 18 31 107 94 74||{ B2&&A1 18 26 94 74;}&&{ B7 11;B4 0 0 11;C3 23;};A1 18 26 94;B7 11;B4 0 0 11;C3 24;D4 60 14 66 92;D4 58 14 67 93;D4 26 4 21 24;D4 42 14 1 62;D4 43 37 2 90 48;D4 41 10 42;D2 48 36 47 25;A1 4 3 60&&{ B3 9;A2 14 61;B4 0 10 21;B4 9 0;A2 14 62;B4 0 0 21;B6 0 10 4;C3 5;};D4 9 41 69 100;D2 29 21 68 35;D2 49 21 48 49;B4 4 22 57 102;A1 21 46 56 74;B7 22;B4 0 0 58;C3 47;D4 54 5 7 75 76 69;D4 52 5 8 75 76 69;D4 57 4 64 76 91;D2 0 4 4 84;D2 1 4 51 84;D4 21 22 9 37;D0 0 N1+17 108; A1 23 18 28 89;B4 0 16 22 102;A1 16 25 33;B7 16;B4 0 0 34;D1 31 47;D4 64 4 71 41;C4;B4 4 12 26 89 23 102;for i in {0..3};do A1 0 N1+10+i 72 74;B7 12;B4 0 0 52;C3 N3+5+i;((i))||C4;done;A1 24 22 29;B7 12;B3 14;A2 39 57 30;B3 15;B6 14 15 4;C3 67;A1 24 75 74;B3 23;A2 39 57 30;B3 24;B6 23 24 4;C3 68;B4 4 13 27 89 65;A1 24 23;B7 13;C3 30;B4 4 0 87;A2 14 61 89 20;B4 0 17;A1 26 50 64;B7 17;C3 6;D0 0 N1+18 109;D4 7 11 6;A3;C2 39;C4;} 4>&2 2>/dev/null;);C5
Copy the selected text to the Clipboard by pressing the key combination command-C.
8. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad and start typing the name.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter
exec bash
and press return. Then paste the script again.
10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:
[Process started]
Part 1 of 8 done at … sec
Part 8 of 8 done at … sec
The test results are on the Clipboard.
Please close this window.
[Process completed]
The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.
Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.
12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.
14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I may not agree with them.
Copyright © 2014, 2015 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed. -
My Firefox browser has been overtaken by the "install Torch Browser" and "www.newhtsoft.com - Free home tab" pop up screens. These pop ups continue to request I download and install their software. Currently, this appears to be only affecting Firefox, but I've read this can also affect other browsers. I am not a programer or experienced root user, but if there is a fix, I would welcome all feedback. Below is my system profiler report:
Hardware Information:
iMac (21.5-inch, Late 2009)
iMac - model: iMac10,1
1 3.06 GHz Intel Core 2 Duo CPU: 2 cores
4 GB RAM
Video Information:
NVIDIA GeForce 9400 - VRAM: 256 MB
System Software:
Mac OS X 10.6.8 (10K549) - Uptime: 0 days 1:12:42
Disk Information:
ST3500418ASQ disk0 : (465.76 GB)
(null) (disk0s1) <not mounted>: 200 MB
Macintosh HD (disk0s2) / [Startup]: 465.44 GB (4.44 GB free) (Low!)
HL-DT-ST DVDRW GA11N
USB Information:
Apple Inc. Built-in iSight
Apple Internal Memory Card Reader
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Computer, Inc. IR Receiver
FireWire Information:
Thunderbolt Information:
Kernel Extensions:
com.rim.driver.BlackBerryUSBDriverInt (0.0.64)
Problem System Launch Daemons:
[System] org.samba.winbindd.plist 3rd-Party support link
Launch Daemons:
[System] com.adobe.fpsaud.plist 3rd-Party support link
[System] com.rim.BBDaemon.plist 3rd-Party support link
Launch Agents:
[System] com.rim.BBLaunchAgent.plist 3rd-Party support link
User Launch Agents:
[not loaded] com.google.keystone.agent.plist 3rd-Party support link
User Login Items:
Android File Transfer Agent
Dropbox
BlackBerry Device Manager
Internet Plug-ins:
Flip4Mac WMV Plugin: Version: 2.3.2.6 3rd-Party support link
FlashPlayer-10.6: Version: 12.0.0.70 - SDK 10.6 3rd-Party support link
JavaAppletPlugin: Version: 13.9.8 - SDK 10.6 Outdated! Update
Flash Player: Version: 12.0.0.70 - SDK 10.6 3rd-Party support link
QuickTime Plugin: Version: 7.6.6
DivXBrowserPlugin: Version: 2.0 3rd-Party support link
CitrixICAClientPlugIn: Version: 11.4.3 - SDK 10.0 3rd-Party support link
Google Earth Web Plug-in: Version: 7.1 3rd-Party support link
OfficeLiveBrowserPlugin: Version: 12.3.6 3rd-Party support link
Silverlight: Version: 3.0.50106.0 3rd-Party support link
iPhotoPhotocast: Version: 7.0
iTunes Plug-ins:
Quartz Composer Visualizer: Version: 1.2
3rd Party Preference Panes:
Flash Player 3rd-Party support link
Old Applications:
Citrix Receiver: Version: 11.4.3 - SDK 10.0 3rd-Party support link
Time Machine:
Time Machine information requires OS X 10.7 "Lion" or later.
Top Processes by CPU:
2% EtreCheck
1% WindowServer
1% mds
1% WebProcess
0% ps
Top Processes by Memory:
246 MB WebProcess
90 MB Safari
74 MB WindowServer
61 MB Microsoft Excel
57 MB Finder
Virtual Memory Information:
2.15 GB Free RAM
779 MB Active RAM
502 MB Inactive RAM
359 MB Wired RAM
323 MB Page-ins
0 B Page-outsThe too-full hard disk drive is an issue to contend with, a backup to external hard disk drive is recommended, then you can remove any user created (itunes, iphoto, movies) once reliable libraries are moved or copied to the external. There is a way to move libraries, etc correctly so they can be used by their associated applications.
That is not why I am writing now.
I'm curious about how your computer arrived at possibly having adware installed, and what kind it has in it, or at least in the Firefox browser (or other locations) since the Install Torch is a proof of some kind of adware... And you should look into
•The Safe Mac: Adware Removal Guide
http://www.thesafemac.com/arg/
From a web site suggesting another path to cure that, the following suggests anyone with the issue you describe to download & install some probably bogus removal tools to be rid of the stuff your computer is doing, but really the answer is in the Adware removal guide....
"Victims often notice Torch Browser or Torch add-ons and extensions such as Torch Music installed onto their computers without consent. if this is the case, it is likely that Torch Browser bundled with previous downloads including freeware, shareware, codecs, and torrents. Torch Browser primarily bundles with media related software including video converters and P2P clients, as well as third-party browser add-ons, extensions, plug-ins, and Toolbars." -- this, from a possibly bogus site where one could get an Uninstaller; but their removal tool can be a source of bigger problems, since it Installs more stuff.
The adware known as Conduit has been said to probably be behind this but there may be others. There are a few things the Safe Mac pages can help you find out about the item affecting your browser. These adware malware items can affect other browsers, in the same way it may have affected your FireFox. This appears to have been going on for a time, and likely has evolved since it first appeared a year or two ago.
So, this is something to look into.
Good luck & happy computing! -
System is slow, pop ups, adware
My mac is acting slow, i'm getting lots of pop ups, and i'm not computer savy.
I"m running the Avast Free Antivirus in the background.
Can you help me?
This is the result of the EtreCheck
Hardware Information:
iMac (27-inch, Mid 2010)
iMac - model: iMac11,3
1 2.8 GHz Intel Core i5 CPU: 4 cores
12 GB RAM
Video Information:
ATI Radeon HD 5750 - VRAM: 1024 MB
System Software:
Mac OS X 10.7.5 (11G63b) - Uptime: 3 days 10:48:49
Disk Information:
WDC WD1001FALS-40Y6A0 disk0 : (1 TB)
disk0s1 (disk0s1) <not mounted>: 209.7 MB
HD (disk0s2) / [Startup]: 999.35 GB (250.03 GB free)
OPTIARC DVD RW AD-5680H
USB Information:
Western Digital My Book 1140 3 TB
disk4s1 (disk4s1) <not mounted>: 209.7 MB
Backup 1 2012 (disk4s2) /Volumes/Backup 1 2012: 3 TB (1.39 TB free)
Wacom Co.,Ltd. CTL-460
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Internal Memory Card Reader 63.86 GB
EOS_DIGITAL (disk1s1) /Volumes/EOS_DIGITAL 1: 63.85 GB (40.71 GB free)
SanDisk ImageMate CF Reader/Writer 32.01 GB
EOS_DIGITAL (disk3s1) /Volumes/EOS_DIGITAL: 32.01 GB (28.21 GB free)
Western Digital My Passport 07A8 500.07 GB
disk2s1 (disk2s1) <not mounted>: 32 KB
My Passport for Mac (disk2s3) /Volumes/My Passport for Mac: 499.94 GB (121.24 GB free)
Apple Computer, Inc. IR Receiver
Apple Inc. Built-in iSight
FireWire Information:
Thunderbolt Information:
Configuration files:
Kernel Extensions:
[kext loaded] com.Cycling74.driver.Soundflower (1.6.6 - SDK 10.6) Support
[not loaded] com.aladdin.kext.aksfridge (1.0.2) Support
[kext loaded] com.avast.AvastFileShield (2.1.0 - SDK 10.9) Support
[kext loaded] com.avast.PacketForwarder (1.4 - SDK 10.9) Support
[kext loaded] com.bresink.driver.BRESINKx86Monitoring (8.0) Support
[not loaded] com.devguru.driver.SamsungACMControl (1.2.61 - SDK 10.6) Support
[not loaded] com.devguru.driver.SamsungACMData (1.2.61 - SDK 10.6) Support
[not loaded] com.devguru.driver.SamsungComposite (1.2.61 - SDK 10.6) Support
[not loaded] com.devguru.driver.SamsungMTP (1.2.61 - SDK 10.5) Support
[not loaded] com.devguru.driver.SamsungSerial (1.2.61 - SDK 10.6) Support
[not loaded] com.wacom.kext.pentablet (5.2.1) Support
[kext loaded] org.virtualbox.kext.VBoxDrv (4.1.2) Support
[kext loaded] org.virtualbox.kext.VBoxNetAdp (4.1.2) Support
[kext loaded] org.virtualbox.kext.VBoxNetFlt (4.1.2) Support
[kext loaded] org.virtualbox.kext.VBoxUSB (4.1.2) Support
Startup Items:
HP IO: Path: /Library/StartupItems/HP IO
HP Trap Monitor: Path: /Library/StartupItems/HP Trap Monitor
VirtualBox: Path: /Library/StartupItems/VirtualBox
Launch Daemons:
[loaded] com.adobe.fpsaud.plist Support
[loaded] com.adobe.SwitchBoard.plist Support
[loaded] com.adobe.versioncueCS4.plist Support
[running] com.aladdin.aksusbd.plist Support
[failed] com.aladdin.hasplmd.plist Support
[loaded] com.avast.init.plist Support
[loaded] com.avast.uninstall.plist Support
[loaded] com.google.keystone.daemon.plist Support
[loaded] com.oracle.java.Helper-Tool.plist Support
[running] com.parallels.desktop.launchdaemon.plist Support
[running] com.xrite.device.xrdd.plist Support
Launch Agents:
[not loaded] com.adobe.AAM.Updater-1.0.plist Support
[loaded] com.adobe.CS4ServiceManager.plist Support
[loaded] com.adobe.CS5ServiceManager.plist Support
[loaded] com.avast.userinit.plist Support
[loaded] com.citrix.AuthManager_Mac.plist Support
[running] com.citrix.ServiceRecords.plist Support
[running] com.epson.Epson_Low_Ink_Reminder.launcher.plist Support
[running] com.epson.epw.agent.plist Support
[running] com.epson.eventmanager.agent.plist Support
[loaded] com.google.keystone.agent.plist Support
[loaded] com.oracle.java.Java-Updater.plist Support
[loaded] com.parallels.desktop.launch.plist Support
[running] com.parallels.vm.prl_pcproxy.plist Support
[running] com.wacom.pentablet.plist Support
User Launch Agents:
[loaded] com.avast.home.userinit.plist Support
[loaded] com.macpaw.CleanMyMac.helperTool.plist Support
[loaded] com.macpaw.CleanMyMac.volumeWatcher.plist Support
[not loaded] org.virtualbox.vboxwebsrv.plist Support
User Login Items:
iTunesHelper
i1ProfilerD2LionEditionTray
Chrometa
Dropbox
Copy
smcFanControl
fuspredownloader
Launch Nikon Message Center 2
Internet Plug-ins:
o1dbrowserplugin: Version: 5.3.0.18358 Support
WacomNetscape: Version: 1.1.0-4 Support
Google Earth Web Plug-in: Version: 6.1 Support
WacomSafari: Version: 1.1.0-4 Support
Flip4Mac WMV Plugin: Version: 2.3.0.14 Support
AmazonMP3DownloaderPlugin101750: Version: AmazonMP3DownloaderPlugin 1.0.17 - SDK 10.4 Support
AdobePDFViewerNPAPI: Version: 10.1.3 Support
FlashPlayer-10.6: Version: 13.0.0.201 - SDK 10.6 Support
Silverlight: Version: 5.1.20513.0 - SDK 10.6 Support
Flash Player: Version: 13.0.0.201 - SDK 10.6 Support
iPhotoPhotocast: Version: 7.0
CitrixICAClientPlugIn: Version: 1.0 - SDK 10.6 Support
googletalkbrowserplugin: Version: 5.3.0.18358 Support
AdobePDFViewer: Version: 10.1.3 Support
NP_2020Player_IKEA: Version: 5.0.94.1 - SDK 10.6 Support
QuickTime Plugin: Version: 7.7.1
JavaAppletPlugin: Version: Java 7 Update 25 Mismatch! Oracle recommends Java 7 Update 55
Safari Extensions:
AdBlock: Version: 2.5.61
Audio Plug-ins:
iSightAudio: Version: 7.7.1 - SDK 10.7
iTunes Plug-ins:
Quartz Composer Visualizer: Version: 1.3 - SDK 10.7
3rd Party Preference Panes:
Adobe Version Cue CS4 Support
avast! Preferences Support
PenTablet Support
Citrix ShareFile Sync Support
Déjà Vu Support
Flash Player Support
Flip4Mac WMV Support
Growl Support
Java Support
MacFUSE Support
Time Machine:
Time Machine not configured!
Top Processes by CPU:
77% avast!
3% WindowServer
1% hidd
0% smcFanControl
0% Pages
Top Processes by Memory:
307 MB Safari
295 MB WebProcess
209 MB Finder
197 MB avast!
147 MB Pages
Virtual Memory Information:
2.43 GB Free RAM
4.56 GB Active RAM
4.02 GB Inactive RAM
1015 MB Wired RAM
34.91 GB Page-ins
6 MB Page-outsRemove these apps. Computer will run faster.
loaded] com.avast.home.userinit.plist Support
[loaded] com.macpaw.CleanMyMac.helperTool.plist Support
[loaded] com.macpaw.CleanMyMac.volumeWatcher.plist Support
Avast antivirus sofrware doesn't help.
Top Processes by CPU:
77% avast!
Identify and remove adware/malware
http://www.thesafemac.com/arg/
Maybe you are looking for
-
Error while trying to deploy BIDS Cube
Hi I have created a Cube, and when I'm trying to deploy it I'm getting errors. First error it's on Calculations Tab on a Cube under Metadata: "Error loading metadata connection is not open" There's also another error: "Unable to query 'AdventureWorks
-
HELP! Cannot install itunes 11.1.3.8
I'm unable to add new songs or pictures to my iphone because my itunes is not up to date but when I try to download the lastest version I get the following error message... Any ideas how to solve this? Please Help!
-
Hi folks, Another glitch I cannot seem to work around. I'm digging the new calender app in Mavericks. After I type in an address into the calendar, the map and weather don't pop up. Any ideas?
-
Finding column count with dynamic columns and dynamic tables
I've done some PL/SQL for awhile now but was trying to devise a solution for the following problem: I wish to find the number of times a specific value for a column exists in all the tables that contain the field and I have access to see with the cur
-
Hi, I've been given a PDF with a video file embedded in it. Is there anyway I can export the video file out of the PDF? Thanks