Unwanted Pop-up ads in all browsers

Hello, guys! This is my first post. I've had two Mac computers in my life and never really had any problems until yesterday.
I have a MacBook Air (13-inch, Mid 2013), Processor 1.3 GHz Intel Core i5 and Memory 4GB 1600 MHz DDR3 (I don't know what any of this means but its suggested info). I'm running OS Yosemite V.10.10.2, Safari V.8.0.3 and Chrome V.40.0.2214.115 (64-bit).
Anyway, since yesterday when I open certain webpages (not "serious" ones like Google or Facebook) I get layers of ads, mostly in Russian. I know they are not coming from the site because I've visited them before and it's always the same two ads, appearing on many sites. I'm also getting a pop-up ad from a "adultyum.info" site (very graphic ****). This happens on both Safari and Chrome, particularly when I click on a link or use the search bar.
First I checked for Adware using The Safe Mac's Adware Medic (it found nothing), then I checked with Bitdefender (found lots of Genieo, but they've been removed and the ads keep on appearing).
I've checked the Launch Agents folder, nothing seems amiss there. I couldn't open the Launch Daemons folder (Finder couldn't find it).
Then I installed the Adblock extension on Chrome. In general, the ads no longer show up but I got the **** pop-up once. Safari is another story, they all keep showing up, so my guess is it's something on my computer.
I figured out, since most of the ads are in Russian, that adware/malware was installed on my computer yesterday when I downloaded a torrent file from a Russian website: http://rutracker.org/forum/viewtopic.php?t=3763287 (DO NOT DOWNLOAD ANYTHING FROM THERE). Anyway, the torrent file didn't open and Transmission crashed. Now I'm getting these annoying and offensive ads and adware removal apps can't find the source.
Is this some sort of new trojan? Has this happened to you and do you know how to fix it?
Thanks a lot for your help!

Hey!
I'm going to send the report to thomas_r. for analysis. And, as for Etrecheck, here it goes:
EtreCheck version: 2.1.8 (121)
Report generated February 21, 2015 at 4:26:10 AM GMT-5
Download EtreCheck from http://etresoft.com/etrecheck
Click the [Click for support] links for help with non-Apple products.
Click the [Click for details] links for more information about that line.
Hardware Information: ℹ️
    MacBook Air (13-inch, Mid 2013) (Technical Specifications)
    MacBook Air - model: MacBookAir6,2
    1 1.3 GHz Intel Core i5 CPU: 2-core
    4 GB RAM Not upgradeable
        BANK 0/DIMM0
            2 GB DDR3 1600 MHz ok
        BANK 1/DIMM0
            2 GB DDR3 1600 MHz ok
    Bluetooth: Good - Handoff/Airdrop2 supported
    Wireless: en0: 802.11 a/b/g/n/ac
    Battery Health: Normal - Cycle count 599
Video Information: ℹ️
    Intel HD Graphics 5000
        Color LCD 1440 x 900
System Software: ℹ️
    OS X 10.10.2 (14C109) - Time since boot: 0:5:7
Disk Information: ℹ️
    APPLE SSD SM0128F disk0 : (121.33 GB)
        EFI (disk0s1) <not mounted> : 210 MB
        Macintosh HD (disk0s2) / : 120.47 GB (16.22 GB free)
        Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
USB Information: ℹ️
    Apple Internal Memory Card Reader
    Apple Inc. BRCM20702 Hub
        Apple Inc. Bluetooth USB Host Controller
Thunderbolt Information: ℹ️
    Apple Inc. thunderbolt_bus
Gatekeeper: ℹ️
    Mac App Store and identified developers
Kernel Extensions: ℹ️
        /System/Library/Extensions
    [not loaded]    com.devguru.driver.SamsungComposite (1.4.14 - SDK 10.6) [Click for support]
        /System/Library/Extensions/ssuddrv.kext/Contents/PlugIns
    [not loaded]    com.devguru.driver.SamsungACMControl (1.4.14 - SDK 10.6) [Click for support]
    [not loaded]    com.devguru.driver.SamsungACMData (1.4.14 - SDK 10.6) [Click for support]
    [not loaded]    com.devguru.driver.SamsungMTP (1.4.14 - SDK 10.5) [Click for support]
    [not loaded]    com.devguru.driver.SamsungSerial (1.4.14 - SDK 10.6) [Click for support]
Launch Agents: ℹ️
    [failed]    com.divx.dms.agent.plist [Click for support] [Click for details]
    [loaded]    com.divx.update.agent.plist [Click for support]
    [loaded]    com.oracle.java.Java-Updater.plist [Click for support]
    [loaded]    com.paragon.updater.plist [Click for support]
    [not loaded]    com.teamviewer.teamviewer.plist [Click for support]
    [not loaded]    com.teamviewer.teamviewer_desktop.plist [Click for support]
Launch Daemons: ℹ️
    [loaded]    com.adobe.fpsaud.plist [Click for support]
    [loaded]    com.anchorfree.ajaxserver.plist [Click for support]
    [loaded]    com.microsoft.office.licensing.helper.plist [Click for support]
    [loaded]    com.oracle.java.Helper-Tool.plist [Click for support]
    [loaded]    com.oracle.java.JavaUpdateHelper.plist [Click for support]
    [not loaded]    com.teamviewer.teamviewer_service.plist [Click for support]
User Launch Agents: ℹ️
    [loaded]    com.adobe.ARM.[...].plist [Click for support]
User Login Items: ℹ️
    iTunesHelper    Application (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
    Dropbox    Application (/Applications/Dropbox.app)
    AdobeResourceSynchronizer    Application Hidden (/Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app)
    Alarm Clock    Application (/Applications/Alarm Clock.app)
    Google Chrome    Application (/Applications/Google Chrome.app)
    KiesAgent    Application Hidden (/Applications/Kies.app/Contents/MacOS/KiesAgent.app)
Internet Plug-ins: ℹ️
    FlashPlayer-10.6: Version: 16.0.0.305 - SDK 10.6 [Click for support]
    OVSHelper: Version: 1.1 [Click for support]
    AdobePDFViewerNPAPI: Version: 11.0.10 - SDK 10.6 [Click for support]
    AdobePDFViewer: Version: 11.0.10 - SDK 10.6 [Click for support]
    Flash Player: Version: 16.0.0.305 - SDK 10.6 [Click for support]
    Default Browser: Version: 600 - SDK 10.10
    QuickTime Plugin: Version: 7.7.3
    SharePointBrowserPlugin: Version: 14.0.0 [Click for support]
    Unity Web Player: Version: UnityPlayer version 4.5.2f1 - SDK 10.6 [Click for support]
    Silverlight: Version: 5.1.30514.0 - SDK 10.6 [Click for support]
    JavaAppletPlugin: Version: Java 7 Update 71 Check version
3rd Party Preference Panes: ℹ️
    Flash Player [Click for support]
    Java [Click for support]
Time Machine: ℹ️
    Auto backup: YES
    Volumes being backed up:
        Macintosh HD: Disk size: 120.47 GB Disk used: 104.25 GB
    Destinations:
        Manuela [Local]
        Total size: 999.86 GB
        Total number of backups: 28
        Oldest backup: 2013-09-01 07:15:55 +0000
        Last backup: 2015-02-21 09:12:56 +0000
        Size of backup disk: Excellent
            Backup size 999.86 GB > (Disk size 120.47 GB X 3)
Top Processes by CPU: ℹ️
        78%    firefox
         9%    WindowServer
         7%    plugin-container
         1%    Google Chrome
         1%    hidd
Top Processes by Memory: ℹ️
    283 MB    firefox
    175 MB    Google Chrome
    150 MB    Google Chrome Helper
    99 MB    ocspd
    86 MB    Finder
Virtual Memory Information: ℹ️
    261 MB    Free RAM
    1.77 GB    Active RAM
    1.53 GB    Inactive RAM
    739 MB    Wired RAM
    1.19 GB    Page-ins
    57 KB    Page-outs
Diagnostics Information: ℹ️
    Feb 21, 2015, 04:21:06 AM    /Users/[redacted]/Library/Logs/DiagnosticReports/DMSLaunch_2015-02-21-042106_[r edacted].crash
    Feb 21, 2015, 04:20:42 AM    Self test - passed
    Feb 21, 2015, 04:16:10 AM    /Users/[redacted]/Library/Logs/DiagnosticReports/AddressBookSourceSync_2015-02- 21-041610_[redacted].crash
    Feb 21, 2015, 04:16:08 AM    /Users/[redacted]/Library/Logs/DiagnosticReports/com.apple.internetaccounts_201 5-02-21-041608_[redacted].crash
    Feb 21, 2015, 01:39:24 AM    /Users/[redacted]/Library/Logs/DiagnosticReports/DMSLaunch_2015-02-21-013924_[r edacted].crash
    Feb 21, 2015, 01:33:59 AM    /Library/Logs/DiagnosticReports/AdwareMedic_2015-02-21-013359_[redacted].hang
    Feb 21, 2015, 01:28:24 AM    /Users/[redacted]/Library/Logs/DiagnosticReports/DMSLaunch_2015-02-21-012824_[r edacted].crash
    Feb 21, 2015, 12:45:34 AM    /Library/Logs/DiagnosticReports/BitdefenderVirusScanner_2015-02-21-004534_[reda cted].cpu_resource.diag [Click for details]
    Feb 21, 2015, 12:41:23 AM    /Library/Logs/DiagnosticReports/Dropbox109_2015-02-21-004123_[redacted].cpu_res ource.diag [Click for details]
    Feb 21, 2015, 12:38:50 AM    /Users/[redacted]/Library/Logs/DiagnosticReports/DMSLaunch_2015-02-21-003850_[r edacted].crash
    Feb 21, 2015, 02:24:27 AM    /Library/Logs/DiagnosticReports/BitdefenderVirusScanner_2015-02-21-022427_[reda cted].cpu_resource.diag [Click for details]
    Feb 21, 2015, 12:31:06 AM    /Library/Logs/DiagnosticReports/installd_2015-02-21-003106_[redacted].cpu_resou rce.diag [Click for details]
    Feb 21, 2015, 12:25:21 AM    /Library/Logs/DiagnosticReports/DesktopServicesHelper_2015-02-21-002521_[redact ed].cpu_resource.diag [Click for details]
    Feb 20, 2015, 04:59:49 PM    /Users/[redacted]/Library/Logs/DiagnosticReports/DMSLaunch_2015-02-20-165949_[r edacted].crash
    Feb 20, 2015, 04:54:27 PM    /Library/Logs/DiagnosticReports/???_2015-02-20-165427_[redacted].cpu_resource.d iag [Click for details]
BTW, what is the "hidd" 1% in processes?
PS: I also checked on firefox. The ads are showing up too.

Similar Messages

How can you remove unwanted pop-up ads and the virus creating them?

I think I downloaded virus which causes unwanted pop-up ads that cannot be removed. There is only the option to minimize, not close and they continually pop-up. What can be done to run a safe virus scan and remove the unwanted pop-ups?

Force Quit .
Press command + option + esc keys together at the same time. Wait.
When Force Quit window appears, select the application if not already.
Press Force Quit button at the bottom of the window. Wait.
Application will quit.
If this does not help, press the power button for 7 or more seconds.
Computer will shut down.
Relaunch Safari holding the shift key down.
Identify and remove adware/malware
http://www.thesafemac.com/arg/
http://www.thesafemac.com/mmg/

I keep getting pop up ads on all my browsers since I installed mackeeper

I installed mackeeper yesterday thinking it was an apple-made app. Upon realising it wasn't I promptly uninstalled it following instructions online. I think I managed to delete the whole thing (using the uninstaller), but now I'm getting heaps of pop up ads even though all my block pop ups are activated. I don't even need to click a link and a random ad comes up. I've never had problems with ads popping up unless I'm on a free video streaming site (which I rarely am, and even after I leave those pages I don't get anymore ads popping up). So I think it's got to do with the stupid mackeeper app that was installed. Can anyone help me out? I'd rather not have to install anymore stuff to prevent pop ups when I've never had this problem in the past without needing an extra blocker app installed.
Thanks in advance.

If you do not want to install additional software, use the method given by Apple.
   Removing the adware manually by following the “HowTo” from Apple.
   http://support.apple.com/en-us/HT203987
Otherwise try this.
This app will remove existing adware. This will not prevent any future adware infection.
You can uninstall this app after using it.
1. Use free AdwareMedic to remove adware
    http://www.adwaremedic.com/index.php
   Install , open, and run it by clicking “Scan for Adware” button   to remove adware.
   Once done, quit AdwareMedic.
2. Safari > Preferences > Extensions
    Turn those off and relaunch Safari.
    Turn those on one by one and test.
3. Safari > Preferences > Search > Search Engine :
    Select your preferred   search engine.
MacKeeper removal:
http://applehelpwriter.com/2011/09/21/how-to-uninstall-mackeeper-malware/

HT203987 Ad Pop ups coming in all browsers on Mac

Since morning my Mac (running Yosemite) is showing pop ups with on the right bottom of all browsers and at times opens a new tab going to Mackeeper website. I tried various stuff posted on the forum like
searching for various items in Finder as described here by Apple Support
installing & scanning through AdwareMedic
removing all extensions from all browsers
off course rebooting the system
opening URLs in Incognito mode
These obscene pop ups keep showing up in All Browsers. Interestingly they do not appear on some websites or when I doing Google Search or viewing pages on Apple Forums but keep coming on most of the sites I m visiting. I tried visiting the same websites on by MacBook and every thing is clean there.
Only different thing than my usual work I did on this Mac was to download & install Audacity from audacity.sourceforge.net/download/mac. The other thing was I tried downloading Inkscape from https://inkscape.org/en/download/mac-os/ which asked me to install XQuartz from xquartz.macosforge.org which I stopped in between. Not sure if any of these is causing the issue.
More importantly, how do I get rid of these pop ups. Willing to buy any good paid software from Mac Store if that helps.
Thanks

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.
Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.
You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.
In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.
You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.
Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.
4. Here's a summary of what you need to do, if you choose to proceed:
☞ Copy a line of text in this window to the Clipboard.
☞ Paste into the window of another application.
☞ Wait for the test to run. It usually takes a few minutes.
☞ Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.
You may have started up in "safe" mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(1251 ' 0.5 0.25 10 1000 15 5120 1000 25000 1 1 0 100 ' 51 25600 4 10 25 5120 102400 1000 25 1000 225 40 500 300 85 25 20480 262144 20 2000 524288 604800 5 );k=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth SerialATA Extensions Applications Frameworks PrefPane Fonts Displays PCI UniversalAccess InstallHistory ConfigurationProfile AirPort 'com\.apple\.' -\\t N\\/A 'AES|atr|udit|msa|dnse|ax|ensh|fami|FileS|fing|ft[pw]|gedC|kdu|etS|is\.|alk|ODSA|otp|htt|pcas|ps-lp|rexe|rlo|rsh|smb|snm|teln|upd-[aw]|uuc|vix|webf' OSBundle{Require,AllowUserLoa}d 'Mb/s:per sec:ms/s:KiB/s:%:total:MB:total' 'Net in:Net out:I/O wait time:I/O requests:CPU usage:Open files:Memory:Mach ports:File opens:Forks:Failed forks:System errors' 'tsA|[ST]M[HL]' PlistBuddy{,' 2>&1'}' -c Print' 'Info\.plist' CFBundleIdentifier );f=('\n%s'{': ','\n\n'}'%s\n' '\nRAM details\n%s\n' %s{' ','\n'{"${k[22]}",}}'%s\n' '%d MB: %s\n' '\n ...and %s more line(s)\n' '\nContents of %s\n '"${k[22]}"'mod date: %s\n '"${k[22]}"'checksum: %s\n%s\n' );c=(879294308 4071182229 461455494 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 2636415542 3694147963 1233118628 2456546649 2806998573 2778718105 842973933 2051385900 3301885676 891055588 998894468 695903914 1443423563 4136085286 3374894509 1051159591 892310726 1707497389 523110921 2883943871 3873345487 );s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[4]} ' s/:$//;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[9]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' BEGIN { FS="\f";if(system("sw_vers -productVersion|grep -q ^10\.1")) d="^'"${k[21]}"'launch(d\.peruser\.[0-9]+|ctl\.(Aqua|Background|System))$";} { if($2~/[1-9]/) { $2="status: "$2;printf("'"${f[4]}"'",$1,$2);} else if(!d||$1!~d) print $1;} ' ' { sub(/ :/,"");print|"tail -n'${p[10]}'";} ' ' NR==2&&$4<='${p[7]}' { print $4;} ' ' ($1~"wir"&&$2>'${p[22]}')||($1~/P.+ts:/&&$2>'${p[19]}') { print $1" "int($2);} ' '/YLD/s/=/ /p' ' { q=$1;$1="";u=$NF;$NF="";gsub(/ +$/,"");print q"\f"$0"\f"u;} ' ' /^ {6}[^ ]/d;s/:$//;/([^ey]|[^n]e):/d;/e: Y/d;s/: Y.+//g;H;${ g;s/ \n (\n)/\1/g;s/\n +(M[^ ]+)[ -~]+/ (\1)/;s/\n$//;/( {8}[^ ].*){2,}/p;} ' 's:^:/:p;' ' !/, .+:/{print};END{if(NR<'{${p[12]},${p[13]}}')printf("^'"${k[21]}"'.+")} ' '|uniq' ' 1;END { print "/L.+/Scr.+/Templ.+\.app$";print "/L.+/Pri.+\.plugin$";if(NR<'{${p[14]},${p[21]}}') print "^/[Sp].+|'${k[21]}'";} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p;' '&&echo On' '/\.(bundle|component|framework|kext|mdimporter|plugin|qlgenerator|saver|wdgt)$/p' '/\.dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".","");print $0"$";} END { split("'"${c[*]}"'",c);for(i in c) print "\t"c[i]"$";} ' ' /^\/(Ap|Dev|Inc|Prev)/d;/((iTu|ok).+dle|\.(component|mailbundle|mdimporter|plugin|qlgenerator|saver|wdgt))$/p;' ' BEGIN{ FS="= "} $2 { gsub(/[()"]/,"",$2);print $2;} ' ' /^\//!d;s/^.{5}//;s/ [^/]+\//: \//p;' '>&-||echo No' '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[2]}'{$2=$2-1;print}' ' BEGIN { M1='${p[16]}';M2='${p[18]}';M3='${p[8]}';M4='${p[3]}';} !/^A/{next};/%/ { getline;if($5<M1) o["CPU"]="CPU: user "$2"%, system "$4"%";next;} $2~/^disk/&&$4>M2 { o[$2]=$2": "$3" ops/s, "$4" blocks/s";next;} $2~/^(en[0-9]|bridg)/ { if(o[$2]) { e=$3+$4+$5+$6;if(e) o[$2]=o[$2]"; errors "e"/s";next;};if($4>M3||$6>M4) o[$2]=$2": in "int($4/1024)", out "int($6/1024)" (KiB/s)";} END { for(i in o) print o[i];} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' BEGIN{FS=": "} /^ {10}O/ {exit} /^ {0,12}[^ ]/ {next} $1~"Ne"&&$2!~/^In/{print} $1~"Si" { split($2,a," ");if(a[1]-a[4]<'${p[5]}') print;};$1~"T"&&$2<'${p[20]}'{print};$1~"Se"&&$2!~"2"{print};' ' BEGIN { FS="\f";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1;} ' ' BEGIN { split("'"${p[1]}"'",m);FS="\f";} $2<=m[$1]{next} $1<9 { o[$1]=o[$1]"\n "$3" (UID "$4"): "$2;} $1==9&&$5!~"^/dev" { o[$1]=o[$1]"\n "$3" (UID "$4") => "$5" (status "$6"): "$2;} $1==10&&$5 { p="ps -c -ocomm -p"$5"|sed 1d";p|getline n;close(p);if(n) $5=n;o[$1]=o[$1]"\n "$5" => "$3" (UID "$4"): "$2;} $1~/1[12]/ { o[$1]=o[$1]"\n "$3" (UID "$4", error "$5"): "$2;} END { n=split("'"${k[27]}"'",u,":");for(i=n+1;i<n+5;i++)u[i]=u[2];split("'"${k[28]}"'",l,":");for(i in o) print "\n"l[i]" ("u[i]")\n"o[i];} ' ' /^ {8}[^ ]/{print} ' ' BEGIN { L='${p[17]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"cksum "F|getline C;split(C, A);C=A[1];"stat -f%Sm "F|getline D;"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("'"${k[30]}"' "F|getline g) { l++;if(l<=L) f=f"\n "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F"\n '"${k[22]}"'"T;printf("'"${f[8]}"'",F,D,C,f);if(l>L) printf("'"${f[7]}"'",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' 's/^.{52}(.+) <.+/\1/p' ' /id: N|te: Y/{i++} END{print i} ' ' /kext:/ { split($0,a,":");p=a[1];k[S]='${k[25]}';k[U]='${k[26]}';v[S]="Safe";v[U]="true";for(i in k) { s=system("'"${k[30]}"'\\ :"k[i]" \""p"\"/*/I*|grep -qw "v[i]);if(!s) a[1]=a[1]" "i;};if(!a[2]) a[2]="'"${k[23]}"'";printf("'"${f[4]}"'",a[1],a[2]);next;} !/^ *$/ { p="'"${k[31]}"'\\ :'"${k[33]}"' \""$0"\"/*/'${k[32]}'";p|getline b;close(p);if(b~/, .+:/||b=="") b="'"${k[23]}"'";printf("'"${f[4]}"'",$0,b);} ' '/ en/!s/\.//p' ' NR>=13 { gsub(/[^0-9]/,"",$1);print;} ' ' $10~/$L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?'${k[32]}'$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ / [VY]/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' '/^find: /!p;' ' /^p/{ s/.//g;x;s/\nu/'$'\f''/;s/(\n)c/\1'$'\f''/;s/\n\n//;p;};H;' ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;p;' ' s/^.+ |\(.+$$//g;p;' '1;END{if(NR<'${p[15]}')printf("^/(S|usr/(X|li))")}' ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END{ if(i>1)print n} ' s/{'\.|jnl: ','P.+:'}'//;s/ +([0-9]+)(.+)/\2 \1/p' ' /es: ./{ s/^.+://;b0'$'\n'' };/^ +C.+ted: +[NY]/H;/:$/b0'$'\n'' d;:0'$'\n'' x;/: +N/d;s/\n.+//p;' ' 1d;/:$/b0'$'\n'' $b0'$'\n'' /(D|^ *Loc.+): /{ s/^.+: //;H;};/(B2|[my]): /H;d;:0'$'\n'' x;/[my]: [AM]|m: I.+p$|^\/Vo/d;s/(^|\n) [ -~]+//g;s/(.+)\n(.+)/\2:\1/;s/\n//g;/[ -~]/p;' 's/$/'$'\f''(0|-(4[34])?)$/p' '|sort'{'|uniq'{,\ -c},\ -nr} ' s/^/'{5,6,7,8}$'\f''/;s/ *'$'\f'' */'$'\f''/g;p;' '/e:/{print $2}' ' /^[(]/{ s/....//;s/$/:/;N;/: [)]$/d;s/\n.+ ([^ ]+).$/\1/;H;};${ g;p;} ' 's/:.+$//p' '|wc -l' /{\\.{kext,xpc,'(appex|pluginkit)'}'\/(Contents\/)?'Info,'Launch[AD].+'}'\.plist$/p' 's/([-+.?])/\\\1/g;p' 's/, /\'$'\n/g;p' ' BEGIN{FS="\f"} { printf("'"${f[6]}"'",$1/1048576,$2);} ' ' /= D/&&$1!~/'{${k[24]},${k[29]}}'/ { getline d;if(d~"t") D=D"\n"$1;} END { print D;} ' ' NR>1&&$3!~/0x|\.([0-9]{3,}|[-0-9A-F]{36})$/ { print $3"\f"$2;} ' '|tail -n'${p[6]} ' $1>1 { $NF=$NF" x"$1;} /\*/ { if(!f) f="\n\t* Code injection";} { $1="";} 1;END { print f;} ' ' s/.+bus /Bus: /;s/,.+[(]/ /;s/,.+//p;' ' { $NF=$NF" Errors: "$1;$1="";} 1 ' ' 1s/^/\'$'\n''/;/^ +(([MNPRSV]|De|Li).+|Bus): .|d: Y/d;s/:$//;$d;p;' ' BEGIN { RS=",";FS=":";} $1~"name" { gsub("\"","",$2);print $2;} ' '|grep -q e:/' '/[^ .]/p' '{ print $1}' ' /^ +N.+: [1-9]/ { i++;} END { if(i) print "system: "i;} ' ' NF { print "'{admin,user}' "$NF;exit;} ' ' /se.+ =/,/[\}]/!d;/[=\}]/!p ' ' 3,4d;/^ +D|Of|Fu| [0B]/d;s/^ |:$//g;$!H;${ x;/:/p;} ' ' BEGIN { FS=": ";} NR==1 { sub(":","");h="\n"$1"\n";} /:$/ { l=$1;next;} $1~"S"&&$2!~3 { getline;next;} /^ {6}I/ { i++;L[i]=l" "$2;if(i=='${p[24]}') nextfile;} END { if(i) print h;for(j=0;j<i;j++) print L[i-j];} ' ' /./H;${ x;s/\n//;s/\n/, /g;/,/p;} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab kextfind top pkgutil "${k[30]}\\" echo cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom 'mdfind -onlyin' env pluginkit scutil 'dtrace -q -x aggsortrev -n' security sed\ -En awk 'dscl . -read' networksetup mdutil lsof test osascript\ -e netstat mdls route cat );c2=(${k[21]}loginwindow\ LoginHook ' /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'" 'L*/Ca*/'${k[21]}'Saf*/E* -d 2 -name '${k[32]} '~ $TMPDIR.. $ -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $' -i '-nl -print' '-F \$Sender -k Level Nle 3 -k Facility Req "'${k[21]}'('{'bird|.*i?clou','lsu|sha'}')"' "-f'%N: %l' Desktop {/,}L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message CRne '0xdc008012|(allow|call)ing|(mplet|nabl)ed|ry HD|safe b|xpm' -k Message CReq 'bad |Can.t l|corru|dead|fail|GPU |hfs: Ru|inval|Limiti|v_c|NVDA[(]|pagin|Purg(ed|in)|error|Refus|TCON|tim(ed? ?|ing )o|trig|WARN' " '-du -n DEV -n EDEV 1 10' 'acrx -o%cpu,comm,ruid' "' syscall::recvfrom:return {@a[execname,uid]=sum(arg0)} syscall::sendto:return {@b[execname,uid]=sum(arg0)} syscall::open*:entry {@c[execname,uid,copyinstr(arg0),errno]=count()} syscall::execve:return, syscall::posix_spawn:return {@d[execname,uid,ppid]=count()} syscall::fork:return, syscall::vfork:return, syscall::posix_spawn:return /arg0<0/ {@e[execname,uid,arg0]=count()} syscall:::return /errno!=0/ {@f[execname,uid,errno]=count()} io:::wait-start {self->t=timestamp} io:::wait-done /self->t/ { this->T=timestamp - self->t;@g[execname,uid]=sum(this->T);self->t=0;} io:::start {@h[execname,uid]=sum(args[0]->b_bcount)} tick-10sec { normalize(@a,2560000);normalize(@b,2560000);normalize(@c,10);normalize(@d,10);normalize(@e,10);normalize(@f,10);normalize(@g,10000000);normalize(@h,10240);printa(\"1\f%@d\f%s\f%d\n\",@a);printa(\"2\f%@d\f%s\f%d\n\",@b);printa(\"9\f%@d\f%s\f%d\f%s\f%d\n\",@c);printa(\"10\f%@d\f%s\f%d\f%d\n\",@d);printa(\"11\f%@d\f%s\f%d\f%d\n\",@e);printa(\"12\f%@d\f%s\f%d\f%d\n\",@f);printa(\"3\f%@d\f%s\f%d\n\",@g);printa(\"4\f%@d\f%s\f%d\n\",@h);exit(0);} '" '-f -pfc /var/db/r*/'${k[21]}'*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag $ -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true $ -execdir stat -f'$'\f''%Sc'$'\f''%N -t%F {} \;' '/S*/*/Ca*/*xpc*' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' /\ kMDItemContentTypeTree=${k[21]}{bundle,mach-o-dylib} :Label "/p*/e*/{auto*,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {/p*,/usr/local}/e*/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*t .launchd.conf" list '-F "" -k Sender hidd -k Level Nle 3' /Library/Preferences/${k[21]}alf\ globalstate --proxy '-n get default' print\ system --dns -get{dnsservers,info} dump-trust-settings\ {-s,-d,} -n1 '-R -ce -l1 -n5 -o'{'prt -stats prt','mem -stats mem'}',command,uid' -kl -l -s\ / '--regexp --files '${k[21]}'pkg.*' '+c0 -i4TCP:0-1023' ${k[21]}dashboard\ layer-gadgets '-d /L*/Mana*/$USER' '-app Safari WebKitDNSPrefetchingEnabled' '-Fcu +c0 -l' -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' '-F \$Message -k Sender kernel -k Message CReq "'{'n Cause: -','(a und|I/O |jnl_io.+)err','USBF:.+bus'}'"' -name\ kMDItem${k[33]} -T\ hfs '-n get default' -listnetworkserviceorder :${k[33]} :CFBundleDisplayName $EUID {'$TMPDIR../C ','/{S*/,}'}'L*/{,Co*/*/*/L*/}{Cache,Log}s -type f -size +'${p[11]}'M -exec stat -f'%z\f%N' {} \;' \ /v*/d*/*/*l*d{,.*.$UID}/* '-app Safari UserStyleSheetEnabled' 'L*/A*/Fi*/P*/*/a*.json' users/$USER\ HomeDirectory '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' ' -F "\$Time \$(Sender): \$Message" -k Level Nle 3 -k Facility R'{'ne "user|','eq "'}'console" -k Message CRne "[{}<>]|commit - no t|deprec|Goog|realp|sandbox ex|/root" ' getenv '/ "kMDItemDateAdded>=\$time.now(-'${p[23]}')&&kMDItem'${k[33]}'=*"' -m\ / '' );N1=${#c2[@]};for j in {0..20};do c2[N1+j]=SP${k[j]}DataType;done;l=({Restricted\ ,Lock,Pro}files POST Battery {Safari,App,{Bad,Loaded}\ kernel,Firefox}\ extensions System\ load boot\ args FileVault\ {2,1} {Kernel,System,Console}\ log Activity SMC Login\ hook 'I/O per process' 'High file counts' UID Daemons Agents XPC\ cache Startup\ items {Admin,Root}\ access Stylesheet Library\ paths{,' ('{shell,launchd}\)} Font\ issues Firewall Proxies DNS TCP/IP Wi-Fi 'Elapsed time (sec)' {Root,User}\ crontab {Global,User}' login items' Spotlight Memory\ pressure Listeners Widgets Parental\ Controls Prefetching Nets Volumes {Continuity,I/O,iCloud,HID,HCI}\ errors {User,System}\ {caches/logs,overrides} Shutdown\ codes Heat Diagnostic\ reports Bad\ plists Free\ space VM Bundles{,' (new)'} Trust\ settings );N3=${#l[@]};for i in {0..8};do l[N3+i]=${k[5+i]};done;F() { local x="${s[$1]}";[[ "$x" =~ ^([\&\|\<\>]|$) ]]&&{ printf "$x";return;};:|${c1[30]} "$x" 2>&-;printf "%s \'%s\'" "|${c1[30+$?]}" "$x";};A0() { Q=6;v[2]=1;id -G|grep -qw 80;v[1]=$?;((v[1]))||{ Q=7;sudo -v;v[2]=$?;((v[2]))||Q=8;};v[3]=`date +%s`;date '+Start time: %T %D%n';printf '\n[Process started]\n\n'>&4;printf 'Revision: %s\n\n' ${p[0]};};A1() { local c="${c1[$1]} ${c2[$2]}";shift 2;c="$c ` while [[ "$1" ]];do F $1;shift;done`";((P2))&&{ c="sudo $c";P2=;};v=`eval "$c"`;[[ "$v" ]];};A2() { local c="${c1[$1]}";[[ "$c" =~ ^(awk|sed ) ]]&&c="$c '${s[$2]}'"||c="$c ${c2[$2]}";shift 2;local d=` while [[ "$1" ]];do F $1;shift;done`;((P2))&&{ c="sudo $c";P2=;};local a;v=` while read a;do eval "$c '$a' $d";done<<<"$v";`;[[ "$v" ]];};A3(){ v=$((`date +%s`-v[3]));};B1() { v=No;! ((v[1]))&&{ v=;P1=1;};};eval "`type -a B1|sed '1d;s/1/2/'`";B3(){ v[$1]="$v";};B4() { local i=$1;local j=$2;shift 2;local c="cat` while [[ "$1" ]];do F $1;shift;done`";v[j]=`eval "{ $c;}"<<<"${v[i]}"`;};B5(){ v="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d$'\e' <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F$'\e' ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`egrep -v "${v[$1]}"<<<"$v"|sort`;};eval "`type -a B7|sed '1d;s/7/8/;s/-v //'`";C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { B4 0 0 63&&C1 1 $1;};C4() { echo $'\t'"Part $((++P)) of $Q done at $((`date +%s`-v[3])) sec">&4;};C5() { sudo -k;pbcopy<<<"$o";printf '\n\tThe test results are on the Clipboard.\n\n\tPlease close this window.\n';exit 2>&-;};for i in 1 2;do eval D$((i-1))'() { A'$i' $@;C0;};';for j in 2 3;do eval D$((i+2*j-3))'() { local x=$1;shift;A'$i' $@;C'$j' $x;};';done;done;trap C5 2;o=$({ A0;D0 0 N1+1 2;D0 0 $N1 1;B1;C2 27;B1&&! B2&&C2 28;D2 22 15 63;D0 0 N1+2 3;D0 0 N1+15 17;D4 3 0 N1+3 4;D4 4 0 N1+4 5;D4 N3+4 0 N1+9 59;D0 0 N1+16 99; for i in 0 1 2;do D4 N3+i 0 N1+5+i 6;done;D4 N3+3 0 N1+8 71;D4 62 1 10 7;D4 10 1 11 8;B2&&D4 18 19 53 67;D2 11 2 12 9;D2 12 3 13 10;D2 13 32 70 101 25;D2 65 6 76 13;D2 45 20 52 66;D4 66 7 77 14;D4 17 8 15 38;D0 9 16 16 77 45;C4;B2&&D0 35 49 61 75 76 78 45;B2&&{ D0 28 17 45;C4;};D0 12 40 54 16 79 45;D0 12 39 54 16 80 45;D4 31 25 77 15&&{ B4 0 8 103;B4 8 0;A2 18 74;B6 8 0 3;C3 32;};B2&&D4 19 21 0;B2&&D4 40 10 42;D2 2 0 N1+19 46 84;D2 44 34 43 53;D2 25 22 20 32;D2 33 0 N1+14 51;for i in {0..2};do A1 29 35+i 104+i;B3 25+i;done;B6 25 27 5;B6 0 26 5;B4 0 0 110;C2 69;D2 34 21 28 35;D4 35 27 29 36;A1 40 59 81;B3 18;A1 33 60 82;B8 18;B4 0 19 83;A1 27 32 39&&{ B3 20;B4 19 0;A2 33 33 40;B3 21;B6 20 21 3;};C2 36;D4 50 38 5 68;B4 19 0;D5 37 33 34 42;B2&&D4 46 35 45 55;D4 38 0 N1+20 43;B2&&D4 59 4 65 76 91;D4 63 4 19 44 75 95 96;B1&&{ D4 53 5 55 75 69&&D4 51 6 58 31;D4 56 5 56 97 75 98&&D0 0 N1+7 99;D2 55 5 27 84;D4 61 5 54 75 70;D4 14 5 14 12;D4 15 5 72 12;C4;};D4 16 5 73 12;A1 13 44 74 18;C4;B3 4;B4 4 0 85;A2 14 61 89;B4 0 5 19 102;A1 17 41 50;B7 5;C3 8;B4 4 0 88;A2 14 24 89;C4;B4 0 6 19 102;B4 4 0 86;A2 14 61 89;B4 0 7 19 102;B5 6 7;B4 0 11 73 102;A1 18 31 107 94 74||{ B2&&A1 18 26 94 74;}&&{ B7 11;B4 0 0 11;C3 23;};A1 18 26 94;B7 11;B4 0 0 11;C3 24;D4 60 14 66 92;D4 58 14 67 93;D4 26 4 21 24;D4 42 14 1 62;D4 43 37 2 90 48;D4 41 10 42;D2 48 36 47 25;A1 4 3 60&&{ B3 9;A2 14 61;B4 0 10 21;B4 9 0;A2 14 62;B4 0 0 21;B6 0 10 4;C3 5;};D4 9 41 69 100;D2 29 21 68 35;D2 49 21 48 49;B4 4 22 57 102;A1 21 46 56 74;B7 22;B4 0 0 58;C3 47;D4 54 5 7 75 76 69;D4 52 5 8 75 76 69;D4 57 4 64 76 91;D2 0 4 4 84;D2 1 4 51 84;D4 21 22 9 37;D0 0 N1+17 108; A1 23 18 28 89;B4 0 16 22 102;A1 16 25 33;B7 16;B4 0 0 34;D1 31 47;D4 64 4 71 41;C4;B4 4 12 26 89 23 102;for i in {0..3};do A1 0 N1+10+i 72 74;B7 12;B4 0 0 52;C3 N3+5+i;((i))||C4;done;A1 24 22 29;B7 12;B3 14;A2 39 57 30;B3 15;B6 14 15 4;C3 67;A1 24 75 74;B3 23;A2 39 57 30;B3 24;B6 23 24 4;C3 68;B4 4 13 27 89 65;A1 24 23;B7 13;C3 30;B4 4 0 87;A2 14 61 89 20;B4 0 17;A1 26 50 64;B7 17;C3 6;D0 0 N1+18 109;D4 7 11 6;A3;C2 39;C4;} 4>&2 2>/dev/null;);C5
Copy the selected text to the Clipboard by pressing the key combination command-C.
8. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad and start typing the name.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter
exec bash
and press return. Then paste the script again.
10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:
[Process started]
Part 1 of 8 done at … sec
Part 8 of 8 done at … sec
The test results are on the Clipboard.
Please close this window.
[Process completed]
The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.
Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.
12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.
14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I may not agree with them.
Copyright © 2014, 2015 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Shows tons of unwanted pop-up ads and get redirected to unknown sites automatically

When i started my PC lately, it was fine. But now i have a problems With my computer. When I connect my system to Internet and start browsing, I find lots of unwanted ads coming on my desktop. Aside this my browser also get redirected automatically to unknown websites.
After spending time lots of time Internet I finally found something really helpful. See what solved my problem :- http://bit.ly/1FFyKZy

Click here and follow the instructions, or if they don't cover the type of adware on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.
(117593)

Pop Up Problems with all browsers and operating systems

I have a website that uses pop up windows in several areas.
They have worked fine for over two years. All of a sudden none of
my popups work. I tested on both a mac and a pc and on firefox,
explorer and safari. Pop up blocker has nothing to do with this
problem. I'm completely dumbfounded.
Any advice would be greatly appreciated.

Good grief - all one line.... That's why it's not working.
Your
"optimization" of the page has munged the javascript.
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.dreamweavermx-templates.com
- Template Triage!
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
http://www.macromedia.com/support/search/
- Macromedia (MM) Technotes
==================
"justletmeaskmyquesti" <[email protected]>
wrote in message
news:elsial$7pp$[email protected]..
> When I test full detail (non-flash)
>
http://www.deltasoniccarwash.com/htm/bfulldetail.htm
> on my desktop (mac OS x safari browser) it works fine. I
upload it and it
> dosn't work live. Again I'm dumbfounded.
>

How to permanently get rid of ads, pop up surveys and all pop ups

I have recently been getting bombarded with pop ups, ads and surveys coming up on pretty much every Web page I visit. Iv tried many different things to get rid of this. Iv download ad block plus, iv removed all extensions and iv reset firefox to default settings. Resetting firefox did fix this for about 10 days but now it is happening again and is getting very frustrating. Any ideas would be appreciated

Is this problem on Windows or Mac? (I assume it is not on Android.)
If the problem is on Windows, here's my suggested procedure for tracking down and cleaning those up:
(1) Open the Windows '''Control Panel''', Uninstall a Program (on XP: Add/Remove Programs). After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Take out as much trash as possible here.
(2) Open Firefox's '''Add-ons page''' using either:
* Ctrl+Shift+a
* "3-bar" menu button (or Tools menu) > Add-ons
In the left column, click '''Plugins'''. Set nonessential and unrecognized plugins to "Never Activate".
In the left column, click '''Extensions'''. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions.
Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
Any improvement?
(3) You can search for remaining issues with the '''scanning/cleaning tools''' listed in our support article: [[Troubleshoot Firefox issues caused by malware]]. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.
Success?

After a recent firefox update, i am getting tons of pop-up ads (pop ups ARE disabled) and admedia ads on ALL videos. how do i make these go away????

recently, i was forced to update my firefox. after that, problems began.
my pop-up blocker is ON with only one exception (my bank website). but i keep getting pop-up ADs (not pop-ups needed for the webpage to work, but actual junk ads that have nothing to do with the website... firefox help called them "pop-under ads" as they pop up under the browser, but they have the firefox logo and star, but are in fact ads).
then, when i am watching videos, hulu, youtube, vimeo, anything that isa video, i get these admedia ads pop up over the video screen.
these things never happened before the update, nowthey are an every use occurance. how do i turn them off again, especially when all information points to the features that should be turning them off say they are off???
EDITED TO ADD:
i have run CC cleaner, spybot, windows defender, norton anti-spyware several times.

I solved the problem of unbelievable slowness, etc. by downloading NoScript from the Firefox Add-On page:
https://addons.mozilla.org/en-US/firefox/addon/noscript/
After you download and install NoScript leave it set to the default settings. It's wonderful - After you get used to using it, you can make changes as necessary.
You'll be redirected to the NoScript web site after you complete your installation:
http://noscript.net/?ver=2.1.9
This is because the version of NoScript posted on the Firefox Add-On page is not the most recent stable version. You'll see a message on the upper right side of the NoScript web site stating:
V. 2.2 - See through the Web!
Looks like you are running an older version (2.1.9), probably because latest version is not published on addons.mozilla.org yet.
You are strongly encouraged to
install latest stable version (2.2)
Definitely install version 2.2 - after installing the version posted on the Firefox Add-On page - and you're good to go.
I found it helpful to read the Reviews of NoScript on the Firefox Add-On page. One person, as I remember, commented that NoScript saved him from abandoning Firefox. That was my experience too.
Let me know if that helps -
Worker Bee

My MacBook Pro is all of sudden having issues with pop up ads. I am running OSX 10.5.8. Any suggestions for fixing the problem?

All of a sudden I am getting TONS of pop up ads. I am on a Macbook Pro running OSX 10.5.8. Anyone have any suggestions for fixing the problem?

Take a look at my Adware Removal Guide.
(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

How do I get rid of all the pop up ads on macbook air?

How do I get rid of pop up ads on MacBook Air?

Click here and follow the instructions, or if desired, download and run Adware Medic. The second link is a direct download; if you're unable to download it, see this page.
(116370)

Does anyone have any suggestions for Ad blocking? I'm getting a lot of pop up ads while using Facebook from Safari.

     I'm getting a lot of pop up ads. mostly while using Facebook. I'm running Safari on a Macbook Pro running Yosemite. Does anyone have any suggestions for an Ad blocker. I don't see anything in the App store.
      I can't swear to it but I don't recall this being a problem pre-Yosemite. I could be wrong. I haven't been real active on Facebook until recently. I see some third party apps out there but am alway wary of non approved software.
     Thanks
     Ron

You may have installed the "VSearch" trojan. Remove it as follows.
Malware is always changing to get around the defenses against it. These instructions are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Internet criminal behind VSearch has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Why is the ad blocker not blocking pop up ads

Every time i open up safari i keep getting this mac keeper pop up add and other pop up ads my ad blocker is enabled but it doesn't block all the ads.
Please help!

You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Can't get rid of pop up ads and my pop up is on.

When I first got my Mac I had no trouble going to sites and no pop up ads. My pop up blocker is on and I can't go to sites without pop up ads from other places showing me where to get items from or advertising and a little place pops up when it is underlined a word for ads. This is very annoying I can't shop without pop ups showing me ads on stuff. Help!

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Hi i have pop up ads everywhere in safari and I'm new to using a mac can someone help me with some info on how to secure myself from this occurring

Hi I need some help with pop up ads there everywhere in safari is there a anti phishing product i should install or settings that need to be changed I'm new to using apple and would love some help here.

There is no need to download anything to solve this problem.
You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.
Make sure you don't repeat the mistake that led you to install the malware. It may have come from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.

How can you remove pop up ads

How can you remove pop up ads.

You installed the "SaveKeeper" adware. To remove it, please take the steps below.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of the date it was posted, as far as I know.They won't necessarily be valid in the future. Anyone finding this comment after a few days from now should look for more recent discussions or start a new one.
1. From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need. If in doubt, uninstall all extensions, including any with the name "RightCoupon," "SaveKeep," or similar. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
2. In the Applications folder, there may be an item with the name "SaveKeeper" or similar. Move it to the Trash and empty. If you get a warning that the item is in use, force it to quit, then try again.
The rest of this comment is optional. I can't be sure that you don't have a variant of SaveKeeper that I'm not familiar with, or that you haven't installed some other kind of malware in addition to SaveKeeper. If you want to rule out that possibility, see below.
1. This procedure is a diagnostic test. It changes nothing, for better or worse.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) on the advice of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed:
☞ Copy a line of text in this window to the Clipboard.
☞ Paste into the window of another application.
☞ Wait for the test to run. It usually takes a few minutes.
☞ Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; AC="com.autodesk.AutoCAD com.evenflow.dropbox com.google.GoogleDrive"; H='^[[:space:]]*((127\.0\.0\.1|::1|fe80::1%lo0)[[:space:]]+local|(255\.){3}255[[:space:]]*broadcast)host[[:space:]]*$'; NS=networksetup; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; BI () { $PB\ :CFBundleIdentifier "$1"; }; LC () { $2 launchctl list | awk 'NR>1 && !/0x|\.[0-9]+$|com\.apple\.(AirPortBaseStationAgent|launchctl\.(Aqua|Background|System))$/{print $3}' | grep -Fv "$1"; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; AT () { o=`file -b "$1" | egrep -v '^(A.{16}t$|cann)'`; Ps "${1##*/} format"; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"and $((l-25)) more line(s)"; Pm "$1"; AT "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/(\/Users\/)[^/]+/\1-/g' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed -n 's/^ *//;5p;6p;8p'; h=(`SP Hardware | awk '/ Id/{print $3}; /Mem/{print $2}'`); o=$h; Ps Model; o=$((h[1]<4?h[1]:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^EO]|x([^8]|8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm POST; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/s/^.*://p' <<< "$p"`; Ps "Battery condition"; for b in FireWire Thunderbolt USB; do o=`SP $b | sed -En '/:$/{s/ *:$//;x;s/\n//;/Apple|Intel|SMSC/d;s/\n.*//;/\)/p;};/^ *(V.+ [0N]|Man).+ /{s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;}'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm Heat; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; o=; fdesetup status | grep -q On && o=On; Ps FileVault; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && f="$f *"; echo "$d ${f%%_2*} ${f##*.}"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; grep -lq '*$' <<< "$o" && printf $'\n\t* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'caug|GPU |hfs: Ru|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN' -k Message Ane 'SMC:' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel log"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; sys=`pkgutil --regexp --only-files --files com.apple.pkg.* | sort | uniq | sed 's:^:/:'`; bi=`egrep '\.(kext|xpc)/(Contents/)?Info.plist$' <<< "$sys" | while read i; do [[ -f "$i" ]] && BI "$i"; done`; o=`kextstat -kl | grep -Fv "$bi" | cut -c53- | cut -d\< -f1`; Pm "Kernel extensions"; li=`egrep 'Launch[AD].+\.plist$' <<< "$sys"`; jl=`while read f; do [[ -f $f ]] && $PB\ :Label $f; done <<< "$li"`$'\n'"$bi"; R && o=`LC "$jl" sudo`; Pm Daemons; o=`LC "$jl"`; Pm Agents; o=`for d in {/,}L*/Lau*; do M; done | grep -Fv "$li" | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/StartupItems; do M; done`; Pm "Startup items"; b=`sed -E '/^.+Lib.+\/Contents\/Info.plist$/!d;s/\/Info.plist$//;/Contents\/./d' <<< "$sys"`; l=`egrep '^/usr/lib/.+dylib$' <<< "$sys"`; p=`lsbom -pfc /var/db/*/*.BSD.bom | sed -En '/peri.+\/.+\./s/^\.\/[^/]+//p'`; [[ "$b" && "$l" && "$p" ]] && { o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | grep -Fv "$b" | while read d; do i="$d"/Info.plist; [[ -f "$i" ]] || continue; ID=$(BI "$i") || ID="No bundle ID"; printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Bundles"; o=`find /usr/lib -type f -name *.dylib | grep -Fv "$l"`; Pm "Shared libraries"; o=`find -L {,/u*/lo*}/e*/periodic -type f -exec cksum {} \; | awk '{print $3"\t"$1}' | grep -Fv "$p" | awk '{print $1}'`; Pm "Periodic scripts"; :; } || echo $'\nReceipts missing'; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Inserted dylibs"; o=; defaults read /Library/Preferences/com.apple.alf globalstate | grep -q 0 || o=On; Ps Firewall; o=`scutil --proxy | egrep 'Prox.+: [^0]'`; Pm Proxies; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; i=`route -n get default | awk '/e:/{print $2}'`; I=`$NS -listnetworkserviceorder | sed -En '/ '$i'\)$/{x;s/^$.+$ //p;q;};x'`; n=`$NS -getdnsservers "$I" | awk '!/^T/{printf "not "; exit}'`; Ps "DNS (${n}from DHCP)"; o=`$NS -getinfo "$I" | awk '/k:/{if ($3 !~ "(255\.){3}0") print}; /v6:/{if ($2 !~ "A") print}'`; Pm TCP/IP; [[ "$I" =~ [AW]i ]] && { o=`/S*/*/P*/*/*/*/*/airport -I | awk '/lR/{print $2}'`; o=$((o<=-87?o:0)); Ps RSSI; }; R && o=`sudo profiles -P | grep : | wc -l`; Ps Profiles; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; f=/etc/hosts; Pc hosts <(egrep -v "$H" $f ); AT $f; Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; LD="$(`find /S*/*/F* -type f -name lsregister | head -n1` -dump)"; o=`for ID in $AC; do [[ "$LD" =~ $ID ]] && echo $ID; done`; Pm "App check"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. $ -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $ | wc -l`; Ps "Restricted user files"; cd; o=`find .??* -path .Trash -prune -o -type d -name *.app -print -prune`; Pm "Hidden apps"; o=`SP Fonts | egrep 'id: N|te: Y' | wc -l`; Ps "Font issues"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps UID; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-
Copy the selected text to the Clipboard by pressing the key combination command-C.
7. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "syntax error," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Terms of Use of the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Unwanted Pop-up ads in all browsers

Similar Messages

Maybe you are looking for