EtreCheckPro version: 6.8.9 (68074) Report generated: 2025-03-31 18:12:52 Download EtreCheckPro from https://etrecheck.com Runtime: 13:35 Performance: Poor Problem: Other problem Description: Computer takes a long tome to start-up, switch users and open apps lik e safari or mail amungst others. Major Issues: Anything that appears on this list needs immediate attention. Failing hard drive - This computer has a hard drive that appears to be failing. Malware - Malware detected. Safe mode - This computer is running in Safe Mode. Minor Issues: These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. No Time Machine backup - Time Machine backup not found. Apps crashing - There have been numerous app crashes. Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage. Clean up - There are orphan files that could be removed. Unsigned files - There are unsigned software files installed. These files could be old, incompatible, and cause problems. They should be reviewed. Limited permissions - More information may be available with Full Disk Access. Kernel extensions present - This computer has kernel extensions that may not work in the future. Hardware Information: iMac (Retina 4K, 21.5-inch, 2019) Status: Supported iMac Model: iMac19,2 3.6 GHz Quad-Core Intel Core i3 (i3-8100) CPU: 4-core 8 GB RAM - Upgradeable by an Apple Authorized Service Provider BANK 0/ChannelA-DIMM0 - 4 GB DDR4 2400 BANK 2/ChannelB-DIMM0 - 4 GB DDR4 2400 Video Information: Radeon Pro 555X - VRAM: 2 GB iMac (built-in) 3360 x 1890 Drives: disk0 - APPLE HDD HTS541010A9E632 1.00 TB (Mechanical - 5400 RPM) Internal SATA 3 Gigabit Serial ATA disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB disk0s2 [APFS Container] 1000.00 GB disk1 [APFS Virtual drive] 1000.00 GB (Shared by 6 volumes) disk1s1 - Macintosh HD - Data (APFS) [APFS Virtual drive] (503.72 GB used) disk1s2 - Preboot (APFS) [APFS Preboot] (2.44 GB used) disk1s3 - Recovery (APFS) [Recovery] (1.31 GB used) disk1s4 - VM (APFS) [APFS VM] (4.30 GB used) disk1s5 (APFS) [APFS Container] (11.16 GB used) disk1s5s1 - Macintosh HD (APFS) [APFS Snapshot] (11.16 GB used) disk1s6 - Update (APFS) (2 MB used) Mounted Volumes: disk1s1 - Macintosh HD - Data [APFS Virtual drive] Filesystem: APFS Mount point: /System/Volumes/Data Used: 503.72 GB Shared values Size: 1000.00 GB Free: 476.87 GB Available: 480.95 GB disk1s2 - Preboot [APFS Preboot] Filesystem: APFS Mount point: /System/Volumes/Preboot Used: 2.44 GB Shared values Size: 1000.00 GB Free: 476.87 GB disk1s3 - Recovery [Recovery] Filesystem: APFS Mount point: /Volumes/Recovery Used: 1.31 GB Shared values Size: 1000.00 GB Free: 476.87 GB disk1s4 - VM [APFS VM] Filesystem: APFS Mount point: /System/Volumes/VM Used: 4.30 GB Shared values Size: 1000.00 GB Free: 476.87 GB Available: 480.95 GB disk1s5s1 - Macintosh HD [APFS Snapshot] Filesystem: APFS Mount point: / Read-only: Yes Used: 11.16 GB Shared values Size: 1000.00 GB Free: 476.87 GB Available: 480.95 GB disk1s6 - Update Filesystem: APFS Mount point: /System/Volumes/Update Used: 2 MB Shared values Size: 1000.00 GB Free: 476.87 GB Available: 480.95 GB disk3s1 - Creedence11M6270.SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex Filesystem: APFS Disk Image Mount point: /System/Library/A******2/c*********************************e/p**********o/6********************************************t/.********a Read-only: Yes Size: 4 MB USB: USB 3.1 bus Apple Inc. - FaceTime HD Camera (Built-in) Apple Inc. - Magic Keyboard USB 3.1 bus Network: Interface en0: Ethernet Interface en5: DJI Interface en4: HERO9 Interface en1: Wi-Fi 802.11 a/b/g/n/ac Interface bridge0: Thunderbolt Bridge Interface bridge0: Thunderbolt Bridge 2 System Software: macOS Sequoia 15.3.2 (24D81) Installed 2025-03-24 Time since boot: Less than an hour Safe Mode: Enabled Security: Gatekeeper: App Store and identified developers System Integrity Protection: Enabled Antivirus software: Apple Malware: Launchd: ~/Library/LaunchAgents/Bilabordnet.uadpte.plist Executable: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger update -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet -sig RAFICOLMAN_SIGNATURE -agentUpdate 0 Reason: Malware name match Launchd: ~/Library/LaunchAgents/Bilabordnet.dolnwoad.plist Executable: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger download -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -sig RAFICOLMAN_SIGNATURE -identity Bilabordnet Reason: Malware name match Launchd: ~/Library/LaunchAgents/Bilabordnet.AppVemoral.plist Executable: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger AppRemoval -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet Reason: Malware name match Launchd: ~/Library/LaunchAgents/Bilabordnet.btvlit.plist Executable: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger ltvbit -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet Reason: Malware name match Launchd: ~/Library/LaunchAgents/Bilabordnet.disable.plist Executable: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger disable -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet Reason: Malware name match Unsigned Files: Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool Details: Exact match found in the legitimate list - probably OK Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist Command: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck Details: Exact match found in the legitimate list - probably OK Launchd: ~/Library/LaunchAgents/com.amazon.music.plist Executable: /Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper Details: Exact match found in the legitimate list - probably OK Login Item: /Applications/Nikon Software/Nikon Message Center 2/Nikon Message Center 2.app/Contents/SharedSupport/Launch Nikon Message Center 2.app Apps: 17 System Extensions: [Not Loaded] Surfshark Antivirus - version 4.17.0 (SURFSHARK LTD - installed 2025-01-28) Application: /Applications/Surfshark.app - version 4.17.0 (SURFSHARK LTD - installed 2025-03-31) Description: System Extension enables Surfshark app to provide antivirus features. [Running] Surfshark. WireGuard - version 4.17.0 (SURFSHARK LTD - installed 2025-01-28) Application: /Applications/Surfshark.app - version 4.17.0 (SURFSHARK LTD - installed 2025-03-31) Description: System Extension enables Surfshark app to connect using WireGuard protocol. Kernel Extensions: /Library/Extensions [Not Loaded] FTDIUSBSerialDriver.kext - com.FTDI.driver.FTDIUSBSerialDriver (2.3 - SDK 10.9) [Not Loaded] Franklin Wireless Modem.kext - com.fklt.driver (1.1) [Not Loaded] hp_fax_io.kext - com.hp.kext.hp-fax-io (5.11.0 - SDK 10.8) [Not Loaded] hp_io_enabler_compound.kext - com.hp.kext.io.enabler.compound (3.2.0) [Not Loaded] hp_Inkjet1_io_enabler.kext - com.hp.print.hpio.Inkjet1.kext (3.2.1 - SDK 10.8) [Not Loaded] HoRNDIS.kext - com.joshuawise.kexts.HoRNDIS (8.0 - SDK 10.6) System Launch Daemons: [Not Loaded] 41 Apple tasks [Loaded] 201 Apple tasks [Running] 164 Apple tasks [Other] 4 Apple tasks System Launch Agents: [Not Loaded] 20 Apple tasks [Loaded] 234 Apple tasks [Running] 192 Apple tasks Launch Daemons: [Not Loaded] com.adobe.ARMDC.Communicator.plist (Adobe Inc. - installed 2024-12-03) Executable: /Library/PrivilegedHelperTools/com.adobe.ARMDC.Communicator [Not Loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Inc. - installed 2024-12-03) Executable: /Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper [Not Loaded] com.cardosystems.cardo-updater.plist (Not signed - installed 2015-10-28) [Other] com.fujifilm.importer.plist (Not signed - installed 2013-02-28) Executable: ./PCAutoSaveSv [Loaded] com.google.GoogleUpdater.wake.system.plist (Google LLC - installed 2025-03-25) Command: /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/MacOS/GoogleUpdater --wake-all --enable-logging --vmodule=*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2 --system [Not Loaded] com.google.keystone.daemon.plist (Not signed - installed 2023-12-05) [Not Loaded] com.oracle.java.Helper-Tool.plist (Not signed - installed 2021-04-07) Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool Launch Agents: [Not Loaded] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist (Adobe Inc. - installed 2024-12-08) Executable: /Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper [Not Loaded] com.google.keystone.agent.plist (Not signed - installed 2023-12-05) [Not Loaded] com.google.keystone.xpcservice.plist (Not signed - installed 2023-12-05) [Not Loaded] com.oracle.java.Java-Updater.plist (Not signed - installed 2021-04-07) Command: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck User Launch Agents: [Not Loaded] Bilabordnet.AppVemoral.plist (Malware - installed 2019-09-06) Command: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger AppRemoval -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet [Not Loaded] Bilabordnet.btvlit.plist (Malware - installed 2019-09-06) Command: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger ltvbit -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet [Not Loaded] Bilabordnet.disable.plist (Malware - installed 2019-09-06) Command: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger disable -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet [Not Loaded] Bilabordnet.dolnwoad.plist (Malware - installed 2019-09-06) Command: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger download -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -sig RAFICOLMAN_SIGNATURE -identity Bilabordnet [Not Loaded] Bilabordnet.uadpte.plist (Malware - installed 2019-09-06) Command: ~/Library/Application Support/Bilabordnet/Bilabordnet.app/Contents/MacOS/AppRC -trigger update -isDev 0 -installVersion 1443 -firstAppId 1538565934698879 -identity Bilabordnet -sig RAFICOLMAN_SIGNATURE -agentUpdate 0 [Not Loaded] com.amazon.music.plist (Not signed - installed 2017-04-12) Executable: /Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper [Not Loaded] com.apple.CSConfigDotMacCert-***@***-SharedServices.Agent.plist (Not signed - installed 2012-06-12) Command: /System/Library/Frameworks/CoreServices.framework/Frameworks/OSServices.framework/Versions/A/Support/CSConfigDotMacCert -l ~/Library/Logs/CSConfigDotMacCert.log -u a*********e@m****m -t SharedServices -s [Not Loaded] com.citrixonline.GoToMeeting.G2MUpdate.plist (Citrix Online LLC - installed 2017-08-04) Executable: ~/Library/Application Support/CitrixOnline/GoToMeeting/G2MUpdate [Not Loaded] com.logmein.GoToMeeting.G2MUpdate.plist (Citrix Online LLC - installed 2017-08-04) Executable: ~/Library/Application Support/LogMeInInc/GoToMeeting/G2MUpdate [Not Loaded] com.nero.HSMMonitor.plist (Not signed - installed 2021-11-18) Command: ~/Desktop/HTC Sync Manager.app/Contents/Resources/HSMMonitor.app/Contents/MacOS/HSMMonitor -runMode autoLaunched User Login Items: [Loaded] Adobe Acrobat Reader (Adobe Inc. - installed 2025-03-23) Application /Applications/Adobe Acrobat Reader.app [Loaded] Launch Nikon Message Center 2 (Not signed - installed 2017-05-23) Application /Applications/Nikon Software/Nikon Message Center 2/Nikon Message Center 2.app/Contents/SharedSupport/Launch Nikon Message Center 2.app [Not Loaded] Surfshark (SURFSHARK LTD - installed 2025-03-31) Modern Login Item /Applications/Surfshark.app/Contents/Library/LoginItems/LaunchAgent.app [Not Loaded] HP Device Monitor (Hewlett Packard - installed 2015-10-06) Modern Login Item /Library/Printers/hp/Utilities/HP Utility.app/Contents/Library/LoginItems/HP Device Monitor.app [Not Loaded] PasswordsMenuBarExtra (Apple - installed 2025-03-06) Modern Login Item /System/Applications/Passwords.app/Contents/Library/LoginItems/PasswordsMenuBarExtra.app [Not Loaded] WeatherMenu (Apple - installed 2025-03-06) Modern Login Item /System/Applications/Weather.app/Contents/Library/LoginItems/WeatherMenu.app [Loaded] Android File Transfer Agent (Google, Inc. - installed 2018-10-17) Application ~/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app Applications: 725 Apple apps 66 3rd party apps 53 x86-only apps 17 unsigned apps App Extensions: Finder sync extensions: [Not Loaded] Surfshark Finder Extension - /Applications/Surfshark.app QuickLook Previews: [Loaded] EtreCheckQuickLook - ~/Downloads/EtreCheckPro.app com.etresoft.etrecheck4 *.etrecheck Internet Plug-ins: AdobePDFViewerNPAPI: 17.012.20098 (Adobe Systems, Inc. - installed 2021-07-13) GarminGpsControl: 4.2.0.0 (? - installed 2014-03-31) AdobePDFViewer: 21.005.20058 (Adobe Systems, Inc. - installed 2021-07-13) JavaAppletPlugin: Java 8 Update 291 build 10 (? - installed 2021-05-28) 3rd Party Preference panels: Java (? - installed 2021-04-07) Backup: Time Machine information is limited without Full Disk Access Performance: System Load: 1.49 (1 min ago) 1.78 (5 min ago) 1.90 (15 min ago) Nominal I/O usage: 1.35 MB/s File system: 71.76 seconds Write speed: 29 MB/s Read speed: 45 MB/s CPU Usage Snapshot: Type Overall System: 5 % User: 18 % Idle: 78 % Top Processes Snapshot by CPU: Process (count) CPU (Source - Location) WindowServer 62.70 % (Apple) EtreCheckPro 35.02 % (Etresoft, Inc.) com.apple.WebKit.WebContent (6) 17.74 % (Apple) com.apple.WebKit.GPU 5.78 % (Apple) Safari 3.30 % (Apple) Top Processes Snapshot by Memory: Process (count) RAM usage (Source - Location) com.apple.WebKit.WebContent (6) 1.56 GB (Apple) com.apple.WebKit.GPU 681 MB (Apple) EtreCheckPro 512 MB (Etresoft, Inc.) WindowServer 234 MB (Apple) Safari 214 MB (Apple) Top Processes Snapshot by Network Use: Process (count) Input / Output (Source - Location) com.apple.WebKit.Networking 7 MB / 600 KB (Apple) apsd 5 KB / 478 KB (Apple) mDNSResponder 185 KB / 58 KB (Apple) appstorecomponentsd 178 KB / 12 KB (Apple) parsecd 29 KB / 20 KB (Apple) Top Processes Snapshot by Energy Use: Process (count) Energy (0-100) (Source - Location) WindowServer 27 (Apple) AddressBookManag 1 (Not signed) PerfPowerServices 1 (Apple) runningboardd 0 (Apple) launchd 0 (Apple) Virtual Memory Information: Physical RAM: 8 GB Free RAM: 74 MB Used RAM: 4.47 GB Cached files: 3.45 GB Available RAM: 3.53 GB Swap Used: 0 B Software Installs (past 60 days): Install Date Name (Version) 2025-02-01 Adobe Acrobat Reader (24.005.20400) (24.005.20400) - Installer 2025-02-05 XProtectPlistConfigData (5287) - Software update 2025-02-15 macOS 15.3.1 (15.3.1) - Software update 2025-02-16 MRTConfigData (1.93) - Software update 2025-02-16 Gatekeeper Compatibility Data (1.0) - Software update 2025-02-26 XProtectPlistConfigData (5288) - Software update 2025-02-27 XProtectCloudKitUpdate (5288) - XProtectUpdateService 2025-03-01 Adobe Acrobat Reader (24.005.20421) (24.005.20421) - Installer 2025-03-04 XProtectPlistConfigData (5289) - Software update 2025-03-04 XProtectPayloads (151) - Software update 2025-03-11 XProtectPlistConfigData (5290) - Software update 2025-03-13 Adobe Acrobat Reader (25.001.20432) (25.001.20432) - Installer 2025-03-23 Adobe Acrobat Reader (25.001.20438) (25.001.20438) - Installer 2025-03-24 macOS 15.3.2 (15.3.2) - Software update 2025-03-25 XProtectCloudKitUpdate (5291) - XProtectUpdateService 2025-03-26 XProtectPlistConfigData (5291) - Software update Clean up: ~/Library/LaunchAgents/com.nero.HSMMonitor.plist ~/Desktop/HTC Sync Manager.app/Contents/Resources/HSMMonitor.app/Contents/MacOS/HSMMonitor Executable not found /Library/LaunchDaemons/com.fujifilm.importer.plist ./PCAutoSaveSv Executable not found Diagnostics Information (past 60 days): 2025-03-31 17:52:01 avconferenced Crash Executable: /usr/libexec/avconferenced 2025-03-31 17:29:34 bluetoothd Crash (6 times) First occurrence: 2025-03-28 13:43:22 Executable: /usr/sbin/bluetoothd Details: libsystem_c.dylib: abort() called 2025-03-31 07:54:26 spotlightknowledged High CPU Use (10 times) First occurrence: 2025-03-26 12:43:51 Executable: /System/Library/Frameworks/CoreSpotlight.framework/spotlightknowledged 2025-03-28 13:19:58 Amazon Music Helper Crash (3 times) First occurrence: 2025-03-26 12:00:35 Executable: /Applications/Amazon Music.app 2025-03-28 12:50:11 AdobeResourceSynchronizer Crash Executable: /Applications/Adobe Acrobat Reader.app 2025-03-27 10:24:43 mds_stores Crash (2 times) Executable: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores 2025-03-26 17:11:22 signpost_reporter High CPU Use (3 times) First occurrence: 2025-03-24 17:10:14 Executable: /usr/libexec/signpost_reporter 2025-03-24 11:59:24 com.apple.WebKit.WebContent High CPU Use Details: "com.apple.Safari"(1235) 2025-03-24 02:35:46 lsd Crash (7 times) First occurrence: 2025-03-24 01:29:26 Executable: /usr/libexec/lsd End of report