-
All replies
-
Helpful answers
-
Oct 17, 2013 5:06 PM in response to Sannapannaby Linc Davis,Please read this whole message before doing anything.
This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, or by corruption of certain system caches.Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards. Boot in safe mode and log in to the account with the problem. Note: If FileVault is enabled on some models, or if a firmware password is set, or if the boot volume is a software RAID, you can’t do this. Ask for further instructions.Safe mode is much slower to boot and run than normal, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal boot may also be somewhat slow.
The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.
Test while in safe mode. Same problem?
After testing, reboot as usual (i.e., not in safe mode) and verify that you still have the problem. Post the results of the test. -
Oct 26, 2013 1:42 AM in response to Linc Davisby Sannapanna,No, when in safe mode Safari works fine. So I guess this means it is a third-party software?
Last week I reinstalled OS X, then everything worked fine. But today the problem came back. Not sure what to do. How can I identify which software that is corrupt?
//Sanna
-
Oct 26, 2013 11:54 PM in response to Sannapannaby Linc Davis,Please read this whole message before doing anything.This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software — potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions — they’re easy to carry out and won’t change anything on your Mac.These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.Below are instructions to enter some UNIX shell commands. The commands are harmless, but they must be entered exactly as given in order to work. If you have doubts about the safety of the procedure suggested here, search this site for other discussions in which it’s been followed without any report of ill effects.Some of the commands will line-wrap or scroll in your browser, but each one is really just a single line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then copy it. The headings “Step 1” and so on are not part of the commands.Note: If you have more than one user account, Step 2 must be taken as an administrator. Ordinarily that would be the user created automatically when you booted the system for the first time. The other steps should be taken as the user who has the problem, if different. Most personal Macs have only one user, and in that case this paragraph doesn’t apply.Launch the Terminal application in any of the following ways:☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.When you launch Terminal, a text window will open with a line already in it, ending either in a dollar sign (“$”) or a percent sign (“%”). If you get the percent sign, enter “sh” and press return. You should then get a new line ending in a dollar sign.Step 1Triple-click anywhere in the line of text below on this page to select it:kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}' | open -efCopy the selected text to the Clipboard by pressing the key combination command-C. Then click anywhere in the Terminal window and paste (command-V). I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting. A TextEdit window will open with the output of the command. If the command produced no output, the window will be empty. Post the contents of the TextEdit window (not the Terminal window), if any — the text, please, not a screenshot. You can then close the TextEdit window. The title of the window doesn't matter, and you don't need to post that. No typing is involved in this step.Step 2Repeat with this line:{ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|cups|isc|ntp|postf|x)/{print $3}'; echo; sudo defaults read com.apple.loginwindow LoginHook; echo; sudo crontab -l; } 2> /dev/null | open -efThis time you'll be prompted for your login password, which you do have to type. Nothing will be displayed when you type it. Type it carefully and then press return. You may get a one-time warning to be careful. Heed that warning, but don't post it. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.Note: If you don’t have a login password, you’ll need to set one before taking this step. If that’s not possible, skip to the next step.Step 3{ launchctl list | sed 1d | awk '!/0x|com\.apple|org\.(x|openbsd)/{print $3}'; echo; crontab -l 2> /dev/null; } | open -efStep 4ls -A /e*/{cr,la,mach}* {,/}Lib*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts .la* 2> /dev/null | open -efImportant: If you formerly synchronized with a MobileMe account, your me.com email address may appear in the output of the above command. If so, anonymize it before posting.Step 5osascript -e 'tell application "System Events" to get name of login items' | open -ef
Remember, steps 1-5 are all copy-and-paste — no typing, except your password. Also remember to post the output.You can then quit Terminal. -
Jun 4, 2016 7:39 AM in response to Linc Davisby ShayRH,Hi Linc,
I followed your clear instructions and got the following texts. What should my next steps be?
Thanks a lot!
Step1:
com.sophos.nke.swi (9.4.52)
com.sophos.kext.sav (9.4.52)
Step2:
com.sophos.webd
com.sophos.scan
com.progressionist.plist
com.sophos.intercheck
com.sophos.common.servicemanager
com.sophos.mcs
com.sophos.autoupdate
com.sophos.sxld
com.sophos.notification
com.sophos.configuration
com.malwarebytes.MBAMHelperTool
/Library/uusktas/uusktas.app/Contents/MacOS/uusktas
Step3:
com.google.GoogleDrive.34964
com.sophos.uiserver
com.holgersindbaek.solitaire.free.app.launcher
com.stahltechnologies.App-for-Instagram-Helper
com.google.keystone.user.agent
com.bittorrent.uTorrent.18492
Step4:
/Library/Components:
/Library/Extensions:
ACS6x.kext
ATTOCelerityFC8.kext
ATTOExpressSASHBA2.kext
ATTOExpressSASRAID2.kext
ArcMSR.kext
CalDigitHDProDrv.kext
HighPointIOP.kext
HighPointRR.kext
PromiseSTEX.kext
SoftRAID.kext
SophosNetworkInterceptor.kext
SophosOnAccessInterceptor.kext
/Library/Frameworks:
AEProfiling.framework
AERegistration.framework
AudioMixEngine.framework
NyxAudioAnalysis.framework
PluginManager.framework
SAVI.framework
SUMScanKit.framework
SophosGenericsCommon.framework
SophosGenericsCore.framework
iTunesLibrary.framework
/Library/Input Methods:
/Library/Internet Plug-Ins:
Default Browser.plugin
Disabled Plug-Ins
Quartz Composer.webplugin
/Library/Keyboard Layouts:
/Library/LaunchAgents:
com.sophos.uiserver.plist
/Library/LaunchDaemons:
com.apple.morkim.plist
com.malwarebytes.MBAMHelperTool.plist
com.progressionist.plist
com.sophos.common.servicemanager.plist
com.uusktas.plist
/Library/PreferencePanes:
/Library/PrivilegedHelperTools:
com.malwarebytes.MBAMHelperTool
/Library/QuickLook:
iBooksAuthor.qlgenerator
iWork.qlgenerator
/Library/QuickTime:
AppleIntermediateCodec.component
AppleMPEG2Codec.component
/Library/ScriptingAdditions:
/Library/Spotlight:
Microsoft Office.mdimporter
iBooksAuthor.mdimporter
iWork.mdimporter
/Library/StartupItems:
/etc/mach_init.d:
/etc/mach_init_per_login_session.d:
/etc/mach_init_per_user.d:
Library/Address Book Plug-Ins:
SkypeABCaller.bundle
SkypeABChatter.bundle
SkypeABDialer.bundle
SkypeABSMS.bundle
Library/Fonts:
Library/Input Methods:
.localized
Library/Internet Plug-Ins:
.DS_Store
Picasa.plugin
Library/Keyboard Layouts:
Library/LanguageModeling:
da-dynamic.lm
de-dynamic.lm
en-dynamic.lm
es-dynamic.lm
fr-dynamic.lm
it-dynamic.lm
pt-dynamic.lm
Library/LaunchAgents:
com.apple.FolderActions.enabled.plist
com.apple.FolderActions.folders.plist
com.google.keystone.agent.plist
Library/PreferencePanes:
Library/Services:
Add To Backup Selection.workflow
Instant Backup.workflow
Remove From Backup Selection.workflow
View Previous Versions.workflow
Step5:
iTunesHelper, Audacity, uTorrent, Google Drive
-
Jun 4, 2016 9:58 AM in response to ShayRHby Eric Root,You might want to consider starting a new discussion. Since this one is a couple of years old, less people are likely to look at it. You can link to this one.
Uninstall Sophos.
-
Jun 4, 2016 10:35 AM in response to Eric Rootby ShayRH,Thanks a lot, Eric!
I installed Sophos today, as I had no antivirus installed on my machine.
I'll uninstall it as per your recommendation, though the problem appeared much before it was installed...
BTW, in safe mode everything's fine...
-
Jun 4, 2016 11:08 AM in response to ShayRHby ShayRH,I removed Sophos, but the problem is still there...
-
Jun 5, 2016 9:18 AM in response to ShayRHby Eric Root,Please start a new discussion and try running this program and then copy and paste the output in a reply. The program was created by Etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. This will show what is running on your computer. No personal information is shown.