Q: Anyone seen this odd screen behavior with Mavericks?

I have a Mac Pro running 10.9.3 with a GT8800 GPU. This Mac Pro is a 1,1 which is unsupported for 10.9 so it is running the 'Sixty Four On Thirty Two' hack, however I also see this issue…

This is a clean installed 10.9.3 OS with the installer creating the user accounts, I do have home folders on a second disk with the path set in the advanced user settings of Users and Groups.

My Main user is fine.

This is a 'standard account' all logins are fine with this user.

Switching to the admin user (created upon a clean install of 10.9.2).

The Desktop flashes the grey area for 1/4 of a second or so & everything jumps back into place. App windows also restore into the correct locations. The OS is fine for this user. This is the only user that is stored on the boot partition inside /Users.

Switching to a migrated user (from 10.6.8).

The Desktop is as described, the grey area stays in place. The Desktop and the grey area is actually like two different apps. I can use (cmd+shift+4, then tap space) to take a 'window screenshot' of each area as a separate window (each one highlights with the camera icon).

I logged out of the migrated user & deleted /Users/MIGRATED-USER/Library/Caches folder. The issue appears to have gone - now it behaves like the other account, a brief flash of grey & then it goes to normal. Now for the weird part…

This user's home folder is actually on another disk /Volumes/data/Users, so deleting the path above shouldn't have any effect at all!

The user is configured with its home path to /Volumes/data/Users in the advanced user settings of Users and Groups.

This users cache is /Volumes/data/Users/MIGRATED-USER/Library/Caches - this is still the same - I didn't delete this at all.

Incidentally if I go to the login window first the issue goes away (even with the original user still logged in).

@rstreborg,

If you can find away to make the issue reappear we can try more testing, but as it stands for me it doesn't seem to come back now.

Do you have your users on another disk? If so how is it configured?

Did Onyx delete all the users caches?

Do you have any custom bootloaders?

Do you want to compare Etrecheck reports to look for similar software?

http://www.etresoft.com/etrecheck

@Linc Davis, can you explain this? It's almost like the OS has hardcoded the path to use User's cache folder but I cannot see how that could work, it would break for network users etc? It seems to be the login window system, but it really isn't clear to me. Could open directory have cached the path somewhere? My non-admin users were created as normal but I changed the home paths to point to the second disk.

Do you want me to run any commands to parse the logs or does my hacked boot EFI make this something you won't look at?

If It shows up again I will try it in safe mode, but I cannot reproduce at present - any ideas for this?

Etrecheck is a no go on my system. Three days ago I downloaded it from CNET and ran it. It hijacked Safari and Firefox.

You should have downloaded directly from this link. http://www.etresoft.com/etrecheck

The installer on CNET most likely included Genieo which was an option that you most likely didn't see when installing.

Genieo - how to remove:

http://www.thesafemac.com/art/

Oh boy that is a shame if someone is hacking up EtreCheck & putting out malware. CNET seems to be overflowing with adverts, so I avoid it.

Etrecheck is good and the developer is responsive. If you see etresoft around here please let him know your experience. His app is signed IIRC so Gatekeeper should allow it. Sadly I don't think Apple would allow it in the store (they really need a system overview report for support). I guess he could add SSL to his site to add an extra layer of confidence, but it won't stop CNET's scummy behavior.

Just to clarify my setup I have…

10.9.3

MacPro 1,1 with 'tiamo's' hacked boot.efi (SFOTT).

NVIDIA 8800GT

Boot SSD

admin's home & OS is on this disk

The two non admin users have homes from when the accounts were created but they haven't been used.

Data HD

Two non admin users are on this disk.

Both are new disks, only used with 10.9, no RAID, no core storage.

The non admin users were migrated from 10.6.8.

rstreborg wrote:

 

Etrecheck is a no go on my system. Three days ago I downloaded it from CNET and ran it. It hijacked Safari and Firefox. Without asking It installed an Amazon shopping plugin, a Ebay plugin, a Searchme plugin, reset my home page and locked me to the new page. It took me a couple of hours to recover.

That had nothing to do with EtreCheck and everything to do with C|Net's download.com. They include adware with most of their customized installers. Softonic does the same thing. Just avoid both sites and all BitTorrents to keep this from happening again.

I try to download everything from the AppStore or the developer's sites. MacUpdate hasn't implemented the adware policy yet, so I still use them in a pinch.

You can always find the direct download link on this forum at Using EtreCheck.

I just checked the CNET download installer for Etrecheck. First hint for me was Little Snitch asked for permission to install an extension in my browser. However not everyone has LS installed.

Check out what it was going to install. You have to manually select NOT to install under custom.

Not sure what site it was, but I was downloading a utility that had a small line at the bottom with the box checked. Install Genieo.

You can't be too careful now.

EtreSoft is aware and will undoubtedly be taking appropriate action.

I imagine CNET is doing this to all their installers.

I know they weren't at first, but I haven't checked to see how pervasive it is now.

This is what we get for blocking ads. Somebody has to pay C|Net to provide all these free downloads and if we block the ads on their web site then they have to resort to these tactics to be able to afford keeping it around or start charging users for the priviledge of downloading.

I believe the trusted data is a virus protector that does nothing but cause problems. Disable symantec virus as well.

Restart in Safe Boot mode and see what happens.

Safe boot

*  shutdown

*  start the Mac and *wait* for the startup chime to sound

*  after the sound, press and hold down the shift key

*  keep holding and *wait* until the grey  Apple logo appears

*  now release the shift key and just wait (it could take a few minutes)

*  eventually the login screen appears with the words SAFE BOOT

See this link to see what happens during Safe Mode.

Mac OS X: What is Safe Boot, Safe Mode?

http://support.apple.com/kb/HT1564

MadMacs0 wrote:

 

I know they weren't at first, but I haven't checked to see how pervasive it is now.

 

This is what we get for blocking ads. Somebody has to pay C|Net to provide all these free downloads and if we block the ads on their web site then they have to resort to these tactics to be able to afford keeping it around or start charging users for the priviledge of downloading.

CNET could keep it's fingers out of other peoples downloads & simply send users to the developers actual download page. If CNET's business model is peddling adware junk they should look for alternatives.

Thanks for checking Etresoft knows about it MadMac's

Here is my report - this MacPro 1,1  also did the same thing as rstreborg's

EtreCheck version: 1.9.11 (43) - report generated 10 June 2014 00:31:43 BST

Hardware Information:

          Mac Pro

          Mac Pro - model: MacPro1,1

          2 2.66 GHz Dual-Core Intel Xeon CPUs: 4 cores

          6 GB RAM

Video Information:

          NVIDIA GeForce 8800 GT - VRAM: 512 MB

System Software:

          OS X 10.9.3 (13D65) - Uptime: 1 day 5:10:57

Disk Information:

          SanDisk SDSSDP128G disk0 : (126.04 GB)

                    EFI (disk0s1) <not mounted>: 209.7 MB

                    Boot (disk0s2) / [Startup]: 125.18 GB (65.04 GB free)

                    Recovery HD (disk0s3) <not mounted>: 650 MB

          ST2000DM001-1CH164 disk1 : (2 TB)

                    EFI (disk1s1) <not mounted>: 209.7 MB

                    Data (disk1s2) /Volumes/Data: 1.88 TB (1.03 TB free)

                    10.6 (disk1s3) <not mounted>: 119.92 GB

          TOSHIBA DT01ACA200 disk2 : (2 TB)

                    EFI (disk2s1) <not mounted>: 209.7 MB

                    Boot Clone (disk2s2) <not mounted>: 125 GB

                    Data Clone (disk2s3) <not mounted>: 1.87 TB

USB Information:

          Apple Inc. iPhone

          Apple, Inc. Keyboard Hub

                    Logitech USB Receiver

                    Apple, Inc Apple Keyboard

          Apple Computer, Inc. Apple Cinema HD Display

          APC Back-UPS ES 700 FW:829.D2.I USB FW:D2

Configuration files:

          /etc/hosts - Count: 29

Gatekeeper:

          Anywhere

Kernel Extensions:

          [kext loaded] com.bresink.driver.BRESINKx86Monitoring (9.0) Support

          [kext loaded] com.orderedbytes.driver.CMUSBDevices (4.6.0 - SDK 10.6) Support

          [not loaded] com.orderedbytes.driver.CMUSBKeyboard (4.6.0 - SDK 10.6) Support

          [not loaded] com.orderedbytes.driver.CMUSBPointer (4.6.0 - SDK 10.6) Support

          [kext loaded] com.orderedbytes.driver.ControllerMateFamily (4.6.0 - SDK 10.6) Support

Launch Daemons:

          [loaded] org.macosforge.xquartz.privileged_startx.plist Support

Launch Agents:

          [running] com.orderedbytes.ControllerMateHelper.plist Support

          [loaded] org.macosforge.xquartz.startx.plist Support

User Launch Agents:

          [loaded] backup-to-pogo-void.plist Support

          [loaded] backup-void-to-g4.plist Support

          [loaded] com.google.keystone.agent.plist Support

          [loaded] com.shirtpocket.backupbytime.plist Support

          [loaded] com.valvesoftware.steamclean.plist Support

User Login Items:

          iTunesHelper

          AirClick

          Dropbox

          Hardware Monitor

Internet Plug-ins:

          OfficeLiveBrowserPlugin: Version: 12.3.6 Support

          QuickTime Plugin: Version: 7.7.3

          JavaAppletPlugin: Version: 14.9.0 - SDK 10.7 Check version

          Default Browser: Version: 537 - SDK 10.9

Safari Extensions:

          Defacer: Version: 1.0.3

          Right Exit: Version: 1.0.1

          ClickToFlash: Version: 2.9.2

          delicious: Version: 1.2

          BuiltWith: Version: 1.1

          OpenAtEnd: Version: 1.0

          Disconnect: Version: 3.0.3

          DoNotTrackMe: Online Privacy Protection: Version: 3.1.1064

          AdBlock: Version: 2.6.18

          Pinbar: Version: 2.78

          BetterSource: Version: 1.1

          Fireballed: Version: 1.2

          Unicorn: Version: 1.0

          AdBlock: Version: 2.6.34

          DuckDuckGo: Version: 1.6.1

          Ghostery: Version: 5.1.0

          Firebug Lite for Safari: Version: 1.2.0.16797

          ClickToFlash: Version: 2.9.3

          Validator: Version: 1.4.2

          JavaScript Blacklist: Version: 1.0.1

          Ghostery: Version: 5.2.0

Audio Plug-ins:

          BluetoothAudioPlugIn: Version: 1.0 - SDK 10.9

          AirPlay: Version: 2.0 - SDK 10.9

          AppleAVBAudio: Version: 203.2 - SDK 10.9

          iSightAudio: Version: 7.7.3 - SDK 10.9

iTunes Plug-ins:

          Quartz Composer Visualizer: Version: 1.4 - SDK 10.9

3rd Party Preference Panes:

          FUSE for OS X (OSXFUSE)  Support

Time Machine:

          Time Machine not configured!

Top Processes by CPU:

              14%          Safari

               8%          WindowServer

               2%          HardwareMonitor

               2%          Dropbox

               1%          Adobe Photoshop CS3

Top Processes by Memory:

          233 MB          iTunes

          197 MB          Safari

          104 MB          mds_stores

          100 MB          WindowServer

          80 MB          Mail

Virtual Memory Information:

          1.28 GB          Free RAM

          2.01 GB          Active RAM

          312 MB          Inactive RAM

          859 MB          Wired RAM

          4.23 GB          Page-ins

          35 MB          Page-outs

NB: the /etc/hosts are for local website testing - deal with it

The two launchd jobs are my own rsync jobs…

backup-to-pogo-void.plist

backup-void-to-g4.plist

This is running Tiamo's boot.efi to make 64bit work on 32bit hardware.

More to follow…

I used Filemerge from Xcode to compare my report to rstreborg's you are welcome to try the same.

This is my overview…

Key:

DR: Drew Reece (My Mac pro)

RB: rstreborg’s Mac Pro

Etrecheck version is the same

Hardware Information:

RB: Mac Pro - model: MacPro3,1

DR: Mac Pro - model: MacPro1,1

Video Information:

BOTH: NVIDIA GeForce 8800 GT - VRAM: 512 MB

System Software:

          BOTH: BUILD

Disk Information:

          Different obviously, we both have additional bootable HD's

USB Information:

          BOTH: Apple Computer, Inc. Apple Cinema HD Display

          DR: Logitech USB Receiver

          DR: APC Back-UPS ES 700 FW:829.D2.I USB FW:D2

          RB: Logitech USB Optical Mouse

          RB: Apple Inc. Bluetooth USB Host Controller

FireWire Information:

          RB: Drobo connected

Gatekeeper:

          DR: Anywhere

          RB: Mac App Store and identified developers

Kernel Extensions:

          Nothing in common

Startup Items:

          RB: has 3

          DR: none

Launch Daemons:

          Nothing in common

Launch Agents:

          Nothing in common

User Launch Agents:

          Nothing in common

User Login Items:

          Nothing in common

Internet Plug-ins:

          BOTH: JavaAppletPlugin: Version: 14.9.0 - SDK 10.7 Check version

          BOTH: Default Browser: Version: 537 - SDK 10.9

          BOTH: QuickTime Plugin: Version: 7.7.3

Safari Extensions:

          SAME: Adblock, ClicktoFlash, Ghostery

          RB: JavaScript Blocker: Version: 4.1.12

          DR: too many extensions see report.

Audio Plug-ins:

SAME

iTunes Plug-ins:

SAME

3rd Party Preference Panes:

          DR: has OS X Fuse only

Time Machine:

          DR: none

          RB: uses TM

Virtual Memory Information:

          DR: still reading huh?

          RB: apparently so

I can't see many things that are the same (aside from the GPU, OS, a Cinema display & we have a Logitech mouse using different drivers).  I'm also having difficulty getting the issue to appear again, I do still see the grey area & the desktop resizes a few times, but it no longer freezes in place.

It also doesn't happen if I switch to the login window before switching to another user.

To me it looks like when a game resets your graphics resolution & everything jumps around when you quit. It makes me think it's part of the window manager outside of the realm of the Finder (I hope that makes sense).