Q: how to stop a key log
-
Jun 21, 2014 8:10 AMby delew,One of my bank accounts has been compromised twice with money being removed and the security from that bank believes that a key log has been attached to my computer. this after I had changed all of my relevant info such as my password, account numbers etc. I just received a notice from another agency asking if I had changed or attempted to change a pin number, which I had not done.
-
Jun 21, 2014 8:17 AMby Linc Davis,A keylogger is by far the least likely explanation for what happened. Probably the bank had an internal security breach for which it wants to blame you. However, if you want to be reasonably sure that your computer isn't compromised, see below.
1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the behest of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed:
- Copy a line of text in this window to the Clipboard.
- Paste into the window of another application.
- Wait for the test to run. It usually takes a few minutes.
- Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts 51 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports 'com.autodesk.AutoCad com.evenflow.dropbox com.google.GoogleDrive' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n\t(%s)\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1000) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/d;/(etc|Preferences)\//s/^\.\/[^/]+//p;' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| ","||kMDItem'${p[35]}'=");sub("^.."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[9]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]" "$1;b=b$1;} END { if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' ' /^ +B/{ s/.+= |(-[0-9]+)?\.s.+//g;p;} ' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' 's/0/Off/p' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil PlistBuddy whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '-c Print /L*/P*/loginw*' '-c Print L*/P*/*loginit*' '-c Print L*/Saf*/*/E*.plist' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' '-c Print\ :'${p[35]}' 2>&1' '-c Print\ :Label 2>&1' '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' -i4TCP:0-1023 com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' );N1=${#c2[@]};for j in {0..8};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A1 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D22 4 4 50 0;D13 14 3 49 5;D12 26 48 59 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-Copy the selected text to the Clipboard by pressing the key combination command-C.
7. Launch the built-in Terminal application in any of the following ways:
- Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
- In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
- Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "syntax error," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start Time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
________________________________
Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.
-
Jun 21, 2014 12:35 PMby delew,Start time: 08:44:02 06/21/14
Model Identifier: Macmini6,1
System Version: OS X 10.9.3 (13D65)
Kernel Version: Darwin 13.2.0
Boot Mode: Normal
Memory
BANK 0/DIMM0:
Size: 8 GB
Speed: 1600 MHz
Status: OK
Manufacturer: 0x859B
BANK 1/DIMM0:
Size: 8 GB
Speed: 1600 MHz
Status: OK
Manufacturer: 0x859B
FileVault: On
Diagnostic reports
2014-06-21 Event Manager hang
2014-06-21 Safari hang
Log
Jun 21 00:15:51 CODE SIGNING: cs_invalid_page(0x10ebd0000): p=594[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 00:17:58 CODE SIGNING: cs_invalid_page(0x1099fc000): p=606[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 00:18:45 CODE SIGNING: cs_invalid_page(0x108fb6000): p=614[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 00:50:58 ZBAVKauth: [0xffffff8053a792d0] daemon response timeout
Jun 21 00:51:05 ZBAVKauth: [0xffffff805dfa21e0] daemon response timeout
Jun 21 00:51:33 ZBAVKauth: [0xffffff80642e05a0] daemon response timeout
Jun 21 00:51:41 ZBAVKauth: [0xffffff80676f4960] daemon response timeout
Jun 21 00:52:02 ZBAVKauth: [0xffffff8066279b40] daemon response timeout
Jun 21 00:52:07 ZBAVKauth: [0xffffff8066279b40] daemon response timeout
Jun 21 00:52:26 ZBAVKauth: [0xffffff806626c4b0] daemon response timeout
Jun 21 00:52:31 ZBAVKauth: [0xffffff806626c4b0] daemon response timeout
Jun 21 00:52:57 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 00:53:02 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 00:53:07 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 00:53:12 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 02:04:54 process WindowServer[108] caught causing excessive wakeups. Observed wakeups rate (per sec): 248; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 582657
Jun 21 02:04:55 CODE SIGNING: cs_invalid_page(0x109fd0000): p=946[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 07:44:50 wl0: Roamed or switched channel, reason #4, bssid 00
Jun 21 08:00:59 CODE SIGNING: cs_invalid_page(0x10b3c5000): p=1067[spindump_symboli] final status 0x0, allowing (remove VALID) page
Jun 21 08:11:56 AppleKeyStore: operation failed (pid: 211 sel: 12 ret: e00002ce)
Jun 21 08:13:34 CODE SIGNING: cs_invalid_page(0x10d9e0000): p=1123[spindump_symboli] final status 0x0, allowing (remove VALID) page
Jun 21 08:15:57 AppleKeyStore: operation failed (pid: 211 sel: 12 ret: e00002ce)
Jun 21 08:25:25 Error 2 registering socket filter (com.symantec.fw.ac.at). Your computer may not be fully protected.
Jun 21 08:26:26 wl0: Roamed or switched channel, reason #0, bssid 00
Jun 21 08:26:49 CODE SIGNING: cs_invalid_page(0x100000000): p=300[SmartDaemon] final status 0x0, allowing (remove VALID) page
kexts
com.symantec.kext.internetSecurity (5.3.1f8)
com.symantec.kext.pf (5.6.1f9)
com.symantec.kext.ips (3.9.2f1)
com.sophos.nke.swi (9.0.53)
com.intego.netbarrier.kext.monitor (143)
com.intego.netbarrier.kext.process (143)
com.intego.netbarrier.kext.network (143)
com.sophos.kext.sav (9.0.61)
com.symantec.kext.filesecurity (12.6.1f9)
com.symantec.kext.fw (5.3.1f9)
com.symantec.kext.SymAPComm (12.6.1f9)
net.kromtech.kext.AVKauth (2.3.6)
net.kromtech.kext.Firewall (2.3.6)
Daemons
com.sophos.scan
com.sophos.intercheck
com.symantec.deepsight-extractor
com.zeobit.MacKeeper.plugin.AntiTheft.daemon
com.zeobit.MacKeeper.AntiVirus
com.symantec.symdaemon
com.symantec.sharedsettings
com.symantec.liveupdate.daemon
com.symantec.liveupdate.daemon.ondemand
com.symantec.errorreporting.periodic
com.sophos.webd
com.sophos.sxld
com.sophos.notification
com.sophos.configuration
com.sophos.autoupdate
com.smithmicro.schedulerdaemon
com.macpaw.CleanMyMac2.Agent
com.intego.virusbarrier.daemon.scanner
com.intego.virusbarrier.daemon
com.intego.virusbarrier.daemon.logger
com.intego.virusbarrier.daemon.emlparser
com.intego.netupdate.daemon
com.intego.netbarrier.daemon
com.intego.netbarrier.daemon.monitor
com.intego.netbarrier.daemon.logger
com.intego.commonservices.metrics.kschecker
com.intego.commonservices.icalserver
com.intego.commonservices.daemon.taskmanager
com.intego.commonservices.daemon.integod
com.intego.BackupAssistant.daemon
com.cleverfiles.cfbackd
com.adobe.fpsaud
Agents
com.symantec.uiagent.application
com.symantec.nis.application
com.symantec.errorreporting.periodic-agent
com.sophos.uiserver
com.smithmicro.cleaning.quickbackupcheck
com.intego.virusbarrier.alert
com.intego.netupdate.agent
com.intego.netbarrier.alert
com.intego.commonservices.uninstaller
com.intego.commonservices.taskmanager
com.intego.commonservices.integomenu
com.intego.backupassistant.agent
com.epson.eventmanager.agent
com.epson.esua.launcher
com.epson.Epson_Low_Ink_Reminder.launcher
com.zeobit.MacKeeper.Helper
com.smithmicro.cleaning.schedulermailer
com.macpaw.CleanMyMac2Helper.trashWatcher
com.macpaw.CleanMyMac2Helper.scheduledScan
com.macpaw.CleanMyMac2Helper.diskSpaceWatcher
com.google.keystone.user.agent
com.adobe.ARM.UUID
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist
(com.epson.Epson_Low_Ink_Reminder.launcher)
/Library/LaunchAgents/com.epson.esua.launcher.plist
(com.epson.esua.launcher)
/Library/LaunchAgents/com.epson.eventmanager.agent.plist
(com.epson.eventmanager.agent)
/Library/LaunchAgents/com.intego.backupassistant.agent.plist
(com.intego.backupassistant.agent)
/Library/LaunchAgents/com.intego.commonservices.integomenu.plist
(com.intego.commonservices.integomenu)
/Library/LaunchAgents/com.intego.commonservices.taskmanager.plist
(com.intego.commonservices.taskmanager)
/Library/LaunchAgents/com.intego.commonservices.uninstaller.plist
(com.intego.commonservices.uninstaller)
/Library/LaunchAgents/com.intego.netbarrier.alert.plist
(com.intego.netbarrier.alert)
/Library/LaunchAgents/com.intego.netupdate.agent.plist
(com.intego.netupdate.agent)
/Library/LaunchAgents/com.intego.virusbarrier.alert.plist
(com.intego.virusbarrier.alert)
/Library/LaunchAgents/com.smithmicro.cleaning.quickbackupcheck.plist
(com.smithmicro.cleaning.quickbackupcheck)
/Library/LaunchAgents/com.sophos.uiserver.plist
(com.sophos.uiserver)
/Library/LaunchAgents/com.symantec.errorreporter-periodicagent.plist
(com.symantec.errorreporting.periodic-agent)
/Library/LaunchAgents/com.symantec.nis.application.plist
(com.symantec.nis.application)
/Library/LaunchAgents/com.symantec.uiagent.application.plist
(com.symantec.uiagent.application)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.cleverfiles.cfbackd.plist
(com.cleverfiles.cfbackd)
/Library/LaunchDaemons/com.intego.BackupAssistant.daemon.plist
(com.intego.BackupAssistant.daemon)
/Library/LaunchDaemons/com.intego.commonservices.daemon.integod.plist
(com.intego.commonservices.daemon.integod)
/Library/LaunchDaemons/com.intego.commonservices.daemon.taskmanager.plist
(com.intego.commonservices.daemon.taskmanager)
/Library/LaunchDaemons/com.intego.commonservices.icalserver.plist
(com.intego.commonservices.icalserver)
/Library/LaunchDaemons/com.intego.commonservices.metrics.kschecker.plist
(com.intego.commonservices.metrics.kschecker)
/Library/LaunchDaemons/com.intego.netbarrier.daemon.logger.plist
(com.intego.netbarrier.daemon.logger)
/Library/LaunchDaemons/com.intego.netbarrier.daemon.monitor.plist
(com.intego.netbarrier.daemon.monitor)
/Library/LaunchDaemons/com.intego.netbarrier.daemon.plist
(com.intego.netbarrier.daemon)
/Library/LaunchDaemons/com.intego.netupdate.daemon.plist
(com.intego.netupdate.daemon)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.emlparser.plist
(com.intego.virusbarrier.daemon.emlparser)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.logger.plist
(com.intego.virusbarrier.daemon.logger)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.plist
(com.intego.virusbarrier.daemon)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.scanner.plist
(com.intego.virusbarrier.daemon.scanner)
/Library/LaunchDaemons/com.macpaw.CleanMyMac2.Agent.plist
(com.macpaw.CleanMyMac2.Agent)
/Library/LaunchDaemons/com.smithmicro.schedulerdaemon.plist
(com.smithmicro.schedulerdaemon)
/Library/LaunchDaemons/com.sophos.autoupdate.plist
(com.sophos.autoupdate)
/Library/LaunchDaemons/com.sophos.configuration.plist
(com.sophos.configuration)
/Library/LaunchDaemons/com.sophos.intercheck.plist
(com.sophos.intercheck)
/Library/LaunchDaemons/com.sophos.notification.plist
(com.sophos.notification)
/Library/LaunchDaemons/com.sophos.scan.plist
(com.sophos.scan)
/Library/LaunchDaemons/com.sophos.sxld.plist
(com.sophos.sxld)
/Library/LaunchDaemons/com.sophos.webd.plist
(com.sophos.webd)
/Library/LaunchDaemons/com.symantec.deepsight-extractor.plist
(com.symantec.deepsight-extractor)
/Library/LaunchDaemons/com.symantec.errorreporter-periodic.plist
(com.symantec.errorreporting.periodic)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.ondemand.plist
(com.symantec.liveupdate.daemon.ondemand)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.plist
(com.symantec.liveupdate.daemon)
/Library/LaunchDaemons/com.symantec.nav.migrateqtf.plist
(com.symantec.nav.migrateqtf)
/Library/LaunchDaemons/com.symantec.sharedsettings.plist
(com.symantec.sharedsettings)
/Library/LaunchDaemons/com.symantec.symdaemon.plist
(com.symantec.symdaemon)
/Library/LaunchDaemons/com.zeobit.MacKeeper.AntiVirus.plist
(com.zeobit.MacKeeper.AntiVirus)
/Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist
(com.zeobit.MacKeeper.plugin.AntiTheft.daemon)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.user.agent)
Library/LaunchAgents/com.macpaw.CleanMyMac.helperTool.plist
(com.macpaw.CleanMyMac.helperTool)
Library/LaunchAgents/com.macpaw.CleanMyMac.trashSizeWatcher.plist
(com.macpaw.CleanMyMac.trashSizeWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac.volumeWatcher.plist
(com.macpaw.CleanMyMac.volumeWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist
(com.macpaw.CleanMyMac2Helper.diskSpaceWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.scheduledScan.plist
(com.macpaw.CleanMyMac2Helper.scheduledScan)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.trashWatcher.plist
(com.macpaw.CleanMyMac2Helper.trashWatcher)
Library/LaunchAgents/com.smithmicro.cleaning.schedulermailer.plist
(com.smithmicro.cleaning.schedulermailer)
Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist
(com.zeobit.MacKeeper.Helper)
Startup items
/System/Library/StartupItems/WiFiUtilityStartUp/CommandServer
/System/Library/StartupItems/WiFiUtilityStartUp/StartupParameters.plist
/System/Library/StartupItems/WiFiUtilityStartUp/WiFiUtilityStartUp
/Library/StartupItems/Intego Backup Assistant/BackupAssistantAgent.app/Contents/Info.plist
/Library/StartupItems/Intego Backup Assistant/BackupAssistantAgent.app/Contents/MacOS/BackupAssistantAgent
/Library/StartupItems/Intego Backup Assistant/BackupAssistantDaemon
/Library/StartupItems/Intego Backup Assistant/BackupAssistantEngine
/Library/StartupItems/Intego Backup Assistant/PowerManagerTool
/Library/StartupItems/Intego Backup Assistant/uninstall.sh
/Library/StartupItems/NetworkOptimizerSC/NetworkOptimizerSC
/Library/StartupItems/NetworkOptimizerSC/StartupParameters.plist
Font issues: 4
Bad plists
/Library/Preferences/com.epson.Epson Connect Printer Setup.UnInstallList.plist
/Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist
/Library/Preferences/com.epson.Epson Low Ink Reminder.UnInstallList.plist
/Library/Preferences/com.epson.EPSON Scan.UnInstallList.plist
/Library/Preferences/com.epson.Epson Scanner ICA Driver.UnInstallList.plist
/Library/Preferences/com.epson.EPSON Software Updater.UnInstallList.plist
/Library/Preferences/com.epson.EpsonNet Config v4.UnInstallList.plist
/Library/Preferences/com.epson.Inkjet Printer Driver.UnInstallList.plist
DNS: 209.18.47.61 (static)
Restricted files: 912
Safari extensions
Add To Amazon Wish List
Searchme
Amazon Shopping Assistant
Ebay Shopping Assistant
Slick Savings
Norton Internet Security
Elapsed time (s): 285
-
Jun 21, 2014 12:36 PMby delew,okay here it is
Start time: 08:44:02 06/21/14
Model Identifier: Macmini6,1
System Version: OS X 10.9.3 (13D65)
Kernel Version: Darwin 13.2.0
Boot Mode: Normal
Memory
BANK 0/DIMM0:
Size: 8 GB
Speed: 1600 MHz
Status: OK
Manufacturer: 0x859B
BANK 1/DIMM0:
Size: 8 GB
Speed: 1600 MHz
Status: OK
Manufacturer: 0x859B
FileVault: On
Diagnostic reports
2014-06-21 Event Manager hang
2014-06-21 Safari hang
Log
Jun 21 00:15:51 CODE SIGNING: cs_invalid_page(0x10ebd0000): p=594[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 00:17:58 CODE SIGNING: cs_invalid_page(0x1099fc000): p=606[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 00:18:45 CODE SIGNING: cs_invalid_page(0x108fb6000): p=614[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 00:50:58 ZBAVKauth: [0xffffff8053a792d0] daemon response timeout
Jun 21 00:51:05 ZBAVKauth: [0xffffff805dfa21e0] daemon response timeout
Jun 21 00:51:33 ZBAVKauth: [0xffffff80642e05a0] daemon response timeout
Jun 21 00:51:41 ZBAVKauth: [0xffffff80676f4960] daemon response timeout
Jun 21 00:52:02 ZBAVKauth: [0xffffff8066279b40] daemon response timeout
Jun 21 00:52:07 ZBAVKauth: [0xffffff8066279b40] daemon response timeout
Jun 21 00:52:26 ZBAVKauth: [0xffffff806626c4b0] daemon response timeout
Jun 21 00:52:31 ZBAVKauth: [0xffffff806626c4b0] daemon response timeout
Jun 21 00:52:57 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 00:53:02 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 00:53:07 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 00:53:12 ZBAVKauth: [0xffffff80652f3b40] daemon response timeout
Jun 21 02:04:54 process WindowServer[108] caught causing excessive wakeups. Observed wakeups rate (per sec): 248; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 582657
Jun 21 02:04:55 CODE SIGNING: cs_invalid_page(0x109fd0000): p=946[spindump] final status 0x0, allowing (remove VALID) page
Jun 21 07:44:50 wl0: Roamed or switched channel, reason #4, bssid 00
Jun 21 08:00:59 CODE SIGNING: cs_invalid_page(0x10b3c5000): p=1067[spindump_symboli] final status 0x0, allowing (remove VALID) page
Jun 21 08:11:56 AppleKeyStore: operation failed (pid: 211 sel: 12 ret: e00002ce)
Jun 21 08:13:34 CODE SIGNING: cs_invalid_page(0x10d9e0000): p=1123[spindump_symboli] final status 0x0, allowing (remove VALID) page
Jun 21 08:15:57 AppleKeyStore: operation failed (pid: 211 sel: 12 ret: e00002ce)
Jun 21 08:25:25 Error 2 registering socket filter (com.symantec.fw.ac.at). Your computer may not be fully protected.
Jun 21 08:26:26 wl0: Roamed or switched channel, reason #0, bssid 00
Jun 21 08:26:49 CODE SIGNING: cs_invalid_page(0x100000000): p=300[SmartDaemon] final status 0x0, allowing (remove VALID) page
kexts
com.symantec.kext.internetSecurity (5.3.1f8)
com.symantec.kext.pf (5.6.1f9)
com.symantec.kext.ips (3.9.2f1)
com.sophos.nke.swi (9.0.53)
com.intego.netbarrier.kext.monitor (143)
com.intego.netbarrier.kext.process (143)
com.intego.netbarrier.kext.network (143)
com.sophos.kext.sav (9.0.61)
com.symantec.kext.filesecurity (12.6.1f9)
com.symantec.kext.fw (5.3.1f9)
com.symantec.kext.SymAPComm (12.6.1f9)
net.kromtech.kext.AVKauth (2.3.6)
net.kromtech.kext.Firewall (2.3.6)
Daemons
com.sophos.scan
com.sophos.intercheck
com.symantec.deepsight-extractor
com.zeobit.MacKeeper.plugin.AntiTheft.daemon
com.zeobit.MacKeeper.AntiVirus
com.symantec.symdaemon
com.symantec.sharedsettings
com.symantec.liveupdate.daemon
com.symantec.liveupdate.daemon.ondemand
com.symantec.errorreporting.periodic
com.sophos.webd
com.sophos.sxld
com.sophos.notification
com.sophos.configuration
com.sophos.autoupdate
com.smithmicro.schedulerdaemon
com.macpaw.CleanMyMac2.Agent
com.intego.virusbarrier.daemon.scanner
com.intego.virusbarrier.daemon
com.intego.virusbarrier.daemon.logger
com.intego.virusbarrier.daemon.emlparser
com.intego.netupdate.daemon
com.intego.netbarrier.daemon
com.intego.netbarrier.daemon.monitor
com.intego.netbarrier.daemon.logger
com.intego.commonservices.metrics.kschecker
com.intego.commonservices.icalserver
com.intego.commonservices.daemon.taskmanager
com.intego.commonservices.daemon.integod
com.intego.BackupAssistant.daemon
com.cleverfiles.cfbackd
com.adobe.fpsaud
Agents
com.symantec.uiagent.application
com.symantec.nis.application
com.symantec.errorreporting.periodic-agent
com.sophos.uiserver
com.smithmicro.cleaning.quickbackupcheck
com.intego.virusbarrier.alert
com.intego.netupdate.agent
com.intego.netbarrier.alert
com.intego.commonservices.uninstaller
com.intego.commonservices.taskmanager
com.intego.commonservices.integomenu
com.intego.backupassistant.agent
com.epson.eventmanager.agent
com.epson.esua.launcher
com.epson.Epson_Low_Ink_Reminder.launcher
com.zeobit.MacKeeper.Helper
com.smithmicro.cleaning.schedulermailer
com.macpaw.CleanMyMac2Helper.trashWatcher
com.macpaw.CleanMyMac2Helper.scheduledScan
com.macpaw.CleanMyMac2Helper.diskSpaceWatcher
com.google.keystone.user.agent
com.adobe.ARM.UUID
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist
(com.epson.Epson_Low_Ink_Reminder.launcher)
/Library/LaunchAgents/com.epson.esua.launcher.plist
(com.epson.esua.launcher)
/Library/LaunchAgents/com.epson.eventmanager.agent.plist
(com.epson.eventmanager.agent)
/Library/LaunchAgents/com.intego.backupassistant.agent.plist
(com.intego.backupassistant.agent)
/Library/LaunchAgents/com.intego.commonservices.integomenu.plist
(com.intego.commonservices.integomenu)
/Library/LaunchAgents/com.intego.commonservices.taskmanager.plist
(com.intego.commonservices.taskmanager)
/Library/LaunchAgents/com.intego.commonservices.uninstaller.plist
(com.intego.commonservices.uninstaller)
/Library/LaunchAgents/com.intego.netbarrier.alert.plist
(com.intego.netbarrier.alert)
/Library/LaunchAgents/com.intego.netupdate.agent.plist
(com.intego.netupdate.agent)
/Library/LaunchAgents/com.intego.virusbarrier.alert.plist
(com.intego.virusbarrier.alert)
/Library/LaunchAgents/com.smithmicro.cleaning.quickbackupcheck.plist
(com.smithmicro.cleaning.quickbackupcheck)
/Library/LaunchAgents/com.sophos.uiserver.plist
(com.sophos.uiserver)
/Library/LaunchAgents/com.symantec.errorreporter-periodicagent.plist
(com.symantec.errorreporting.periodic-agent)
/Library/LaunchAgents/com.symantec.nis.application.plist
(com.symantec.nis.application)
/Library/LaunchAgents/com.symantec.uiagent.application.plist
(com.symantec.uiagent.application)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.cleverfiles.cfbackd.plist
(com.cleverfiles.cfbackd)
/Library/LaunchDaemons/com.intego.BackupAssistant.daemon.plist
(com.intego.BackupAssistant.daemon)
/Library/LaunchDaemons/com.intego.commonservices.daemon.integod.plist
(com.intego.commonservices.daemon.integod)
/Library/LaunchDaemons/com.intego.commonservices.daemon.taskmanager.plist
(com.intego.commonservices.daemon.taskmanager)
/Library/LaunchDaemons/com.intego.commonservices.icalserver.plist
(com.intego.commonservices.icalserver)
/Library/LaunchDaemons/com.intego.commonservices.metrics.kschecker.plist
(com.intego.commonservices.metrics.kschecker)
/Library/LaunchDaemons/com.intego.netbarrier.daemon.logger.plist
(com.intego.netbarrier.daemon.logger)
/Library/LaunchDaemons/com.intego.netbarrier.daemon.monitor.plist
(com.intego.netbarrier.daemon.monitor)
/Library/LaunchDaemons/com.intego.netbarrier.daemon.plist
(com.intego.netbarrier.daemon)
/Library/LaunchDaemons/com.intego.netupdate.daemon.plist
(com.intego.netupdate.daemon)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.emlparser.plist
(com.intego.virusbarrier.daemon.emlparser)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.logger.plist
(com.intego.virusbarrier.daemon.logger)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.plist
(com.intego.virusbarrier.daemon)
/Library/LaunchDaemons/com.intego.virusbarrier.daemon.scanner.plist
(com.intego.virusbarrier.daemon.scanner)
/Library/LaunchDaemons/com.macpaw.CleanMyMac2.Agent.plist
(com.macpaw.CleanMyMac2.Agent)
/Library/LaunchDaemons/com.smithmicro.schedulerdaemon.plist
(com.smithmicro.schedulerdaemon)
/Library/LaunchDaemons/com.sophos.autoupdate.plist
(com.sophos.autoupdate)
/Library/LaunchDaemons/com.sophos.configuration.plist
(com.sophos.configuration)
/Library/LaunchDaemons/com.sophos.intercheck.plist
(com.sophos.intercheck)
/Library/LaunchDaemons/com.sophos.notification.plist
(com.sophos.notification)
/Library/LaunchDaemons/com.sophos.scan.plist
(com.sophos.scan)
/Library/LaunchDaemons/com.sophos.sxld.plist
(com.sophos.sxld)
/Library/LaunchDaemons/com.sophos.webd.plist
(com.sophos.webd)
/Library/LaunchDaemons/com.symantec.deepsight-extractor.plist
(com.symantec.deepsight-extractor)
/Library/LaunchDaemons/com.symantec.errorreporter-periodic.plist
(com.symantec.errorreporting.periodic)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.ondemand.plist
(com.symantec.liveupdate.daemon.ondemand)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.plist
(com.symantec.liveupdate.daemon)
/Library/LaunchDaemons/com.symantec.nav.migrateqtf.plist
(com.symantec.nav.migrateqtf)
/Library/LaunchDaemons/com.symantec.sharedsettings.plist
(com.symantec.sharedsettings)
/Library/LaunchDaemons/com.symantec.symdaemon.plist
(com.symantec.symdaemon)
/Library/LaunchDaemons/com.zeobit.MacKeeper.AntiVirus.plist
(com.zeobit.MacKeeper.AntiVirus)
/Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist
(com.zeobit.MacKeeper.plugin.AntiTheft.daemon)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.user.agent)
Library/LaunchAgents/com.macpaw.CleanMyMac.helperTool.plist
(com.macpaw.CleanMyMac.helperTool)
Library/LaunchAgents/com.macpaw.CleanMyMac.trashSizeWatcher.plist
(com.macpaw.CleanMyMac.trashSizeWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac.volumeWatcher.plist
(com.macpaw.CleanMyMac.volumeWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist
(com.macpaw.CleanMyMac2Helper.diskSpaceWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.scheduledScan.plist
(com.macpaw.CleanMyMac2Helper.scheduledScan)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.trashWatcher.plist
(com.macpaw.CleanMyMac2Helper.trashWatcher)
Library/LaunchAgents/com.smithmicro.cleaning.schedulermailer.plist
(com.smithmicro.cleaning.schedulermailer)
Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist
(com.zeobit.MacKeeper.Helper)
Startup items
/System/Library/StartupItems/WiFiUtilityStartUp/CommandServer
/System/Library/StartupItems/WiFiUtilityStartUp/StartupParameters.plist
/System/Library/StartupItems/WiFiUtilityStartUp/WiFiUtilityStartUp
/Library/StartupItems/Intego Backup Assistant/BackupAssistantAgent.app/Contents/Info.plist
/Library/StartupItems/Intego Backup Assistant/BackupAssistantAgent.app/Contents/MacOS/BackupAssistantAgent
/Library/StartupItems/Intego Backup Assistant/BackupAssistantDaemon
/Library/StartupItems/Intego Backup Assistant/BackupAssistantEngine
/Library/StartupItems/Intego Backup Assistant/PowerManagerTool
/Library/StartupItems/Intego Backup Assistant/uninstall.sh
/Library/StartupItems/NetworkOptimizerSC/NetworkOptimizerSC
/Library/StartupItems/NetworkOptimizerSC/StartupParameters.plist
Font issues: 4
Bad plists
/Library/Preferences/com.epson.Epson Connect Printer Setup.UnInstallList.plist
/Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist
/Library/Preferences/com.epson.Epson Low Ink Reminder.UnInstallList.plist
/Library/Preferences/com.epson.EPSON Scan.UnInstallList.plist
/Library/Preferences/com.epson.Epson Scanner ICA Driver.UnInstallList.plist
/Library/Preferences/com.epson.EPSON Software Updater.UnInstallList.plist
/Library/Preferences/com.epson.EpsonNet Config v4.UnInstallList.plist
/Library/Preferences/com.epson.Inkjet Printer Driver.UnInstallList.plist
DNS: 209.18.47.61 (static)
Restricted files: 912
Safari extensions
Add To Amazon Wish List
Searchme
Amazon Shopping Assistant
Ebay Shopping Assistant
Slick Savings
Norton Internet Security
Elapsed time (s): 285
-
Jun 21, 2014 12:50 PMby Linc Davis,No keylogger, but you have bogged down the machine with so much worthless "security" and "utility" software that I'm surprised it runs at all.
A.
Remove "MacKeeper" as follows. First, back up all data.
"MacKeeper" is a scam with only one useful feature: it deletes itself.
Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.
If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and emptying—then you'll have to reinstall it and start over.
IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.
In the Finder, select
Go ▹ Applications
from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the functional components of the software will be deleted. Restart the computer.
☞ Quit MacKeeper before dragging it to the Trash.
☞ Don't empty the Trash. Let MacKeeper delete itself.
☞ Don't try to drag the MacKeeper Dock icon to the Trash.
B.
Remove the Norton/Symantec product by following the instructions on either of these pages:
Uninstalling your Norton product for Mac
Removing Symantec programs for Macintosh
If you have a different version of the product, the procedure may be different.
C.
Remove the Sophos product by following the instructions on this page. If you have a different version, the procedure may be different.
D.
Remove the Intego product by following the instructions on this page. If you have a different version, the procedure may be different.
E.
"CleanMyMac" is a scam. The developer's instructions don't completely remove it. Follow those instructions, then do as below.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchDaemons/com.macpaw.CleanMyMac2.Agent.plist
Right-click or control-click the highlighted line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item selected. Move the selected item to the Trash. You may be prompted for your administrator login password. Repeat with this line:
/Library/PrivilegedHelperTools/com.macpaw.CleanMyMac2.Agent
Restart the computer and empty the Trash. Never again install "CleanMyMac" or anything like it.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
F.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall all extensions.
-
Jun 22, 2014 10:06 AMby Linc Davis,Any known software keylogger, and almost any unknown one, would have shown up in the test results. If you have been personally targeted for surveillance by an agency such as the FBI or the CIA, and they surreptitiously entered your home to install the keylogger, and they anticipated that you were going to ask me to look for it, it might not show up, but then you have problems I can't help you with. A hardware keylogger, which is a physical device rather than software, also might not show up, but again, someone would have had to enter your home to install it and would probably have to come back to retrieve the data.
A much more rational explanation is that the bank screwed up and wants to shift the blame for its own mistakes to its customers. That happens all the time.
-
Jun 22, 2014 11:30 AMby Linc Davis,No, but if you want to do it anyway, see below.
If you know or suspect that a hostile intruder has either had physical access to the computer, or has been able to log in remotely, then there are some steps you should take to make sure that the computer is safe to use.
First, depending on the circumstances, computer tampering may be a crime, a civil wrong, or both. If there's any chance that the matter will be the subject of legal action, then you should do nothing at all without consulting a lawyer or the police. The computer would be the principal evidence in such a case, and you don't want to contaminate that evidence.
Running any kind of "anti-virus" software is pointless. If I broke into a system and wanted to leave a back door, I could do it in a way that would be undetectable by those means—and I don't pretend to any special skill as a hacker. You have to assume that any intruder can do the same. Commercial keylogging software—which has legitimate as well as illegitimate uses—won't be recognized as malware, because it's not malware.
The only way you can be sure that the computer is not compromised is to erase at least the startup volume and restore it to something like the status quo ante. The easiest approach is to recover the entire system from a backup that predates the attack. Obviously, that's only practical if you know when the attack took place, and it was recent, and you have such a backup. You will lose all changes to data, such as email, that were made after the time of the snapshot. Some of those changes can be restored from a later backup.
If you don't know when the attack happened, or if it was too long ago for a complete rollback to be feasible, then you should erase and install OS X. If you don't already have at least two complete, independent backups of all data, then you must make them first. One backup is not enough to be safe.
When you restart after the installation, you'll be prompted to go through the initial setup process for a new computer. That’s when you transfer the data from a backup in Setup Assistant.
Select only users in the Setup Assistant dialog—not Applications, Other files and folders, or Computer & Network Settings. Don't transfer the Guest account, if it was enabled.
Reinstall third-party software from original media or fresh downloads—not from a backup, which may be contaminated.
Unless you were the target of an improbably sophisticated attack, this procedure will leave you with a clean system. If you have reason to think that you were the target of a sophisticated attack, then you need expert help.
That being done, change all Internet passwords and check all financial accounts for unauthorized transactions. Do this after the system has been secured, not before.
