ofpeb

Q: Anyone See a Problem With Malwarebytes

For Macs?  I have malware on my Imac without doubt - for 3 weeks now. I have done some things and have additional tasks to do, but I'd prefer to use something like this as I am extremely busy and don't have the time go throough learning curves on how to do everything or have the time to back up my drives and reinstall software and files etc. I just want to know if there's any red flags on this software. the link to it is here: http://www.antimalwaremac.com

 

Here's my etresoft report:

 

Hardware Information:

          iMac (27-inch, Late 2009)

          iMac - model: iMac10,1

          1 3.06 GHz Intel Core 2 Duo CPU: 2 cores

          16 GB RAM

 

Video Information:

          ATI Radeon HD 4670 - VRAM: 256 MB

 

System Software:

          OS X 10.9.2 (13C64) - Uptime: 0 days 2:4:52

 

Disk Information:

          HGST HDS724040ALE640 disk0 : (4 TB)

                    EFI (disk0s1) <not mounted>: 209.7 MB

                    disk0s2 (disk0s2) <not mounted>: 4 TB

                    Recovery HD (disk0s3) <not mounted>: 650 MB

 

          OPTIARC DVD RW AD-5680H

 

USB Information:

          Seagate  GoFlex Desk      2 TB

                    FreeAgentGo (disk2s1) /Volumes/FreeAgentGo: 2 TB (309.82 GB free)

 

          Western Digital My Book 1230 3 TB

                    disk3s1 (disk3s1) <not mounted>: 209.7 MB

                    My Book 3TB (disk3s2) /Volumes/My Book 3TB: 3 TB (2.49 TB free)

 

          Apple Inc. Built-in iSight

 

          Apple Internal Memory Card Reader

 

          Apple Inc. iPad

 

          Apple Computer, Inc. IR Receiver

 

          Apple Inc. BRCM2046 Hub

                    Apple Inc. Bluetooth USB Host Controller

 

FireWire Information:

          WD My Book 800mbit - 800mbit max

                    EFI (disk5s1) <not mounted>: 209.7 MB

                    My Book (disk5s2) /Volumes/My Book: 6 TB (97.1 GB free)

          Rocraid 2MT HDD_01 800mbit - 800mbit max

                    EFI (disk4s1) <not mounted>: 209.7 MB

                    Rocstor (disk4s2) /Volumes/Rocstor: 6 TB (2.41 GB free)

 

Thunderbolt Information:

 

Kernel Extensions:

          com.rim.driver.BlackBerryUSBDriverInt          (0.0.74)

          com.seagate.driver.PowSecDriverCore          (5.2.3 - SDK 10.4)

          com.seagate.driver.PowSecLeafDriver_10_5          (5.2.3 - SDK 10.5)

          com.sophos.nke.swi          (9.0.53)

          com.eltima.ElmediaPlayer.kext          (1.0)

          foo.tap          (1.0)

          foo.tun          (1.0)

          com.sophos.kext.sav          (9.0.53)

 

Startup Items:

          HDDFanControlDaemon: Path: /Library/StartupItems/HDDFanControlDaemon

          ParallelsDesktopTransporter: Path: /Library/StartupItems/ParallelsDesktopTransporter

          tap: Path: /Library/StartupItems/tap

          tun: Path: /Library/StartupItems/tun

 

Problem System Launch Agents:

          [System] com.paragon.NTFS.notify.plist 3rd-Party support link

 

Launch Daemons:

          [System] com.adobe.fpsaud.plist 3rd-Party support link

          [System] com.adobe.SwitchBoard.plist 3rd-Party support link

          [System] com.adobe.versioncueCS3.plist 3rd-Party support link

          [System] com.bombich.ccc.plist 3rd-Party support link

          [System] com.bombich.ccc.scheduledtask.00D3E368-E7CE-4E80-B171-487DD590DD5F.plist 3rd-Party support link

          [System] com.bombich.ccc.scheduledtask.35174FA0-9D88-40CE-A665-C2E53561EF04.plist 3rd-Party support link

          [System] com.eltima.ElmediaPlayer.daemon.plist 3rd-Party support link

          [System] com.google.keystone.daemon.plist 3rd-Party support link

          [System] com.microsoft.office.licensing.helper.plist 3rd-Party support link

          [invalid] com.oracle.java.Helper-Tool.plist

          [System] com.oracle.java.JavaUpdateHelper.plist 3rd-Party support link

          [System] com.rim.BBDaemon.plist 3rd-Party support link

          [System] com.vmware.launchd.vmware.plist 3rd-Party support link

 

Launch Agents:

          [System] com.adobe.AAM.Updater-1.0.plist 3rd-Party support link

          [System] com.adobe.AdobeCreativeCloud.plist 3rd-Party support link

          [System] com.adobe.CS4ServiceManager.plist 3rd-Party support link

          [System] com.adobe.CS5ServiceManager.plist 3rd-Party support link

          [System] com.google.keystone.agent.plist 3rd-Party support link

          [System] com.kodak.BonjourAgent.plist 3rd-Party support link

          [invalid] com.oracle.java.Java-Updater.plist

          [System] com.rim.BBLaunchAgent.plist 3rd-Party support link

 

User Launch Agents:

          [not loaded] com.adobe.AAM.Updater-1.0.plist 3rd-Party support link

          [not loaded] com.bombich.ccc-user-agent.plist 3rd-Party support link

          [not loaded] com.digitalrebellion.PreferenceManagerAutoSave.plist 3rd-Party support link

          [not loaded] com.digitalrebellion.SoftwareUpdateAutoCheck.plist 3rd-Party support link

 

User Login Items:

          FreeScreenSharing

          iTunesHelper

          GrowlMenu

          GrowlHelperApp

          ConnectService

 

Internet Plug-ins:

          o1dbrowserplugin: Version: 5.1.7.17873 3rd-Party support link

          Default Browser: Version: 537 - SDK 10.9

          Flip4Mac WMV Plugin: Version: 2.3.1.2 3rd-Party support link

          AdobeAAMDetect: Version: AdobeAAMDetect 2.0.0.0 - SDK 10.7 3rd-Party support link

          FlashPlayer-10.6: Version: 12.0.0.77 - SDK 10.6 3rd-Party support link

          AdobePDFViewerNPAPI: Version: 11.0.0 - SDK 10.6 3rd-Party support link

          Silverlight: Version: 3.0.40818.0 3rd-Party support link

          Flash Player: Version: 12.0.0.77 - SDK 10.6 3rd-Party support link

          iPhotoPhotocast: Version: 7.0 - SDK 10.8

          googletalkbrowserplugin: Version: 5.1.7.17873 3rd-Party support link

          npgtpo3dautoplugin: Version: 0.1.44.29 - SDK 10.5 3rd-Party support link

          AdobePDFViewer: Version: 11.0.0 - SDK 10.6 3rd-Party support link

          QuickTime Plugin: Version: 7.7.3

          SharePointBrowserPlugin: Version: 14.3.9 - SDK 10.6 3rd-Party support link

          SoShare: Version: SoShare 4.4.1 - SDK 10.7 3rd-Party support link

          JavaAppletPlugin: Version: 14.9.0 - SDK 10.7 Outdated! Update

 

Safari Extensions:

          Amazon Shopping Assistant: Version: 1.1

          Ebay Shopping Assistant: Version: 1.1

          savekeep: Version: 1.0

          Searchme: Version: 1.2

          Slick Savings: Version: 1.0

 

Audio Plug-ins:

          BluetoothAudioPlugIn: Version: 1.0 - SDK 10.9

          AirPlay: Version: 2.0 - SDK 10.9

          AppleAVBAudio: Version: 203.2 - SDK 10.9

          iSightAudio: Version: 7.7.3 - SDK 10.9

 

iTunes Plug-ins:

          Quartz Composer Visualizer: Version: 1.4 - SDK 10.9

 

User Internet Plug-ins:

          FreeScreenSharingPlugin: Version: (null) - SDK 10.9 3rd-Party support link

 

3rd Party Preference Panes:

          Adobe Version Cue CS3  3rd-Party support link

          Déjà Vu  3rd-Party support link

          Flash Player  3rd-Party support link

          Flip4Mac WMV  3rd-Party support link

          Growl  3rd-Party support link

          HDD Fan Control  3rd-Party support link

          Paragon NTFS for Mac ® OS X  3rd-Party support link

          Tuxera NTFS  3rd-Party support link

 

Old Applications:

          Microsoft Language Register:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    /Applications/Microsoft Office 2011/Additional Tools/Microsoft Language Register/Microsoft Language Register.app

          Solver:          Version: 1.0 - SDK 10.5 3rd-Party support link

                    /Applications/Microsoft Office 2011/Office/Add-Ins/Solver.app

          Image Data Converter Ver:          Version: 4.0.01.09150 - SDK 10.5 3rd-Party support link

                    /Applications/Image Data Converter/Image Data Converter Ver.4.app

          oDesk Team:          Version: 3.4.17 - SDK 10.5 3rd-Party support link

          Microsoft Word:          Version: 14.3.8 - SDK 10.5 3rd-Party support link

          /Applications/Microsoft Office 2011

                    Microsoft PowerPoint:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Excel:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Outlook:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Document Connection:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

          /Applications/Microsoft Office 2011/Office

                    Microsoft Graph:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Database Utility:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Office Reminders:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Upload Center:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    My Day:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    SyncServicesAgent:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Open XML for Excel:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Alerts Daemon:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Database Daemon:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Chart Converter:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

                    Microsoft Clip Gallery:          Version: 14.3.9 - SDK 10.5 3rd-Party support link

          /Applications/iWork '09

          SA Color Finesse 3 UI:          Version: 3.0.10(292) - SDK 10.5 3rd-Party support link

                    /Applications/Adobe After Effects CC/Plug-ins/Effects/Synthetic Aperture/(CF3 Support)/SA Color Finesse 3 UI.app

          Microsoft AutoUpdate:          Version: 2.3.6 - SDK 10.4 3rd-Party support link

                    /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app

          SoftwareUpdateHelper:          Version: 1.2.6 - SDK 10.5 3rd-Party support link

                    /Library/Application Support/Digital Rebellion/Shared Resources/SoftwareUpdateHelper.app

          /Library/Application Support/Microsoft/MERP2.0

                    Microsoft Error Reporting:          Version: 2.2.9 - SDK 10.4 3rd-Party support link

                    Microsoft Ship Asserts:          Version: 1.1.4 - SDK 10.4 3rd-Party support link

          Epson Printer Utility 4:          Version: 9.19 - SDK 10.5 3rd-Party support link

                    /Library/Printers/EPSON/InkjetPrinter2/Utility/UT4/Epson Printer Utility 4.app

 

Time Machine:

          Mobile backups: OFF

          Auto backup: NO - Auto backup turned off

          Volumes being backed up:

          Destinations:

                    FreeAgentGo [Local] (Last used)

                    Total size: 2

                    Total number of backups: 1

                    Oldest backup: 2013-09-27 17:02:54 +0000

                    Last backup: 2013-09-27 17:02:54 +0000

                    Size of backup disk: Excellent

                              Backup size 2  > (Disk size 0 B X 3)

          Time Machine details may not be accurate.

          All volumes being backed up may not be listed.

 

Top Processes by CPU:

               2%          WindowServer

               2%          EtreCheck

               1%          PluginProcess

               0%          com.apple.WebKit.Networking

               0%          HDDFanControlDaemon

 

Top Processes by Memory:

          328 MB          PluginProcess

          164 MB          mds_stores

          131 MB          com.apple.IconServicesAgent

          131 MB          TextEdit

          115 MB          Safari

 

Virtual Memory Information:

          9.13 GB          Free RAM

          4.27 GB          Active RAM

          1.56 GB          Inactive RAM

          1.05 GB          Wired RAM

          596 MB          Page-ins

          0 B          Page-outs

Posted on Mar 18, 2014 5:31 PM

Close

Q: Anyone See a Problem With Malwarebytes

  • All replies
  • Helpful answers

  • by Linc Davis,

    Linc Davis Linc Davis Mar 18, 2014 6:13 PM in response to ofpeb
    Level 10 (208,000 points)
    Applications
    Mar 18, 2014 6:13 PM in response to ofpeb

    I have malware on my Imac without doubt

     

    How do you know that?

  • by petermac87,

    petermac87 petermac87 Mar 18, 2014 6:16 PM in response to ofpeb
    Level 5 (7,402 points)
    Mar 18, 2014 6:16 PM in response to ofpeb

    http://www.antimalwaremac.com

     

    will give you a link to a download for MacKeeper, a cleaning and maintenance program that should be avoided for many reasons. In particular because it is not necessary.

     

    Pete

  • by Allan Eckert,

    Allan Eckert Allan Eckert Mar 18, 2014 6:25 PM in response to ofpeb
    Level 9 (53,793 points)
    Desktops
    Mar 18, 2014 6:25 PM in response to ofpeb

    IMHO antimalwaremac.com is a good site to stay for. far away from especially if you don't want to spend an inordinate amount of your time fixing your Mac because that is what is going to happen.

     

    I too am curious to hear your answer to Linc's question about how do you know you have malware in your Mac.

     

    Allan

  • by ofpeb,

    ofpeb ofpeb Mar 18, 2014 8:39 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 18, 2014 8:39 PM in response to Linc Davis

    Thanks for asking. I've been told by others who have had malware that i have it since i get pop up windows with ads to practically every site i go to as well as text on most website becoming linked with advertising offers. I've had macs for about 8 or 9 years and have never had any type of problem like this.

  • by Linc Davis,

    Linc Davis Linc Davis Mar 18, 2014 9:35 PM in response to ofpeb
    Level 10 (208,000 points)
    Applications
    Mar 18, 2014 9:35 PM in response to ofpeb

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.

    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

    3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger on a public message board. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

    Here's a summary of what you need to do, if you choose to proceed: Copy a line of text from this web page into the window of another application. Wait for the script to run. It usually takes a few minutes. Then paste the results, which will have been copied automatically, back into a reply on this page. The sequence is: copy, paste, wait, paste again. Details follow.

    4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

    5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

    6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

    Triple-click anywhere in the line of text below on this page to select it:

    PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; AC="com.autodesk.AutoCAD  com.google.GoogleDrive"; H='^[[:space:]]*((127\.0\.0\.1|::1|fe80::1%lo0)[[:space:]]+local|(255\.){3}255[[:space:]]*broadcast)host[[:space:]]*$'; NS=networksetup; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; AT () { o=`file -b "$1" | egrep -v '^(A.{16}t$|cann)'`; Ps "${1##*/} format"; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"[$((l-25)) more line(s)]"; Pm "$1"; AT "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$/d;s/^ */   /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/\/Users\/Shared\//b'$'\ns/\/Users\/[^/]+\//\/Users\/USER\//g' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed -n 's/^ *//;5p;6p;8p'; h=(`SP Hardware | awk '/ Id/{print $3}; /Mem/{print $2}'`); o=$h; Ps "Model"; o=$((h[1]<4?h[1]:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^O]|x([^08]|0[^2]|8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/{s/^.*://p;}' <<< "$p"`; Ps "Battery condition"; for b in FireWire Thunderbolt USB; do o=`SP $b | sed -En '1d;/:$/{s/ *:$//;x;s/\n//g;s/\).*/)/p;};/^ *(V.+ [0N]|Man).+ /{s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};/Apple|Genesy|Intel|SMSC/{s/.//g;h;}'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && f="$f *"; echo "$d ${f%%_2*} ${f##*.}"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; grep -lq '*$' <<< "$o" && printf $'\n\t* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'caug|GPU |hfs: Ru|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN' -k Message Ane 'SMC:' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | awk 'NR>1 && !/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|openld|post[fg]|x)/{print $3}'`; Pm "Extrinsic daemons"; o=`launchctl list | awk 'NR>1 && !/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | egrep -v 'com\.apple\.(CSConfig|server)' | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/StartupItems; do M; done`; Pm "Startup items"; sys=`pkgutil --regexp --only-files --files com.apple.pkg.* | sort | uniq | sed 's:^:/:'`; b=`sed -E '/^.+Lib.+\/Contents\/Info.plist$/!d;s/\/Info.plist$//;/Contents\/./d' <<< "$sys"`; l=`egrep '^/usr/lib/.+dylib$' <<< "$sys"`; [[ "$b" && "$l" ]] && { o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | grep -Fv "$b" | while read d; do test -f "$d/Info.plist" || continue; ID=$($PB\ :CFBundleIdentifier "$_") || ID="No bundle ID"; printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; o=`find /usr/lib -type f -name *.dylib | grep -Fv "$l"`; Pm "Extrinsic shared libraries"; :; } || echo $'\nReceipts missing'; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Inserted dylibs"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; i=`route -n get default | awk '/e:/{print $2}'`; I=`$NS -listnetworkserviceorder | sed -En '/ '$i'\)$/{x;s/^\(.+\) //p;q;};x'`; n=`$NS -getdnsservers "$I" | awk '!/^T/{printf "not "}'`; Ps "DNS (${n}from DHCP)"; o=`$NS -getinfo "$I" | awk '/k:/{if ($3 !~ "(255\.){3}0") print $3}'`; Ps "Netmask"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; f=/etc/hosts; Pc "hosts" <(egrep -v "$H" $f ); AT $f; Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; LD="$(`find /S*/*/F* -type f -name lsregister | head -n1` -dump)"; o=`for ID in $AC; do [[ "$LD" =~ $ID ]] && echo $ID; done`; Pm "Application check"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \) | wc -l`; Ps "Restricted user files"; cd; o=`SP Fonts | egrep 'id: N|te: Y' | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps "UID"; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-
    Copy the selected text to the Clipboard by pressing the key combination command-C.

    7. Launch the built-in Terminal application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

    Click anywhere in the Terminal window and paste (command-V). The text you pasted should vanish immediately. If it doesn't, press the return key.

    8. If you see an error message in the Terminal window such as "syntax error," enter

    exec bash

    and press return. Then paste the script again.

    9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

    10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

    [Process completed]

    to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

    11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

    12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

    Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

     

    ________________________________

      
    Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Terms of Use of the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.
  • by davidorlo,

    davidorlo davidorlo Mar 27, 2015 9:10 AM in response to ofpeb
    Level 1 (4 points)
    Mar 27, 2015 9:10 AM in response to ofpeb

    I have seen this, its actually a Browser / Safari plugin that causes it. You can disable and remove it then it will stop.

  • by davidorlo,

    davidorlo davidorlo Mar 27, 2015 9:13 AM in response to davidorlo
    Level 1 (4 points)
    Mar 27, 2015 9:13 AM in response to davidorlo

    in the Safari Preferences window, click the “Extensions” tab. Find the “Omnibar, SearchMe, VidX, MacShop, MacSave, MacVDx plugin, then click on the “Uninstall” button. This infection can add more than one extension, it is recommended that you remove all unknown extensions from Safari.


    I just grabbed that from some webpage but that is what I meant in my previous post

  • by David Cun,

    David Cun David Cun Oct 27, 2015 8:18 AM in response to davidorlo
    Level 4 (1,430 points)
    Oct 27, 2015 8:18 AM in response to davidorlo

    Original question, "Anyone see a problem with Malwarebytes"?  I saw it on another thread and wonder if it's a cool app or not.

  • by Eric Root,

    Eric Root Eric Root Oct 27, 2015 9:51 AM in response to David Cun
    Level 9 (72,578 points)
    iTunes
    Oct 27, 2015 9:51 AM in response to David Cun

    This one works.

     

    Malwarebytes Anti-Malware for Mac      10.7 and later