AggelakasK

Level 1 (0 points)

Q: Adwaremedic is it safe ?

Hello everyone .. I would like to ask if the adwaremedic program is the safest way to remove adware from the mac. Lately I m having some pop up advertisements from a specific site called mac keeper. I have no idea how this ad came up since I am not downloading torrents nor visiting any suspicious site .

So is this the only way to permanently remove the adware? Is it safe , since this is a third party program? Thanks in advance everyone

Posted on Nov 16, 2014 3:22 AM

I have this question too

Q: Adwaremedic is it safe ?

All replies

Helpful answers

first Page 15 of 16 last

by Klaus1,

Klaus1 Sep 27, 2015 10:32 AM in response to Akash agarwal
Level 8 (48,858 points)

Sep 27, 2015 10:32 AM in response to Akash agarwal

Your problem, hardware or software, may not be exactly the same as that of the original poster of this older thread, and it can be very confusing for everybody if we try to answer more than one question in each thread, which can also result in you applying the wrong advice to your particular problem.

In order for us to give your problem our proper attention to try to solve it, would you kindly start your own thread, describing the trouble you are having in the fullest detail, including completing your details to show what Mac or iDevice you are using, what operating system, and what version of the application in question. Please remember to post in the forum relevant to your hardware or version of OS X. A full list of all the support forums is here:

http://discussions.apple.com/index.jspa
Reply options

Link to this post

by CynyC,

CynyC Sep 28, 2015 1:58 PM in response to Klaus1
Level 1 (0 points)

Sep 28, 2015 1:58 PM in response to Klaus1

Start time: 21:48:02 09/28/15

Model Identifier: MacBookAir6,2
System Version: OS X 10.10.5 (14F27)
Kernel Version: Darwin 14.5.0
Time since boot: 10:03

FileVault: On

Diagnostic reports

   2015-09-02 XPCKeychainSandboxCheck crash x2
   2015-09-09 Google Chrome crash x2
   2015-09-09 XPCKeychainSandboxCheck crash
   2015-09-11 XPCKeychainSandboxCheck crash
   2015-09-22 Google Chrome crash
   2015-09-24 Google Chrome crash

Log

   Sep 27 00:48:46 com.apple.iTunesHelper.67340: Service exited with abnormal code: 1
   Sep 27 15:52:29 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
   Sep 27 15:52:30 en0: Error configuring antenna diversity (index = -1).
   Sep 27 15:52:30 en0: Error configuring transmit antenna (index = -1).
   Sep 27 15:52:51 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 105
   Sep 27 16:55:45 com.apple.iTunesHelper.67340: Service exited with abnormal code: 1
   Sep 27 17:59:22 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
   Sep 27 17:59:23 en0: Error configuring antenna diversity (index = -1).
   Sep 27 17:59:23 en0: Error configuring transmit antenna (index = -1).
   Sep 27 17:59:46 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 105
   Sep 27 20:28:17 en0: Error configuring antenna diversity (index = -1).
   Sep 27 20:28:17 en0: Error configuring transmit antenna (index = -1).
   Sep 27 21:09:46 com.apple.iTunesHelper.67340: Service exited with abnormal code: 1
   Sep 28 11:44:38 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
   Sep 28 11:44:40 en0: Error configuring antenna diversity (index = -1).
   Sep 28 11:44:40 en0: Error configuring transmit antenna (index = -1).
   Sep 28 11:45:01 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 105
   Sep 28 15:50:08 en0: Error configuring antenna diversity (index = -1).
   Sep 28 15:50:08 en0: Error configuring transmit antenna (index = -1).
   Sep 28 17:41:41 en0: Error configuring antenna diversity (index = -1).
   Sep 28 17:41:41 en0: Error configuring transmit antenna (index = -1).
   Sep 28 21:23:21 en0: Error configuring antenna diversity (index = -1).
   Sep 28 21:23:21 en0: Error configuring transmit antenna (index = -1).
   Sep 28 21:32:49 en0: Error configuring antenna diversity (index = -1).
   Sep 28 21:32:49 en0: Error configuring transmit antenna (index = -1).

Swap (MiB): 1349

Daemons

   com.adobe.ARMDC.Communicator
   com.apple.installer.osmessagetracing
   com.oracle.java.Helper-Tool
   com.adobe.ARMDC.SMJobBlessHelper

Agents

   com.adobe.ARMDCHelper.UUID
   com.oracle.java.Java-Updater
   com.apple.FolderActions.folders
   com.google.keystone.user.agent
   com.apple.AirPortBaseStationAgent
   com.apple.FolderActions.enabled

Bundles

   /System/Library/Extensions/JMicronATA.kext
   - com.jmicron.JMicronATA
   /Library/Internet Plug-Ins/AdobePDFViewer.plugin
   - com.adobe.acrobat.pdfviewer
   /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
   - com.adobe.acrobat.pdfviewerNPAPI
   /Library/Internet Plug-Ins/JavaAppletPlugin.plugin
   - com.oracle.java.JavaAppletPlugin
   /Library/Internet Plug-Ins/Silverlight.plugin
   - com.microsoft.SilverlightPlugin
   /Library/PreferencePanes/JavaControlPanel.prefPane
   - com.oracle.java.JavaControlPanel
   Library/Caches/com.apple.Safari/Extensions/LastPass.safariextension
   - com.lastpass.lpsafariextension

Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist (checksum 3012644940)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Disabled</key>
    <true/>
    <key>Label</key>
    <string>org.apache.httpd</string>
    <key>EnvironmentVariables</key>
    <dict>
    <key>XPC_SERVICES_UNAVAILABLE</key>
    <string>1</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/usr/sbin/httpd-wrapper</string>
    <string>-D</string>
    <string>FOREGROUND</string>
    </array>
    <key>OnDemand</key>
    <false/>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist (checksum 2197523146)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARMDCHelper.UUID</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>12600</integer>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 2504867950)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.oracle.java.Java-Updater</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
    <string>-bgcheck</string>
    </array>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
    <key>StartCalendarInterval</key>
    <dict>
    <key>Hour</key>
    <integer>13</integer>
    <key>Minute</key>
    <integer>17</integer>
    <key>Weekday</key>
    <integer>4</integer>
    </dict>
   </dict>

   ...and 1 more line(s)

Contents of /Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist (checksum 3887726299)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARMDC.Communicator</string>
    <key>MachServices</key>
    <dict>
    <key>com.adobe.ARMDC.Communicator</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/PrivilegedHelperTools/com.adobe.ARMDC.Communicator</string>
    </array>
   </dict>
   </plist>

Contents of /Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist (checksum 930028549)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARMDC.SMJobBlessHelper</string>
    <key>MachServices</key>
    <dict>
    <key>com.adobe.ARMDC.SMJobBlessHelper</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper</string >
    </array>
   </dict>
   </plist>

Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 64342103)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.google.keystone.user.agent</string>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>ProgramArguments</key>
    <array>
     <string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>
     <string>-runMode</string>
     <string>ifneeded</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>3523</integer>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
   </dict>
   </plist>

Firewall: On

Listeners

   cupsd: ipp

User login items

   iTunesHelper
   - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
   SpeechSynthesisServer
   - /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app

Safari extensions

   LastPass

Restricted files: 13

Lockfiles: 4

Elapsed time (s): 244
Reply options

Link to this post

by bjjaszcz,

bjjaszcz Dec 25, 2015 10:41 PM in response to Linc Davis
Level 1 (0 points)

Dec 25, 2015 10:41 PM in response to Linc Davis

-Deleted outdated diagnostic-
Reply options

Link to this post

by nyef40_com,

nyef40_com Jan 10, 2016 2:34 PM in response to Linc Davis
Level 1 (0 points)

Jan 10, 2016 2:34 PM in response to Linc Davis

Hi Lync,

I executed your script on my mac and would appreciate your comments on the results of execution.
http://pastebin.com/LdAv9URc
Just in case you can't open the page I put the results below:
*****
Start time: 13:00:05 01/10/16

Model Identifier: MacBookPro6,2
System Version: OS X 10.11.2 (15C50)
Kernel Version: Darwin 15.2.0
System Integrity Protection: Enabled
Time since boot: 2:53

SATA

   Samsung SSD 840 EVO 250GB

Diagnostic reports

   2016-01-07 Kernel panic x12
   2016-01-07 Spotlight crash
   2016-01-08 Kernel panic x6
   2016-01-09 Kernel panic x4
   2016-01-10 Kernel panic x2

Log

   Jan 9 22:35:54 en1: Error configuring antenna diversity (index = -1).
   Jan 10 10:04:41 en1: Error configuring antenna diversity (index = -1).
   Jan 10 10:06:55 AssertMacros: tmpData (value: 0x0), file: /BuildRoot/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager/AppleCre dentialManager-83.20.2/AppleCredentialManager/AppleCredentialManager.cpp, line: 765
   Jan 10 10:06:55 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x49b0cad3988b3fc3, provider is 0x49b0cad3988c37c3
   Jan 10 10:06:55 jnl: b(1, 4): replay_journal: from: 18845696 to: 3631104 (joffset 0x747000)
   Jan 10 10:06:55 000001.724011 IOUSBHostDevice@fa111000: IOUSBHostDevice::start: failed to get device descriptor
   Jan 10 10:06:55 000001.724142 AppleUSB20HubPort@fa111000: AppleUSB20HubPort::resetAndCreateDevice: failed to start device
   Jan 10 10:06:55 000001.724169 AppleUSB20HubPort@fa111000: AppleUSB20HubPort::resetAndCreateDevice: failed to create device (0xe00002e9), disabling port
   Jan 10 10:06:55 jnl: b(1, 4): journal replay done.
   Jan 10 10:06:57 en1: Error configuring antenna diversity (index = -1).
   Jan 10 10:07:00 Can't load kext org.virtualbox.kext.VBoxUSB - failed to resolve library dependencies.
   Jan 10 10:07:00 Kext org.virtualbox.kext.VBoxUSB failed to load (0xdc00800e).
   Jan 10 10:07:00 Failed to load kext org.virtualbox.kext.VBoxUSB (error 0xdc00800e).
   Jan 10 10:07:00 Can't load kext org.virtualbox.kext.VBoxNetFlt - failed to resolve library dependencies.
   Jan 10 10:07:00 Kext org.virtualbox.kext.VBoxNetFlt failed to load (0xdc00800e).
   Jan 10 10:07:00 Failed to load kext org.virtualbox.kext.VBoxNetFlt (error 0xdc00800e).
   Jan 10 10:07:01 Can't load kext org.virtualbox.kext.VBoxNetAdp - failed to resolve library dependencies.
   Jan 10 10:07:01 Kext org.virtualbox.kext.VBoxNetAdp failed to load (0xdc00800e).
   Jan 10 10:07:01 Failed to load kext org.virtualbox.kext.VBoxNetAdp (error 0xdc00800e).
   Jan 10 10:07:01 org.virtualbox.startup: Service exited with abnormal code: 1
   Jan 10 10:50:45 en1: Error configuring antenna diversity (index = -1).
   Jan 10 11:07:37 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1
   Jan 10 11:13:03 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1
   Jan 10 11:49:44 en1: Error configuring antenna diversity (index = -1).
   Jan 10 13:00:08 process smcDiagnose[720] caught causing excessive wakeups. Observed wakeups rate (per sec): 52647; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 49381

kexts

   tw.com.mct.Trigger5Core (1.1.9) UUID

Daemons

   com.apple.installer.osmessagetracing
   com.oracle.java.Helper-Tool
   com.adobe.fpsaud

Agents

   com.mct.USBVGASync
   com.google.keystone.system.agent
   com.apple.photostream-agent
   com.apple.CSConfigDotMacCert-EMAIL-SharedServices
   com.oracle.java.Java-Updater
   com.apple.AirPortBaseStationAgent

Bundles

   /System/Library/Extensions/BJUSBLoad.kext
   - jp.co.canon.bj.print.BJUSBLoad
   /System/Library/Extensions/EPSONUSBPrintClass.kext
   - com.epson.print.kext.USBPrintClass
   /System/Library/Extensions/hp_designjet_series.kext
   - com.hp.print.hpio.Designjet.kext
   /System/Library/Extensions/hp_Deskjet_io_enabler.kext
   - com.hp.print.hpio.Deskjet.kext
   /System/Library/Extensions/hp_Inkjet1_io_enabler.kext
   - com.hp.print.hpio.Inkjet1.kext
   /System/Library/Extensions/hp_Inkjet2_io_enabler.kext
   - com.hp.print.hpio.Inkjet2.kext
   /System/Library/Extensions/hp_Inkjet3_io_enabler.kext
   - com.hp.print.hpio.Inkjet3.kext
   /System/Library/Extensions/hp_Inkjet4_io_enabler.kext
   - com.hp.print.hpio.Inkjet4.kext
   /System/Library/Extensions/hp_Inkjet5_io_enabler.kext
   - com.hp.print.hpio.Inkjet5.kext
   /System/Library/Extensions/hp_Inkjet7_io_enabler.kext
   - com.hp.print.hpio.inkjet7.kext
   /System/Library/Extensions/hp_Inkjet8_io_enabler.kext
   - com.hp.print.hpio.inkjet8.kext
   /System/Library/Extensions/hp_Inkjet_io_enabler.kext
   - com.hp.print.hpio.Inkjet.kext
   /System/Library/Extensions/hp_Laserjet_io_enabler.kext
   - com.hp.print.hpio.Laserjet.kext
   /System/Library/Extensions/hp_Officejet_io_enabler.kext
   - com.hp.print.hpio.Officejet.kext
   /System/Library/Extensions/hp_Photosmart_io_enabler.kext
   - com.hp.print.hpio.Photosmart.kext
   /System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext
   - com.hp.print.hpio.PhotosmartPro.kext
   /System/Library/Extensions/hp_qc_io_enabler.kext
   - com.hp.hpio.hp_psa530_630_io_enabler
   /System/Library/Extensions/JMicronATA.kext
   - com.jmicron.JMicronATA
   /System/Library/Extensions/LexmarkUSBMerge.kext
   - com.lexmark.print.usbmerge
   /System/Library/Extensions/Trigger5Core.kext
   - tw.com.mct.Trigger5Core
   /Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
   - info.emagic.driver.unitor
   /Library/Internet Plug-Ins/Flash Player.plugin
   - N/A
   /Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
   - com.Google.GoogleEarthPlugin.plugin
   /Library/Internet Plug-Ins/iPhotoPhotocast.plugin
   - com.apple.plugin.iPhotoPhotocast
   /Library/Internet Plug-Ins/JavaAppletPlugin.plugin
   - com.oracle.java.JavaAppletPlugin
   /Library/Internet Plug-Ins/MeetingJoinPlugin.plugin
   - com.microsoft.communicator.meetingjoinplugin
   /Library/Internet Plug-Ins/Silverlight.plugin
   - com.microsoft.SilverlightPlugin
   /Library/Internet Plug-Ins (Disabled)/Flash Player.plugin
   - N/A
   /Library/PreferencePanes/Flash Player.prefPane
   - com.adobe.flashplayerpreferences
   /Library/PreferencePanes/JavaControlPanel.prefPane
   - com.oracle.java.JavaControlPanel
   /Library/ScriptingAdditions/MemopalAppScript.osax
   - com.memopal.MemopalAppScript.osax
   /Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle
   - com.teamviewer.AuthorizationPlugin
   /Library/Spotlight/GBSpotlightImporter.mdimporter
   - com.apple.garageband.spotlightimporter
   /Library/Widgets/CI Filter Browser.wdgt
   - com.apple.CIFilterBrowser
   Library/Address Book Plug-Ins/SkypeABCaller.bundle
   - com.skype.SkypeABCaller
   Library/Address Book Plug-Ins/SkypeABChatter.bundle
   - com.skype.SkypeABChatter
   Library/Address Book Plug-Ins/SkypeABDialer.bundle
   - com.skype.skypeabdialer
   Library/Address Book Plug-Ins/SkypeABSMS.bundle
   - com.skype.skypeabsms
   Library/Internet Plug-Ins/WebEx64.plugin
   - com.cisco_webex.plugin.gpc64

dylibs

   /usr/lib/libgutenprint.2.0.3.dylib

Contents of /etc/hosts (checksum 3164423663)

   127.0.0.1 localhost
   255.255.255.255 broadcasthost
   ::1             localhost

Contents of /etc/pf.conf (checksum 2891177609)

   scrub-anchor "com.apple/*"
   nat-anchor "com.apple/*"
   rdr-anchor "com.apple/*"
   dummynet-anchor "com.apple/*"
   anchor "com.apple/*"
   load anchor "com.apple" from "/etc/pf.anchors/com.apple"

Contents of /etc/syslog.conf (checksum 2399118465)

   install.* @127.0.0.1:32376

Contents of /etc/pam.d/authorization (checksum 1288902703)

   auth       optional       pam_krb5.so use_first_pass use_kcminit
   auth       optional       pam_ntlm.so use_first_pass
   auth       required       pam_opendirectory.so use_first_pass nullok
   account    required       pam_opendirectory.so

Contents of /etc/pam.d/checkpw (checksum 2672765862)

   auth       required       pam_opendirectory.so use_first_pass nullok
   account    required       pam_opendirectory.so no_check_home no_check_shell

Contents of /etc/pam.d/chkpasswd (checksum 335781771)

   auth       required       pam_opendirectory.so
   account    required       pam_opendirectory.so
   password   required       pam_permit.so
   session    required       pam_permit.so

Contents of /etc/pam.d/cups (checksum 2842188894)

   auth       required       pam_opendirectory.so
   account    required       pam_permit.so
   password   required       pam_deny.so
   session    required       pam_permit.so

Contents of /etc/pam.d/ftpd (checksum 2001169128)

   auth       required       pam_opendirectory.so
   account    required       pam_permit.so
   password   required       pam_deny.so
   session    required       pam_permit.so

Contents of /etc/pam.d/login (checksum 1242678644)

   auth       optional       pam_krb5.so use_kcminit
   auth       optional       pam_ntlm.so try_first_pass
   auth       optional       pam_mount.so try_first_pass
   auth       required       pam_opendirectory.so try_first_pass
   account    required       pam_nologin.so
   account    required       pam_opendirectory.so
   password   required       pam_opendirectory.so
   session    required       pam_launchd.so
   session    required       pam_uwtmp.so
   session    optional       pam_mount.so

Contents of /etc/pam.d/login.term (checksum 3930746290)

   account    required       pam_nologin.so
   account    required       pam_opendirectory.so
   session    required       pam_uwtmp.so

Contents of /etc/pam.d/other (checksum 2748091512)

   auth       required       pam_deny.so
   account    required       pam_deny.so
   password   required       pam_deny.so
   session    required       pam_deny.so

Contents of /etc/pam.d/passwd (checksum 1026516346)

   auth       required       pam_permit.so
   account    required       pam_opendirectory.so
   password   required       pam_opendirectory.so
   session    required       pam_permit.so

Contents of /etc/pam.d/rshd (checksum 1553764881)

   auth        required       pam_permit.so
   account     required       pam_nologin.so
   account     required       pam_opendirectory.so
   session     required       pam_launchd.so

Contents of /etc/pam.d/screensaver (checksum 3141704602)

   auth       optional       pam_krb5.so use_first_pass use_kcminit
   auth       required       pam_opendirectory.so use_first_pass nullok
   account    required       pam_opendirectory.so
   account    sufficient     pam_self.so
   account    required       pam_group.so no_warn group=admin,wheel fail_safe
   account    required       pam_group.so no_warn deny group=admin,wheel ruser fail_safe

Contents of /etc/pam.d/smbd (checksum 2516643123)

   account required pam_sacl.so sacl_service=smb allow_trustacct
   session required pam_permit.so

Contents of /etc/pam.d/sshd (checksum 2989478361)

   auth       optional       pam_krb5.so use_kcminit
   auth       optional       pam_ntlm.so try_first_pass
   auth       optional       pam_mount.so try_first_pass
   auth       required       pam_opendirectory.so try_first_pass
   account    required       pam_nologin.so
   account    required       pam_sacl.so sacl_service=ssh
   account    required       pam_opendirectory.so
   password   required       pam_opendirectory.so
   session    required       pam_launchd.so
   session    optional       pam_mount.so

Contents of /etc/pam.d/su (checksum 2045483434)

   auth       sufficient     pam_rootok.so
   auth       required       pam_opendirectory.so
   account    required       pam_group.so no_warn group=admin,wheel ruser root_only fail_safe
   account    required       pam_opendirectory.so no_check_shell
   password   required       pam_opendirectory.so
   session    required       pam_launchd.so

Contents of /etc/pam.d/sudo (checksum 3515993703)

   auth       required       pam_opendirectory.so
   account    required       pam_permit.so
   password   required       pam_deny.so
   session    required       pam_permit.so

Contents of /etc/periodic/daily/110.clean-tmps (checksum 4099837049)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_clean_tmps_enable" in
       [Yy][Ee][Ss])
    if [ -z "$daily_clean_tmps_days" ]
    then
       echo '$daily_clean_tmps_enable is set but' \
    '$daily_clean_tmps_days is not'
       rc=2
    else
       echo ""
       echo "Removing old temporary files:"
       set -f noglob
       args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"
       args="${args} -ctime +$daily_clean_tmps_days"
       dargs="-empty -mtime +$daily_clean_tmps_days"
       dargs="${dargs} ! -name .vfs_rsrc_streams_*"
       [ -n "$daily_clean_tmps_ignore" ] && {
    args="$args "`echo " ${daily_clean_tmps_ignore% }" |
       sed 's/[ ][ ]*/ ! -name /g'`
    dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |
       sed 's/[ ][ ]*/ ! -name /g'`

   ...and 21 more line(s)

Contents of /etc/periodic/daily/130.clean-msgs (checksum 4292599426)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_clean_msgs_enable" in
       [Yy][Ee][Ss])
    if [ ! -d /var/msgs ]
    then
       echo '$daily_clean_msgs_enable is set but /var/msgs' \
    "doesn't exist"
       rc=2
    else
       echo ""
       echo "Cleaning out old system announcements:"
       [ -n "$daily_clean_msgs_days" ] &&
    arg=-${daily_clean_msgs_days#-} || arg=
       msgs -c $arg && rc=0 || rc=3
    fi;;
       *) rc=0;;
   esac
   exit $rc

Contents of /etc/periodic/daily/140.clean-rwho (checksum 659374794)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_clean_rwho_enable" in
       [Yy][Ee][Ss])
    if [ -z "$daily_clean_rwho_days" ]
    then
       echo '$daily_clean_rwho_enable is enabled but' \
    '$daily_clean_rwho_days is not set'
       rc=2
    elif [ ! -d /var/rwho ]
    then
       echo '$daily_clean_rwho_enable is enabled but /var/rwho' \
    "doesn't exist"
       rc=2
    else
       echo ""
       echo "Removing stale files from /var/rwho:"
       case "$daily_clean_rwho_verbose" in
    [Yy][Ee][Ss])
       print=-print;;
    *)
       print=;;

   ...and 14 more line(s)

Contents of /etc/periodic/daily/199.clean-fax (checksum 1104983357)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   if [ -d /var/spool/fax ]; then
       echo ""
       echo "Removing scratch fax files"
       cd /var/spool/fax && \
       find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;
   fi

Contents of /etc/periodic/daily/310.accounting (checksum 3208203734)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_accounting_enable" in
       [Yy][Ee][Ss])
    if [ ! -f /var/account/acct ]
    then
       echo '$daily_accounting_enable is set but /var/account/acct' \
    "doesn't exist"
       rc=2
    elif [ -z "$daily_accounting_save" ]
    then
       echo '$daily_accounting_enable is set but ' \
    '$daily_accounting_save is not'
       rc=2
    else
       echo ""
       echo "Rotating accounting logs and gathering statistics:"
       cd /var/account
       rc=0
       n=$daily_accounting_save
       rm -f acct.$n.gz acct.$n || rc=3
       m=$n

   ...and 18 more line(s)

Contents of /etc/periodic/daily/400.status-disks (checksum 1480768650)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_status_disks_enable" in
       [Yy][Ee][Ss])
    echo ""
    echo "Disk status:"
    df $daily_status_disks_df_flags && rc=1 || rc=3
    ;;
       *) rc=0;;
   esac
   exit $rc

Contents of /etc/periodic/daily/420.status-network (checksum 2730873650)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_status_network_enable" in
       [Yy][Ee][Ss])
    echo ""
    echo "Network interface status:"
    case "$daily_status_network_usedns" in
       [Yy][Ee][Ss])
    netstat -i && rc=0 || rc=3;;
       *)
    netstat -in && rc=0 || rc=3;;
    esac;;
       *) rc=0;;
   esac
   exit $rc

Contents of /etc/periodic/daily/430.status-rwho (checksum 3455351261)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$daily_status_rwho_enable" in
       [Yy][Ee][Ss])
    rwho=$(echo /var/rwho/*)
           if [ -f "${rwho%% *}" ]
           then
       echo ""
       echo "Local network system status:"
       prog=ruptime
    else
       echo ""
       echo "Local system status:"
       prog=uptime
    fi
    rc=$($prog | tee /dev/stderr | wc -l)
    if [ $? -eq 0 ]
    then
       [ $rc -gt 1 ] && rc=1
    else
       rc=3
    fi;;

   ...and 3 more line(s)

Contents of /etc/periodic/daily/999.local (checksum 2319755381)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   rc=0
   for script in $daily_local
   do
       echo ''
       case "$script" in
    /*)
       if [ -f "$script" ]
       then
    echo "Running $script:"
    sh $script || rc=3
       else
    echo "$script: No such file"
    [ $rc -lt 2 ] && rc=2
       fi;;
    *)
       echo "$script: Not an absolute path"
       [ $rc -lt 2 ] && rc=2;;
       esac
   done
   exit $rc

Contents of /etc/periodic/monthly/199.rotate-fax (checksum 3437454680)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   echo ""
   printf %s "Rotating fax log files:"
   cd /var/log/fax
   for i in *.log; do
       if [ -f "${i}" ]; then
       echo -n " $i"
       if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
       if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
       if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
       if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
       if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
       if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
       touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
       fi
   done
   echo ""

Contents of /etc/periodic/monthly/200.accounting (checksum 3541581936)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   oldmask=$(umask)
   umask 066
   case "$monthly_accounting_enable" in
       [Yy][Ee][Ss])
    W=/var/log/wtmp
    rc=0
    remove=NO
    if [ $rc -eq 0 ]
    then
       echo ""
       echo "Doing login accounting:"
       rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)
       [ $rc -gt 0 ] && rc=1
    fi
    [ $remove = YES ] && rm -f $W.0;;
       *) rc=0;;
   esac
   umask $oldmask
   exit $rc

Contents of /etc/periodic/monthly/999.local (checksum 2355967272)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   rc=0
   for script in $monthly_local
   do
       echo ''
       case "$script" in
    /*)
       if [ -f "$script" ]
       then
    echo "Running $script:"
    sh $script || rc=3
       else
    echo "$script: No such file"
    [ $rc -lt 2 ] && rc=2
       fi;;
    *)
       echo "$script: Not an absolute path"
       [ $rc -lt 2 ] && rc=2;;
       esac
   done
   exit $rc

Contents of /etc/periodic/weekly/320.whatis (checksum 922328658)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   case "$weekly_whatis_enable" in
       [Yy][Ee][Ss])
    echo ""
    echo "Rebuilding whatis database:"
    MANPATH=`/usr/bin/manpath -q`
    if [ $? = 0 ]
    then
       if [ -z "${MANPATH}" ]
       then
    echo "manpath failed to find any manpage directories"
    rc=3
       else
    rc=0
    /usr/libexec/makewhatis.local "${MANPATH}" || rc=3
    if [ X"${man_locales}" != X ]
    then
       for i in ${man_locales}
       do
    LC_ALL=$i /usr/libexec/makewhatis.local -a \
       -L "${MANPATH}" || rc=3

   ...and 9 more line(s)

Contents of /etc/periodic/weekly/999.local (checksum 3078968429)

   if [ -r /etc/defaults/periodic.conf ]
   then
       . /etc/defaults/periodic.conf
       source_periodic_confs
   fi
   rc=0
   for script in $weekly_local
   do
       echo ''
       case "$script" in
    /*)
       if [ -f "$script" ]
       then
    echo "Running $script:"
    sh $script || rc=3
       else
    echo "$script: No such file"
    [ $rc -lt 2 ] && rc=2
       fi;;
    *)
       echo "$script: Not an absolute path"
       [ $rc -lt 2 ] && rc=2;;
       esac
   done
   exit $rc

Contents of /Library/Preferences/com.apple.security.appsandbox.plist (checksum 2599182411)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>UnrestrictSpotlightContainerScope</key>
       <true/>
   </dict>
   </plist>

Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (checksum 1199119104)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Kernel Flags</key>
    <string></string>
   </dict>
   </plist>

Font issues: 4

Restricted files: 58

Lockfiles: 51

Elapsed time (s): 161

*****
Reply options

Link to this post

by McTempe,

McTempe Jan 27, 2016 2:14 PM in response to Linc Davis
Level 1 (0 points)

Jan 27, 2016 2:14 PM in response to Linc Davis

Deleted
Reply options

Link to this post

by ginger0541,

ginger0541 Feb 3, 2016 10:47 AM in response to thomas_r.
Level 1 (0 points)

Feb 3, 2016 10:47 AM in response to thomas_r.

Thomas....thank you...thank you...thank you! I have been attacked now and held hostage by "totiteck" for approx. 2 weeks. I just downloaded adwaremedic and within 5 minutes your software kicked totiteck's butt!!! My iMac is now running clean and lightning fast. Your software was uber easy to download, install and run. It found everything and removed in a matter of minutes. I am now a supporter and fan of adwaremedic!

Thanks so much,

Don
Atlanta, Ga
Reply options

Link to this post

by ~Bee,

~Bee Feb 3, 2016 12:27 PM in response to ginger0541
Level 7 (31,792 points)

Mac OS X

Feb 3, 2016 12:27 PM in response to ginger0541

ginger --

Thanks so much for posting your great results with MalwareBytes.
I'll make sure he sees it.
Reply options

Link to this post

by thomas_r.,

thomas_r. Feb 3, 2016 12:52 PM in response to ginger0541
Level 7 (30,924 points)

Mac OS X

Feb 3, 2016 12:52 PM in response to ginger0541

Don,

Thanks for the kind words! I'm glad that my app could be of assistance.

One note, though... if you actually found an old copy of AdwareMedic, you should be aware that it has now become Malwarebytes Anti-Malware for Mac, and the old copies of AdwareMedic are no longer supported. They still work, but may miss things that the newer Malwarebytes Anti-Malware for Mac won't.

Thomas Reed
Director of Mac Offerings, Malwarebytes
Reply options

Link to this post

by Binbucks,

Binbucks Mar 2, 2016 7:19 AM in response to Linc Davis
Level 1 (0 points)

Mar 2, 2016 7:19 AM in response to Linc Davis

Hello Linc,

I erroneously downloaded the ersatz-Flash upgrade and suspect I have related malware problems. For example, at first I couldn't open the WD MacBook Live dashboard via Safari. Although this seems to have been sorted out. Anyway, may I submit my test results for the instructions you have kindly posted in this forum. What does it suggest to you?. Following forum comments, I am tempted to use the Malwarebytes app. if necessary. Thanks for your help. Barry

Start time: 14:24:11 03/02/16

Model Identifier: iMac14,3
System Version: OS X 10.10.5 (14F1605)
Kernel Version: Darwin 14.5.0
Time since boot: 1 day20:14

Root access: No

USB

   Porsche Mobile for Mac (LaCie)
   Mass Storage (Alcor Micro, Corp.)

FileVault: FileVault master keychain appears to be installed

Diagnostic reports

   2016-02-04 ExpanderDaemon crash
   2016-02-04 rapportd crash
   2016-02-04 spindump crash
   2016-02-08 ExpanderDaemon crash
   2016-02-08 rapportd crash
   2016-02-09 ExpanderDaemon crash
   2016-02-09 rapportd crash
   2016-02-10 ExpanderDaemon crash
   2016-02-21 ExpanderDaemon crash
   2016-02-21 rapportd crash
   2016-02-23 ExpanderDaemon crash
   2016-03-01 ExpanderDaemon crash x2
   2016-03-01 WDQuickView crash

Log

   Feb 29 18:12:30 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 111
   Feb 29 18:12:30 com.apple.spindump: Service exited with abnormal code: 75
   Feb 29 18:14:01 com.apple.WebKit.Networking.UUID: Service exited with abnormal code: 1
   Feb 29 18:22:11 com.apple.WebKit.Networking.UUID: Service exited with abnormal code: 1
   Feb 29 18:22:11 com.apple.WebKit.Databases.UUID: Service exited with abnormal code: 1
   Mar 1 10:57:09 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:10:47 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:10:57 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:12:48 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:13:04 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:14:02 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:15:57 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:16:18 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:16:30 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:18:13 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 11:22:27 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 12:02:55 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 1 15:12:44 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 111
   Mar 2 09:45:14 AFP_VFS afpfs_DoReconnect: Max reconnect time: 30 secs, Connect timeout: 15 secs for /Volumes/Public
   Mar 2 09:45:27 AFP_VFS afpfs_DoReconnect: Primary Reconnect failed 22 on /Volumes/Public
   Mar 2 09:45:28 ASP_TCP CancelOneRequest: cancelling slot 88 error 35 reqID 50754 flags 0x29 afpCmd 0x22 so 0xffffff802f9c03d8
   Mar 2 09:45:28 ASP_TCP CancelOneRequest: cancelling slot 89 error 35 reqID 50755 flags 0x29 afpCmd 0x22 so 0xffffff802f9c03d8
   Mar 2 09:58:32 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 111
   Mar 2 10:12:28 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1
   Mar 2 10:14:38 com.apple.WebKit.WebContent.UUID: Service exited with abnormal code: 1

kexts

   com.LaCie.ScsiType00 (2.2.0)

Agents

   com.trusteer.rapport.rapportd
   com.adobe.ARM.UUID
   com.google.keystone.system.agent
   com.lacie.LaCieDesktopManagerAgent
   uk.co.linn.KazooServer
   com.yahoo.YahooContactSyncAgent
   com.adobe.ARMDCHelper.UUID
   com.oracle.java.Java-Updater
   com.apple.FolderActions.folders
   com.apple.mrt.uiagent
   com.f-secure.sync.BTCloud
   net.culater.SIMBL.Agent
   com.divx.update.agent
   com.apple.FolderActions.enabled
   com.mediahm.operator.user.update
   com.divx.dms.agent

App extensions

   com.getdropbox.dropbox.garcon

Apps

   /Applications/Dropbox.app

Contents of /System/Library/LaunchAgents/com.apple.SafariPlugInUpdateNotifier.plist (checksum 941105980)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>EnablePressuredExit</key>
    <true/>
    <key>Label</key>
    <string>com.apple.SafariPlugInUpdateNotifier</string>
    <key>Program</key>
    <string>/usr/libexec/SafariPlugInUpdateNotifier</string>
    <key>LaunchEvents</key>
    <dict>
    <key>com.apple.fsevents.matching</key>
    <dict>
    <key>UserFlashPlugInModified</key>
    <dict>
    <key>Path</key>
    <string>~/Library/Internet Plug-Ins/Flash Player.plugin</string>
    </dict>
    <key>SystemFlashPlugInModified</key>
    <dict>
    <key>Path</key>
    <string>/Library/Internet Plug-Ins/Flash Player.plugin</string>
    </dict>
    </dict>

   ...and 3 more line(s)

Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist (checksum 3012644940)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Disabled</key>
    <true/>
    <key>Label</key>
    <string>org.apache.httpd</string>
    <key>EnvironmentVariables</key>
    <dict>
    <key>XPC_SERVICES_UNAVAILABLE</key>
    <string>1</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/usr/sbin/httpd-wrapper</string>
    <string>-D</string>
    <string>FOREGROUND</string>
    </array>
    <key>OnDemand</key>
    <false/>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist (checksum 2197523146)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARMDCHelper.UUID</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>12600</integer>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.divx.dms.agent.plist (checksum 3097025559)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.divx.dms.agent</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Application Support/DivX/DMSLaunch.app/Contents/MacOS/DMSLaunch</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.divx.update.agent.plist (checksum 3867571547)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.divx.update.agent</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Application Support/DivX/DivXUpdate.app/Contents/MacOS/DivXUpdate</string>
    <string>/silent</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>10800</integer>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.google.keystone.agent.plist (checksum 1503053263)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.google.keystone.system.agent</string>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>ProgramArguments</key>
    <array>
     <string>/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Conten ts/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAg ent</string>
     <string>-runMode</string>
     <string>ifneeded</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>3623</integer>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.lacie.LaCieDesktopManagerAgent.plist (checksum 512742951)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.lacie.LaCieDesktopManagerAgent</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/LaCie Desktop Manager.app/Contents/Helpers/LDM.app/Contents/MacOS/LDM</string>
    <string>--args</string>
    <string>-daemon</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 3019499811)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.oracle.java.Java-Updater</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
    <string>-bgcheck</string>
    </array>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
    <key>StartCalendarInterval</key>
    <dict>
    <key>Hour</key>
    <integer>12</integer>
    <key>Minute</key>
    <integer>36</integer>
    <key>Weekday</key>
    <integer>7</integer>
    </dict>
   </dict>

   ...and 1 more line(s)

Contents of /Library/LaunchAgents/com.trusteer.rapport.rapportd.plist (checksum 4018397927)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.trusteer.rapport.rapportd</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Rapport/bin/rapportd</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>WorkingDirectory</key>
    <string>/Library/Rapport/bin</string>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>Umask</key>
    <integer>18</integer>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/net.culater.SIMBL.Agent.plist (checksum 1107421619)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>net.culater.SIMBL.Agent</string>
    <key>Program</key>
    <string>/Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent</string>
    <key>RunAtLoad</key>
    <false/>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>OnDemand</key>
    <false/>
   </dict>
   </plist>

Contents of /Library/LaunchAgents/uk.co.linn.KazooServer.plist (checksum 4045050483)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>KeepAlive</key>
    <dict>
    <key>NetworkState</key>
    <true/>
    </dict>
    <key>Label</key>
    <string>uk.co.linn.KazooServer</string>
    <key>Program</key>
    <string>/Library/Linn/KazooServer.app/Contents/MacOS/KazooServer</string>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/tmp/KazooServer.stderr</string>
    <key>StandardOutPath</key>
    <string>/tmp/KazooServer.stdout</string>
   </dict>
   </plist>

Contents of /Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist (checksum 3887726299)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARMDC.Communicator</string>
    <key>MachServices</key>
    <dict>
    <key>com.adobe.ARMDC.Communicator</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/PrivilegedHelperTools/com.adobe.ARMDC.Communicator</string>
    </array>
   </dict>
   </plist>

Contents of /Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist (checksum 930028549)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARMDC.SMJobBlessHelper</string>
    <key>MachServices</key>
    <dict>
    <key>com.adobe.ARMDC.SMJobBlessHelper</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper</string >
    </array>
   </dict>
   </plist>

Contents of /Library/LaunchDaemons/com.lacie.LaCieDesktopManagerDaemon.plist (checksum 2312632113)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.lacie.LaCieDesktopManagerDaemon</string>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <dict>
    <key>SuccessfulExit</key>
    <false/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/LaCie Desktop Manager.app/Contents/Helpers/LDM.app/Contents/MacOS/LaCieDesktopManagerDaemon</ string>
    </array>
   </dict>
   </plist>

Contents of /Library/LaunchDaemons/com.trusteer.rooks.rooksd.plist (checksum 1478412778)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.trusteer.rooks.rooksd</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Rapport/bin/rooksd</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
   </dict>
   </plist>

Contents of /Library/LaunchDaemons/uk.co.linn.KazooServerDaemon.plist (checksum 2811515774)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>KeepAlive</key>
    <dict>
    <key>NetworkState</key>
    <true/>
    </dict>
    <key>Label</key>
    <string>uk.co.linn.KazooServerDaemon</string>
    <key>Program</key>
    <string>/Library/Linn/KazooServerDaemon.app/Contents/MacOS/KazooServerDaemon</s tring>
    <key>ProgramArguments</key>
    <array>
    <string>/Library/Linn/KazooServerDaemon.app/Contents/MacOS/KazooServerDaemon</s tring>
    <string>-d</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/tmp/KazooServerDaemon.stderr</string>
    <key>StandardOutPath</key>
    <string>/tmp/KazooServerDaemon.stdout</string>
   </dict>

   ...and 1 more line(s)

Contents of Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist (checksum 4071182229)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
    <dict>
     <key>Label</key>
     <string>com.adobe.AAM.Scheduler-1.0</string>
     <key>Program</key>
     <string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>
     <key>ProgramArguments</key>
     <array>
        <string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>
        <string>-mode=scheduled</string>
     </array>
     <key>StartCalendarInterval</key>
     <dict>
       <key>Minute</key>
       <integer>0</integer>
       <key>Hour</key>
       <integer>2</integer>
     </dict>
    </dict>
   </plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (checksum 408149527)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.adobe.ARM.UUID</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>12600</integer>
   </dict>
   </plist>

Contents of Library/LaunchAgents/com.f-secure.sync.BTCloud.plist (checksum 1294862215)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.f-secure.sync.BTCloud</string>
           <key>RunAtLoad</key>
           <false/>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/BT Cloud.app/Contents/MacOS/BT Cloud</string>
    </array>
   </dict>
   </plist>

Contents of Library/LaunchAgents/com.mediahm.operator.update.plist (checksum 274805927)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.mediahm.operator.user.update</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Users/USER/Library/Application Support/mediahm/mediahm.app/Contents/MacOS/Installer</string>
    <string>-evnt</string>
    <string>agnt</string>
    <string>-oprID</string>
    <string>80801124|00162|1000012|0|0|1|0|000000000|14022016|00469378|MjI=|U2VhcmN oIEdlbml1cw==|R0I=|VW5pdGVkIEtpbmdkb20=|</string>
    </array>
    <key>StartInterval</key>
    <integer>1888</integer>
    <key>WatchPaths</key>
    <array>
    <string>/Users/USER/Downloads</string>
    </array>
    <key>brTim</key>
    <string>1456140808O1456140808O1456140808</string>
    <key>heartBit</key>
    <string>1456912361</string>
    <key>prdInstKey</key>

   ...and 3 more line(s)

Contents of Library/LaunchAgents/com.yahoo.YahooContactSyncAgent.plist (checksum 1306820627)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.yahoo.YahooContactSyncAgent</string>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/PrivateFrameworks/YahooSync.framework/Resources/Yahoo! Sync.app/Contents/MacOS/Yahoo! Sync</string>
    <string>--sync</string>
    <string>--periodic</string>
    </array>
    <key>StartInterval</key>
    <integer>3600</integer>
   </dict>
   </plist>

Global login items

   /Applications/iTunes.app/Contents/Resources/iTunesHelper.app
   /Users/USER/Library/Application Support/SilverKeeper/LaCie Backup Support.app
   /Library/Application Support/WesternDigital/WDDriveManager/WDDriveManagerStatusMenu.app
   /Library/Application Support/WDSmartware/WDQuickView.app

Font issues: 44

Bad plists

   /Library/Preferences/-BringToFront.plist
   /Library/Preferences/AddressBookMe.plist
   /Library/Preferences/ByHost/ .0011248bbcd6.plist
   /Library/Preferences/ByHost/.GlobalPreferences.0011248bbcd6.plist
   /Library/Preferences/ByHost/.GlobalPreferences.003065b25a32.plist
   /Library/Preferences/ByHost/.GlobalPreferences.Barry-Hunts-Computer-2.local.pli st
   /Library/Preferences/ByHost/com.apple.AddressBook.plist
   /Library/Preferences/ByHost/com.apple.appleworks.plist
   /Library/Preferences/ByHost/com.apple.Classic.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.Classic.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.DiskUtility.plist
   /Library/Preferences/ByHost/com.apple.dock.plist
   /Library/Preferences/ByHost/com.apple.dotmactranslator.plist
   /Library/Preferences/ByHost/com.apple.finder.plist
   /Library/Preferences/ByHost/com.apple.frameworks.diskimages.uiagent.plist
   /Library/Preferences/ByHost/com.apple.help.plist
   /Library/Preferences/ByHost/com.apple.HIToolbox.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.HIToolbox.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.HIToolbox.plist
   /Library/Preferences/ByHost/com.apple.iApps.plist
   /Library/Preferences/ByHost/com.apple.ImageCapture2.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.ImageCapture2.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.ImageCaptureApp.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.ImageCaptureApp.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.ImageCaptureCamera.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.ImageCaptureCamera.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.ImageCaptureExtension2.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.ImageCaptureExtension2.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.internetconfig.plist
   /Library/Preferences/ByHost/com.apple.internetconfigpriv.plist
   /Library/Preferences/ByHost/com.apple.iPhoto.plist
   /Library/Preferences/ByHost/com.apple.iTunes.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.iTunes.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.loginwindow.plist
   /Library/Preferences/ByHost/com.apple.mail.plist
   /Library/Preferences/ByHost/com.apple.MenuBarClock.plist
   /Library/Preferences/ByHost/com.apple.networkConnect.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.networkConnect.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.preference.displays.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.preference.displays.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.PrefPane.Network.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.print.Cache.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.print.Cache.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.quicktimeplayer.plist
   /Library/Preferences/ByHost/com.apple.recentitems.plist
   /Library/Preferences/ByHost/com.apple.Safari.plist
   /Library/Preferences/ByHost/com.apple.scheduler.plist
   /Library/Preferences/ByHost/com.apple.screensaver.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.screensaver.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.screensaver.Beach.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.screensaver.slideshow.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.screensaver.slideshow.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.sidebarlists.plist
   /Library/Preferences/ByHost/com.apple.SoftwareUpdate.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.SoftwareUpdate.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.SoftwareUpdate.plist
   /Library/Preferences/ByHost/com.apple.spotlight.plist
   /Library/Preferences/ByHost/com.apple.Syndication.plist
   /Library/Preferences/ByHost/com.apple.SyndicationAgent.plist
   /Library/Preferences/ByHost/com.apple.systempreferences.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.systempreferences.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.systempreferences.plist
   /Library/Preferences/ByHost/com.apple.systemuiserver.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.systemuiserver.003065b25a32.plist
   /Library/Preferences/ByHost/com.apple.systemuiserver.plist
   /Library/Preferences/ByHost/com.apple.universalaccess.plist
   /Library/Preferences/ByHost/com.apple.windowserver.0011248bbcd6.plist
   /Library/Preferences/ByHost/com.apple.windowserver.003065b25a32.plist
   /Library/Preferences/ByHost/com.limegroup.gnutella.plist
   /Library/Preferences/ByHost/loginwindow.0011248bbcd6.plist
   /Library/Preferences/ByHost/loginwindow.003065b25a32.plist
   /Library/Preferences/ByHost/loginwindow.plist
   /Library/Preferences/ByHost/org.smfr.mtnw.plist
   /Library/Preferences/com.adobe.acrobat.reader.plist
   /Library/Preferences/com.adobe.acrobat.sh.plist
   /Library/Preferences/com.adobe.ESD.AdobeUpdaterApplication.plist
   /Library/Preferences/com.adobe.ESD.AUM.plist
   /Library/Preferences/com.adobe.Photoshop.Elements.plist
   /Library/Preferences/com.adobe.Reader.plist
   /Library/Preferences/com.adobe.Reader6.0.plist
   /Library/Preferences/com.adobe.Reader7.0.plist
   /Library/Preferences/com.apple.ActivityMonitor.plist
   /Library/Preferences/com.apple.AddressBook.plist
   /Library/Preferences/com.apple.ATS.plist
   /Library/Preferences/com.apple.Automator.plist
   /Library/Preferences/com.apple.bomarchivehelper.plist
   /Library/Preferences/com.apple.calculator.plist
   /Library/Preferences/com.apple.CharPaletteServer.plist
   /Library/Preferences/com.apple.Chess.plist
   /Library/Preferences/com.apple.ColorSyncCalibrator.plist
   /Library/Preferences/com.apple.ColorSyncUtility.plist
   /Library/Preferences/com.apple.Console.plist
   /Library/Preferences/com.apple.CrashReporter.plist
   /Library/Preferences/com.apple.dashboard.client.plist
   /Library/Preferences/com.apple.dashboard.plist
   /Library/Preferences/com.apple.desktop.plist
   /Library/Preferences/com.apple.dev.isl.plist
   /Library/Preferences/com.apple.Dictionary.plist
   /Library/Preferences/com.apple.digihub.plist
   /Library/Preferences/com.apple.DigitalColorMeter.plist
   /Library/Preferences/com.apple.DirectoryService.Config.plist
   /Library/Preferences/com.apple.DiskUtility.plist
   /Library/Preferences/com.apple.DotMacSync.plist
   /Library/Preferences/com.apple.dotmactranslator.plist
   /Library/Preferences/com.apple.DVDPlayer.plist
   /Library/Preferences/com.apple.finder.plist
   /Library/Preferences/com.apple.FontBook.plist
   /Library/Preferences/com.apple.frameworks.diskimages.diskimagesuiagent.plist
   /Library/Preferences/com.apple.frameworks.diskimages.uiagent.plist
   /Library/Preferences/com.apple.grapher.plist
   /Library/Preferences/com.apple.help.plist
   /Library/Preferences/com.apple.helpui.plist
   /Library/Preferences/com.apple.helpviewer.plist
   /Library/Preferences/com.apple.iApps.plist
   /Library/Preferences/com.apple.iCal.AlarmScheduler.plist
   /Library/Preferences/com.apple.iCal.plist
   /Library/Preferences/com.apple.iCal.sources.plist
   /Library/Preferences/com.apple.iChat.AIM.plist
   /Library/Preferences/com.apple.iChat.Jabber.plist
   /Library/Preferences/com.apple.iChat.plist
   /Library/Preferences/com.apple.iChat.SubNet.plist
   /Library/Preferences/com.apple.iDVD.plist
   /Library/Preferences/com.apple.iGrabNews.plist
   /Library/Preferences/com.apple.ImageCaptureApp.plist
   /Library/Preferences/com.apple.iMovie.plist
   /Library/Preferences/com.apple.iMovie3.plist
   /Library/Preferences/com.apple.installer.plist
   /Library/Preferences/com.apple.internetconfig.plist
   /Library/Preferences/com.apple.internetconfigpriv.plist
   /Library/Preferences/com.apple.internetconnect.plist
   /Library/Preferences/com.apple.iPhoto.plist
   /Library/Preferences/com.apple.isync.plist
   /Library/Preferences/com.apple.iTunes.eq.plist
   /Library/Preferences/com.apple.iTunes.plist
   /Library/Preferences/com.apple.iTunesHelper.plist
   /Library/Preferences/com.apple.iWork.Keynote.plist
   /Library/Preferences/com.apple.iWork.Pages.plist
   /Library/Preferences/com.apple.Labels.plist
   /Library/Preferences/com.apple.LaunchServices.plist
   /Library/Preferences/com.apple.mail.plist
   /Library/Preferences/com.apple.MenuBarClock.plist
   /Library/Preferences/com.apple.menuextra.textinput.plist
   /Library/Preferences/com.apple.modemmenuextra.plist
   /Library/Preferences/com.apple.NetworkDiagnostics.plist
   /Library/Preferences/com.apple.NetworkUtility.plist
   /Library/Preferences/com.apple.Preview.bookmarks.plist
   /Library/Preferences/com.apple.Preview.plist
   /Library/Preferences/com.apple.print.custompapers.plist
   /Library/Preferences/com.apple.print.custompresets.plist
   /Library/Preferences/com.apple.print.favorites.plist
   /Library/Preferences/com.apple.print.PrintCenter.plist
   /Library/Preferences/com.apple.print.PrinterProxy.DESKJET_3820.plist
   /Library/Preferences/com.apple.print.PrinterProxy.Internal_Modem.plist
   /Library/Preferences/com.apple.print.PrinterProxy.plist
   /Library/Preferences/com.apple.print.PrintingPrefs.plist
   /Library/Preferences/com.apple.QuickTime Player.plist
   /Library/Preferences/com.apple.quicktimeplayer.plist
   /Library/Preferences/com.apple.recentitems.plist
   /Library/Preferences/com.apple.Safari.plist
   /Library/Preferences/com.apple.scheduler.plist
   /Library/Preferences/com.apple.Sherlock.plist
   /Library/Preferences/com.apple.sidebarlists.plist
   /Library/Preferences/com.apple.speech.prefs.plist
   /Library/Preferences/com.apple.speech.recognition.AppleSpeechRecognition.prefs. plist
   /Library/Preferences/com.apple.speech.recognition.feedback.prefs.plist
   /Library/Preferences/com.apple.speech.recognition.recognizer.prefs.plist
   /Library/Preferences/com.apple.speech.recognitionserver.plist
   /Library/Preferences/com.apple.speech.synthesis.general.prefs.plist
   /Library/Preferences/com.apple.speech.synthesis.SpeechSynthesisServer.plist
   /Library/Preferences/com.apple.speech.voice.prefs.plist
   /Library/Preferences/com.apple.spotlight.plist
   /Library/Preferences/com.apple.Stickies.plist
   /Library/Preferences/com.apple.symbolichotkeys.plist
   /Library/Preferences/com.apple.Syndication.plist
   /Library/Preferences/com.apple.SyndicationAgent.plist
   /Library/Preferences/com.apple.systempreferences.plist
   /Library/Preferences/com.apple.systemuiserver.plist
   /Library/Preferences/com.apple.Terminal.plist
   /Library/Preferences/com.apple.TextEdit.plist
   /Library/Preferences/com.apple.Type7Camera.plist
   /Library/Preferences/com.apple.universalaccess.plist
   /Library/Preferences/com.divx.DivXBrowserPlugin.plist
   /Library/Preferences/com.divx.divxprefs.plist
   /Library/Preferences/com.divx.DivXUpdater.plist
   /Library/Preferences/com.epson.EPSON Attach To Email.plist
   /Library/Preferences/com.epson.ijprinter.utility.plist
   /Library/Preferences/com.intuit.quicken.plist
   /Library/Preferences/com.lacie.copyTool.plist
   /Library/Preferences/com.lacie.SilverKeeper.plist
   /Library/Preferences/com.limegroup.gnutella.plist
   /Library/Preferences/com.macromedia.Otto.plist
   /Library/Preferences/com.metrowerks.stationery.plist
   /Library/Preferences/com.microsoft.explorer.plist
   /Library/Preferences/com.microsoft.mediaplayer.plist
   /Library/Preferences/com.olympus.OLYMPUSMaster.plist
   /Library/Preferences/com.Qt_Plugins_3_1.plist
   /Library/Preferences/com.stuffit.DropStuff.plist
   /Library/Preferences/com.stuffit.DropZip.plist
   /Library/Preferences/com.stuffit.Engine.plist
   /Library/Preferences/com.stuffit.Expander.plist
   /Library/Preferences/com.yahoo.Messenger.plist
   /Library/Preferences/com.yahoo.Messenger.Users.bbh_40.plist
   /Library/Preferences/DivX Converter.plist
   /Library/Preferences/DM Classic Solitaire.plist
   /Library/Preferences/hu.mplayerhq.mplayerosx.plist
   /Library/Preferences/ImageBrowser Installer.plist
   /Library/Preferences/JavaApplicationStub.plist
   /Library/Preferences/jp.co.epson.Darkroom Print.plist
   /Library/Preferences/jp.co.epson.File Manager.plist
   /Library/Preferences/net.gottsilla.Poisoned.plist
   /Library/Preferences/net.telestream.wmv.import.plist
   /Library/Preferences/net.telestream.wmv.plugin.plist
   /Library/Preferences/org.smfr.mtnw.plist
   /Library/Preferences/org.videolan.vlc.plist
   /Library/Preferences/PIF Tool Lib1.1 Prefs.plist
   /Library/Preferences/SoftwareUpdateCheck.plist
   /Library/Preferences/Vidalia.plist
   /Library/Preferences/widget-com.apple.widget.calendar.plist
   /Library/Preferences/widget-com.apple.widget.dictionary.plist
   /Library/Preferences/widget-com.apple.widget.translation.plist
   /Library/Preferences/widget-com.apple.widget.unitconverter.plist
   /Library/Preferences/widget-com.apple.widget.weather.plist
   /Library/Preferences/widget-com.apple.widget.worldclock.plist
   Library/Preferences/ByHost/com.apple.Classic.001ec20fe9f1.plist
   Library/Preferences/ByHost/com.apple.PrefPane.Network.001ec20fe9f1.plist
   Library/Preferences/com.apple.iphotomosaic.plist
   Library/Preferences/Maintenance.plist

Firewall: On

User login items

   iTunesHelper
   - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
   iTunesHelper
   - missing value
   LaCie Backup Support
   - /Users/USER/Library/Application Support/SilverKeeper/LaCie Backup Support.app
   TCCengine
   - /Users/USER/Library/Preferences/TCCengine.app
   ExpanderDaemon
   - missing value
   AdobeResourceSynchronizer
   - missing value
   ExpanderDaemon
   - /Applications/StuffIt/StuffIt Expander.app/Contents/MacOS/ExpanderDaemon.app
   iTunes
   - /Applications/iTunes.app
   BT Cloud
   - missing value
   Dropbox
   - /Applications/Dropbox.app
   iTunesHelper
   - missing value
   LaCie Backup Support
   - /Users/USER/Library/Application Support/SilverKeeper/LaCie Backup Support.app
   WDDriveManagerStatusMenu
   - missing value
   WD Quick View
   - /Library/Application Support/WDSmartware/WDQuickView.app

Safari extensions

   AdBlock
   DuckDuckGo
   Search Genius

Widgets

   Time Map
   AccuWeather.com

Restricted files: 357

Lockfiles: 169

Elapsed time (s): 405
Reply options

Link to this post

by Linc Davis,

Linc Davis Mar 2, 2016 7:51 AM in response to Binbucks
Level 10 (208,000 points)

Applications

Mar 2, 2016 7:51 AM in response to Binbucks
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
You installed the "mediahm" trojan. Please take the steps below to disable it.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
Back up all data before continuing.
1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.
2. Inside the folder you just opened, there may be one or more files with a name that begins as follows:
          com.mediahm
Move any such files to the Trash. There may not be anything else in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)
Log out or restart the computer.
3. From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall all extensions you don't know you need. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.
4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select
          Safari ▹ Preferences... ▹ General
and click
          Set to Current Page
5. This step is optional. Open this folder as in Step 1:
~/Library/Application Support
and move to the Trash the subfolder with the name
          mediahm
if present.
Don't move the Application Support folder or anything else inside it.
Reply options

Link to this post

by Binbucks,

Binbucks Mar 2, 2016 9:34 AM in response to Linc Davis
Level 1 (0 points)

Mar 2, 2016 9:34 AM in response to Linc Davis

Thanks for the prompt reply Linc. Have followed all steps, so hope this trojan has bitten the dust. Barry
Reply options

Link to this post

by ~Bee,

~Bee Mar 2, 2016 10:06 AM in response to Binbucks
Level 7 (31,792 points)

Mac OS X

Mar 2, 2016 10:06 AM in response to Binbucks

In addition, You have Rapport on there, most likely recommended by your financial institution.
That thing isn't needed, and doesn't work, on Macs.
You can search for "Rapport" on here if you like.
Reply options

Link to this post

by Binbucks,

Binbucks Mar 7, 2016 2:40 AM in response to ~Bee
Level 1 (0 points)

Mar 7, 2016 2:40 AM in response to ~Bee

Thanks Bee. No Idea how Rapport was downloaded, but have run the uninstaller as recommended.

Barry
Reply options

Link to this post

by ~Bee,

~Bee Mar 7, 2016 4:06 PM in response to Binbucks
Level 7 (31,792 points)

Mac OS X

Mar 7, 2016 4:06 PM in response to Binbucks

Good to hear, BInbucks! Hope you're all sorted now.
Reply options

Link to this post

by (Bojangles),

(Bojangles) Mar 20, 2016 1:07 AM in response to Linc Davis
Level 1 (0 points)

Mar 20, 2016 1:07 AM in response to Linc Davis

Start time: 11:45:07 03/20/16

Model Identifier: MacBookPro11,3
System Version: OS X 10.10.5 (14F1605)
Kernel Version: Darwin 14.5.0
Time since boot: 16 days 14:04

System load

   combined level = Bad
   - battery level = Bad

FileVault: On

Diagnostic reports

   2016-02-28 Installer crash

Log

   Mar 15 18:33:19 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 17 12:42:45 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 17 21:58:54 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 18 06:13:01 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 18 21:16:23 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 19 16:37:59 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 19 17:11:18 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)
   Mar 19 20:58:43 [SendRawHCICommand] ### ERROR: EnqueueRequestForController failed (err=e00002d8)

Swap (MiB): 43225

I/O per process: coresymbolicati (UID 0) is using 31 MB/s

Memory: kernel_task (UID 0) is using 1500 MB

Daemons

   com.apple.installer.osmessagetracing
   com.adobe.fpsaud

Agents

   com.genieo.completer.ltvbit
   com.genieo.completer.download
   com.genieo.completer.update
   com.google.Chrome.framework.service_process/Users/USER/Library/Application_Supp ort/Google/Chrome
   com.spotify.webhelper
   com.google.keystone.user.agent
   com.apple.AirPortBaseStationAgent

Bundles

   /System/Library/Extensions/hp_Inkjet9_io_enabler.kext
   - com.hp.print.hpio.Inkjet9.kext
   /System/Library/Extensions/JMicronATA.kext
   - com.jmicron.JMicronATA
   /Library/Internet Plug-Ins/Flash Player.plugin
   - N/A
   /Library/Internet Plug-Ins/JavaAppletPlugin.plugin
   - com.apple.java.JavaAppletPlugin
   /Library/PreferencePanes/Flash Player.prefPane
   - com.adobe.flashplayerpreferences
   Library/Address Book Plug-Ins/SkypeABDialer.bundle
   - com.skype.skypeabdialer
   Library/Address Book Plug-Ins/SkypeABSMS.bundle
   - com.skype.skypeabsms
   Library/Caches/com.apple.Safari/Extensions/AdBlock-2.safariextension
   - com.betafish.adblockforsafari
   Library/Caches/com.apple.Safari/Extensions/Save to Pocket-2.safariextension
   - com.ideashower.pocket.safari
   Library/Caches/com.apple.Safari/Extensions/Searchme-2.safariextension
   - com.spigot.safari.searchme

App extensions

   com.getdropbox.dropbox.garcon

Apps

   /Applications/Dropbox.app
   /Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app

Contents of /System/Library/LaunchAgents/com.apple.SafariPlugInUpdateNotifier.plist (checksum 941105980)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>EnablePressuredExit</key>
    <true/>
    <key>Label</key>
    <string>com.apple.SafariPlugInUpdateNotifier</string>
    <key>Program</key>
    <string>/usr/libexec/SafariPlugInUpdateNotifier</string>
    <key>LaunchEvents</key>
    <dict>
    <key>com.apple.fsevents.matching</key>
    <dict>
    <key>UserFlashPlugInModified</key>
    <dict>
    <key>Path</key>
    <string>~/Library/Internet Plug-Ins/Flash Player.plugin</string>
    </dict>
    <key>SystemFlashPlugInModified</key>
    <dict>
    <key>Path</key>
    <string>/Library/Internet Plug-Ins/Flash Player.plugin</string>
    </dict>
    </dict>

   ...and 3 more line(s)

Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist (checksum 3012644940)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Disabled</key>
    <true/>
    <key>Label</key>
    <string>org.apache.httpd</string>
    <key>EnvironmentVariables</key>
    <dict>
    <key>XPC_SERVICES_UNAVAILABLE</key>
    <string>1</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/usr/sbin/httpd-wrapper</string>
    <string>-D</string>
    <string>FOREGROUND</string>
    </array>
    <key>OnDemand</key>
    <false/>
   </dict>
   </plist>

Contents of Library/LaunchAgents/com.genieo.completer.download.plist (checksum 2611349565)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.genieo.completer.download</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>
    <string>-trigger</string>
    <string>download</string>
    <string>-isDev</string>
    <string>0</string>
    <string>-installVersion</string>
    <string>17046</string>
    <string>-firstAppId</string>
    <string>19340001</string>
    </array>
    <key>WatchPaths</key>
    <array>
    <string>/Users/USER/Downloads</string>
    </array>
   </dict>
   </plist>

Contents of Library/LaunchAgents/com.genieo.completer.ltvbit.plist (checksum 3982294820)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.genieo.completer.ltvbit</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>
    <string>-trigger</string>
    <string>ltvbit</string>
    <string>-isDev</string>
    <string>0</string>
    <string>-installVersion</string>
    <string>17046</string>
    <string>-firstAppId</string>
    <string>19340001</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
    <key>Hour</key>
    <integer>4</integer>
    <key>Minute</key>
    <integer>58</integer>
    </dict>

   ...and 2 more line(s)

Contents of Library/LaunchAgents/com.genieo.completer.update.plist (checksum 4006969348)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.genieo.completer.update</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>
    <string>-trigger</string>
    <string>update</string>
    <string>-isDev</string>
    <string>0</string>
    <string>-installVersion</string>
    <string>17046</string>
    <string>-firstAppId</string>
    <string>19340001</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartCalendarInterval</key>
    <dict>
    <key>Hour</key>
    <integer>1</integer>
    <key>Minute</key>

   ...and 4 more line(s)

Contents of Library/LaunchAgents/com.google.Chrome.framework.plist (checksum 1861910114)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>KeepAlive</key>
    <dict>
    <key>SuccessfulExit</key>
    <false/>
    </dict>
    <key>Label</key>
    <string>com.google.Chrome.framework.service_process/Users/USER/Library/Applicat ion_Support/Google/Chrome</string>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>Program</key>
    <string>/Applications/Google Chrome.app/Contents/Versions/43.0.2357.65/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Applications/Google Chrome.app/Contents/Versions/43.0.2357.65/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper</string>
    <string>--type=service</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>Sockets</key>
    <dict>
    <key>ServiceProcessSocket</key>

   ...and 7 more line(s)

Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 3860473785)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.google.keystone.user.agent</string>
    <key>LimitLoadToSessionType</key>
    <string>Aqua</string>
    <key>ProgramArguments</key>
    <array>
     <string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>
     <string>-runMode</string>
     <string>ifneeded</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>3623</integer>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
   </dict>
   </plist>

Contents of Library/LaunchAgents/com.spotify.webhelper.plist (checksum 3365709012)

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>Label</key>
    <string>com.spotify.webhelper</string>
    <key>KeepAlive</key>
    <dict>
     <key>NetworkState</key>
     <true/>
    </dict>
    <key>RunAtLoad</key>
    <true/>
    <key>Program</key>
    <string>/Users/USER/Library/Application Support/Spotify/SpotifyWebHelper</string>
    <key>SpotifyPath</key>
    <string>/Applications/Spotify.app</string></dict>
   </plist>

DNS: 220.101.191.16 (static)

Listeners

   cupsd: ipp

User login items

   iTunesHelper
   - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
   Android File Transfer Agent
   - /Users/USER/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app
   Dropbox
   - /Applications/Dropbox.app
   Google Chrome
   - /Applications/Google Chrome.app
   Spotify
   - /Applications/Spotify.app

Safari extensions

   AdBlock
   Save to Pocket
   Searchme

Restricted files: 48

Elapsed time (s): 272
Reply options

Link to this post

first Page 15 of 16 last