Mac System Data increases significantly after deleting documents from Hard Drive.

EtreCheckPro version: 6.7.1 (67011)

Report generated: 2022-10-13 11:52:43

Download EtreCheckPro from https://etrecheck.com

Runtime: 3:00

Performance: Excellent

Problem: Other problem

Description: 

Mac System Data growing out of control whenever I delete or move files

 to external drive.

Major Issues:

  Anything that appears on this list needs immediate attention. 

  Unsigned files - There are unsigned software files installed that could be malicious and should be reviewed.

  Security updates disabled - Security updates are disabled. This computer is at risk of malware infection.

  Low disk space - This computer is running critically low on free hard drive space.

  Apple security disabled - Apple security software is disabled. This computer is at risk of malware infection.

Minor Issues:

  These issues do not need immediate attention but they may indicate future problems or opportunities for improvement. 

  Unsigned files - There are unsigned software files installed. These files could be old, incompatible, and cause problems. They should be reviewed.

  System modifications - There are a large number of system modifications running in the background.

  x86-only Apps - This computer has x86-only apps might not work on future versions of the operating system.

  Limited permissions - More information may be available with Full Disk Access.

  Kernel extensions present - This computer has kernel extensions that may not work in the future.

Hardware Information:

  iMac Pro (2017)

   Status: Supported

  iMac Pro Model: iMacPro1,1

  3.2 GHz 8-Core Intel Xeon W (W-2140B) CPU: 8-core

  32 GB RAM - Not upgradeable

Video Information:

  Radeon Pro Vega 56 - VRAM: 8 GB

   iMac (built-in) 4096 x 2304

Good News ( I think). Unit was shut down for several hours today and after start up, everything seems to be ok. Hard drive now showing 401 GD availability and System Data dropped to 256 GB. These numbers are more indicative of files I moved and/or deleted.

Thank You P. Phillips and Etresoft for your guidance and prompt responses to my issue. And thanks for the advice on the third party anti virus software.

Tony

Drives:

  disk0 - APPLE SSD AP1024M 1.00 TB (Solid State - TRIM: Yes) 

  Internal PCI-Express 8.0 GT/s x4 NVM Express

    disk0s1 - EFI [EFI] 315 MB

    disk0s2 [APFS Container] 1.00 TB

      disk1 [APFS Virtual drive] 1.00 TB (Shared by 6 volumes)

        disk1s1 - Macintosh HD - Data (APFS) [APFS Virtual drive] (Shared - 978.22 GB used)

        disk1s2 - Preboot (APFS) [APFS Preboot] (Shared - 508 MB used)

        disk1s3 - Recovery (APFS) [Recovery] (Shared)

        disk1s4 - VM (APFS) [APFS VM] (Shared - 25 KB used)

        disk1s5 (APFS) [APFS Container] (Shared)

          disk1s5s1 - Macintosh HD (APFS) [APFS Snapshot] (Shared - 15.41 GB used)

        disk1s6 - Update (APFS) (Shared - 5 MB used)

  disk2 - Seagate Backup+ Hub BK 8.00 TB

  External USB 5 Gbit/s USB

    disk2s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

    disk2s2 - S********G (Journaled HFS+) 8.00 TB (3.95 TB used)

  disk3 - SABRENT                                500.11 GB

  External USB 5 Gbit/s USB

    disk3s1 - EFI (MS-DOS FAT32) [EFI] 393 MB

    disk3s2 - B********************K (Journaled HFS+) 499.71 GB (194.92 GB used)

  disk4 - Mobile Drive 160.04 GB

  External USB 5 Gbit/s USB

    disk4s1 - K******e 117.89 GB (117.70 GB used)

  disk5 - Seagate BUP BK 5.00 TB

  External USB 5 Gbit/s USB

    disk5s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

    disk5s2 - S*******2 (Journaled HFS+) 5.00 TB (1.08 TB used)

Mounted Volumes:

  disk1s1 - Macintosh HD - Data [APFS Virtual drive]

    1.00 TB (Shared - 978.22 GB used, 4.77 GB free)

    APFS

    Mount point: /System/Volumes/Data

    Encrypted

  disk1s2 - Preboot [APFS Preboot]

    1.00 TB (Shared - 508 MB used, 4.77 GB free)

    APFS

    Mount point: /System/Volumes/Preboot

  disk1s4 - VM [APFS VM]

    1.00 TB (Shared - 25 KB used, 4.77 GB free)

    APFS

    Mount point: /System/Volumes/VM

  disk1s5s1 - Macintosh HD [APFS Snapshot]

    1.00 TB (Shared - 15.41 GB used, 4.77 GB free)

    APFS

    Mount point: /

    Read-only: Yes

  disk1s6 - Update

    1.00 TB (Shared - 5 MB used, 4.77 GB free)

    APFS

    Mount point: /System/Volumes/Update

  disk2s2 - S********G

    8.00 TB (3.95 TB used, 4.05 TB free)

    Journaled HFS+

    Mount point: /Volumes/S********G

    Owners enabled: No

  disk3s2 - B********************K

    499.71 GB (194.92 GB used, 304.80 GB available, 304.79 GB free)

    Journaled HFS+

    Mount point: /Volumes/B********************K

    Owners enabled: No

  disk4s1 - K******e

    117.89 GB (117.70 GB used, 187 MB free)

        Mount point: /Volumes/K******e

  disk5s2 - S*******2

    5.00 TB (1.08 TB used, 3.92 TB free)

    Journaled HFS+

    Mount point: /Volumes/S*******2

    Owners enabled: No

Network:

  Interface en0: Ethernet

  Interface en1: Wi-Fi

    802.11 a/b/g/n/ac

  Interface bridge0: Thunderbolt Bridge

System Software:

  12.6 12.6 (21G115) 

  Time since boot: Less than an hour

Notifications:

  EtreCheck.app

    3 notifications

  Safari.app

    24 notifications

Security:

  Gatekeeper: Enabled

  System Integrity Protection: Enabled

  Security Updates: Disabled

  Antivirus software: McAfee

Unsigned Files:

  Launchd: /Library/LaunchAgents/jp.co.zoom.HandyShareLaunchDaemon.plist

    Executable: /Applications/Utilities/ZOOM HandyShare/HandyShareStartupApp.app/Contents/MacOS/HandyShareStartupApp

    Details: Exact match found in the legitimate list - probably OK

  Launchd: /Library/LaunchDaemons/com.mingjie.mjrecorder.agent.plist

    Executable: /Library/Audio/Plug-Ins/HAL/MJRecorderDevice.driver/Contents/MacOS/MJRecorder-agent

    Details: Exact match found in the legitimate list - probably OK

  Launchd: /Library/LaunchDaemons/com.wdc.WDPrivilegedHelper.plist

    Executable: /Library/PrivilegedHelperTools/com.wdc.WDPrivilegedHelper

    Details: Exact match found in the legitimate list - probably OK

  Launchd: /Library/LaunchDaemons/com.uaudio.load-kext.plist

    Executable: /Library/Application Support/Universal Audio/load-kext.sh

  Launchd: /Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist

    Executable: /System/Library/PrivateFrameworks/OSInstaller.framework/Resources/OSMessageTracer

    Details: Exact match found in the legitimate list - probably OK

  Launchd: /Library/LaunchDaemons/jp.co.canon.MasterInstaller.plist

    Executable: /Library/PrivilegedHelperTools/jp.co.canon.MasterInstaller

    Details: Exact match found in the legitimate list - probably OK

  Running app: /Library/DropboxHelperTools/Dropbox_u501/dbkextd

    Details: Executable file is not accessible without Full Drive Access

  Plugin: /Library/Audio/Plug-Ins/HAL/MJRecorderDevice.driver

  Preference Pane: /Library/PreferencePanes/YAMAHA-USBMIDIPatch.prefPane

  Apps: 32

System Extensions:

  [Not Loaded] McAfee Endpoint Security - version 10.7.6 (McAfee, LLC. - 2022-10-10)

    Application: /Applications/McAfeeSystemExtensions.app - version 10.7.6 (McAfee, LLC. - 2022-10-10)

    Description: System extennsion to get file process events for common mac framework

  [Running] McAfee Network Extension - version 10.7.6 (McAfee, LLC. - 2022-10-10)

    Application: /Applications/McAfeeSystemExtensions.app - version 10.7.6 (McAfee, LLC. - 2022-10-10)

    Description: This sample system extension controls access to a local web server.

Kernel Extensions:

  /Library/Extensions

    Dropbox.kext - com.getdropbox.dropbox.kext (1.13.0 - SDK 10.14)

    ufsd_NTFS.kext - com.paragon-software.filesystems.ntfs (15.9.329 - SDK 10.10)

    quantum_driver.kext - com.presonus.pae-quantum (1.28.0 - SDK 10.11)

    UAD2System.kext - com.uaudio.driver.UAD2System (9.15.0 - SDK 10.16)

    BJUSBLoad.kext - jp.co.canon.bj.print.BJUSBLoad (10.75.21 - SDK 10.8)

    CIJUSBLoad.kext - jp.co.canon.ij.print.CIJUSBLoad (16.0.10 - SDK 10.9)

    YamahaSteinbergUSBAudio.kext - jp.co.yamaha.driver.YamahaSteinbergUSBAudio (2.0.3 - SDK 10.9)

    PaeFireStudio.kext - tc.tctechnologies.driver.PaeFireStudio (4.2.1 - SDK 10.8)

System Launch Agents:

  [Not Loaded]  16 Apple tasks

  [Loaded]  192 Apple tasks

  [Running]  148 Apple tasks

System Launch Daemons:

  [Not Loaded]  37 Apple tasks

  [Loaded]  194 Apple tasks

  [Running]  148 Apple tasks

  [Other]  One Apple task

Launch Agents:

  [Running] com.adobe.AdobeCreativeCloud.plist (Adobe Inc. - installed 2022-10-07)

  [Running] com.adobe.GC.AGM.plist (Adobe Inc. - installed 2022-10-10)

  [Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Inc. - installed 2022-10-10)

  [Loaded] com.adobe.ccxprocess.plist (Apple - installed 2022-10-07)

  [Running] com.mcafee.McAfeeSafariHost.plist (McAfee, LLC. - installed 2020-04-14)

  [Running] com.mcafee.macvpn.plist (McAfee, Inc. - installed 2022-09-28)

  [Running] com.mcafee.menulet.plist (McAfee, LLC. - installed 2022-09-28)

  [Running] com.mcafee.reporter.plist (McAfee, LLC. - installed 2022-09-28)

  [Other] com.mcafee.uninstall.SystemExtension.plist (McAfee, LLC. - installed 2022-09-29)

  [Loaded] com.microsoft.OneDriveStandaloneUpdater.plist (Microsoft Corporation - installed 2022-10-13)

  [Loaded] com.microsoft.update.agent.plist (Microsoft Corporation - installed 2022-10-11)

  [Loaded] com.paceap.eden.licensed.agent.plist (PACE Anti-Piracy, Inc. - installed 2022-04-21)

  [Running] com.paragon-software.ntfs.notification-agent.plist (Paragon Software GmbH - installed 2021-10-11)

  [Loaded] com.uaudio.ua_mixer_engine.plist (Universal Audio - installed 2021-12-08)

  [Running] com.uaudio.uad-meter.plist (Universal Audio - installed 2021-12-08)

  [Running] jp.co.zoom.HandyShareLaunchDaemon.plist (? 111288c2  - installed 2018-10-09)

HELP . . . I'm back where I started . . . This morning, Hard Drive availability dropped to 3 GB and System Data exploded to 663 GB. Not sure what is going on here?