Mac Mail hangs and goes to not responding.

Virus scanners

While users here like the large library of virus strings and its Mac specific nature, MalwareBytes scan should be run ONCE on demand, and then set aside.

The main reason is that Virus scanners are relentless in scanning your files, non-stop, looking for virus-like patterns in Everything. When completed, they do it all again. This punishes performance.

MacOS shares a lot of the lock-down mechanisms developed for the iPhone. Applications are all sand-boxed with a list of the resources they require, and they cannot ask for anything outside their sandbox without crashing. Signed Applications are checked that they are from legitimate Developers, and Notarized Applications are delivered with the assurance that they have NOT been modified since their release by the Developer.

Recent versions of MacOS completely changed how you should think about malware.

From MacOS 10.15 Catalina onward, the system is on a Separate, crypto-locked System Volume, which is not writeable using ordinary means. Any unauthorized differences that appear to the crypto-locked volume are quickly detected and you are alerted.

So you could store just about every malware known to mankind on your Mac, and your Mac would not get infected spontaneously. Scanning for virus-like patterns might make you feel a little better now, but it is outdated nonsense.

Nothing can become Executable Unless/Until you supply your Admin password to "make it so".

Effective defenses against malware and ot… - Apple Community

.

Unsigned files - There are unsigned software files installed. These files could be old, incompatible, and cause problems. They should be reviewed.

Apple issues [revokable] Developer Certificates to legitimate Registered Developers. Every bit of software that Developer releases in intended to be tagged with their traceable Developer Certificate, and the certificate is verified online when the software is installed. Etrecheck was first released while the developer certificate program was in transition, and that language was softened to give lagging Developers a break. Today, no such break is appropriate.

if you have managed to install items that are NOT tagged with a Developer Certificate, it could be malware, and should be removed. Despite the names matching legitimate software, ALL of these should be completely removed:

Unsigned Files:

Launchd: ~/Library/LaunchAgents/com.pia.pia_manager.plist

Command: /usr/bin/open -a '/Applications/Private Internet Access.app' --args --startup

Details: Exact match found in the legitimate list - probably OK

Launchd: ~/Library/LaunchAgents/uk.co.canimaansoftware.clamxav.UninstallWatcher.plist

Command: /usr/bin/open /usr/local/clamXav/bin/UninstallClamXav.app

Details: Exact match found in the legitimate list - probably OK

Launchd: /Library/LaunchDaemons/jp.co.canon.MasterInstaller.plist

Executable: /Library/PrivilegedHelperTools/jp.co.canon.MasterInstaller

Details: Exact match found in the legitimate list - probably OK

you can copy each string supplied (I underlined the part to be copied) and paste it into a window here:

Finder > Go Menu > Go to folder

... and it should take you right to the folder where that file is located. Then find the filename (at the end of the string) and move that file to Trash. After you have restarted, they will no longer be part of running MacOS, and the Trash can be emptied.

NB>> If any turn out to be essential, you can download a newer version. That newer version is FAR more likely to have a current Developer Certificate.

<<. Do not want to reinstall the Mail app and lose my saved emails. >>

if your mail accounts are set up as IMAP, so that you can read emails on your iPhone or another device as well, the emails themselves are NOT stored on your Mac at all, except in "on My Mac" folders. the bodies of the emails are stored on the IMAP server(s) of your service prob=viders, and the subject's (only) are sent to you for display in a list. when you want to actually READ and email, the server downloads it to you at that moment.

This means that deleting an IMAP Account and re-adding it is intended to have no impact on your emails or anything else.

--------

if you are running MacOS 11 Big Sur or later, there is no longer any added value of just re-installing MacOS in place (which is intended to not touch YOUR files in any way.) MacOS does not modify itself. The system files are on a crypto-locked system volume that can not be modified by ordinary means, and if modified, MacOS can determine that very quickly.

Another classic debugging method that can be modestly useful to help isolate Hardware issues, is to make one or several backups, then ERASE the boot drive and re-install. Testing at that moment, when ONLY standard MacOS is present and no third-party add-ons have been installed, can help isolate Hardware issues, but yours is not Likely Hardware.

What MAY be helpful is an Etrecheck report, especially from then the problem is happening.

Consider downloading and running this little "discovery" utility, Etrecheck. It changes NOTHING. Etrecheck was developed by senior contributor here, and uses system calls to collect often-needed information.

it contains little tests for speeds of devices, CPU utilization, memory usage, energy usage and a digest of recent problems, in one easy to use package. it does not even need to be Installed. Because less can be learned when your Mac is running great, best time to run is when your problems are actually occurring, if possible.

if you follow the directions faithfully, its report (pre-laundered of all personally-identifiable information) can be "Shared" to the system ClipBoard, then Pasted into an ‘Additional Text’ window in a reply on the forums.

How to use Etrecheck pro for free

http://etrecheck.com

...

You have been scammed. Someone sold you on the idea that a VPN is better or more secure. Neither is true. Adding a VPN make your Mac slower, MORE subject to intrusion, and less secure, and adds no end of Grief. Get rid of that VPN you installed yourself. Not just disabled -- removed completely.

you appear to have fragments of MULTIPLE VPN s installed and standing by. ALL must be completely removed.

if you are in the federal Witness Protection Program or have comparable needs, use Tor Browser instead.

make Finder active.

from the Finder GO menu, choose:

Go To Folder, and enter:

~/Library/LaunchAgents

in the window that opens, find:

com.pia.pia_manager.plist

drag that item to the Trash

Restart

After you have made some of those improvements, please post another Etrecheck report.

did you restart after moving those items? they still show as installed and running.