iMac freezes during TC backup

Since a few days my iMac (newest version running Mountain Lion) freezes during TC backups. Since TC is set to backup every hour my computer freezes every hour - the MAC wheel pops up and keeps spinning.


Once I abort the TC backup it takes about half a minute for iMac to become responsive again.


Is there a solution for this problem - of course besides turning off TC and TM.


Thanks

iMac, Mac OS X (10.7.3), 2TB Time Capsule

Posted on Oct 20, 2012 12:48 PM

Reply
12 replies

Oct 20, 2012 3:28 PM in response to Wil12345

If you have more than one user account, these instructions must be carried out as an administrator.

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Console in the icon grid.

Step 1

Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left.

Enter "BOOT_TIME" (without the quotes) in the search box. Note the timestamps of those log messages, which refer to the times when the system was booted. Now clear the search box and scroll back in the log to the last boot time when you had the problem. Post the messages logged before the boot, while the system was unresponsive or was failing to shut down. Please include the BOOT_TIME message at the end of the log extract.

Post the log text, please, not a screenshot. If there are runs of repeated messages, post only one example of each. Don’t post many repetitions of the same message. When posting a log extract, be selective. In most cases, a few dozen lines are more than enough.

Please do not indiscriminately dump thousands of lines from the log into a message.

Important: Some private information, such as your name, may appear in the log. Edit it out by search-and-replace in a text editor before posting.

Step 2

Still in Console, look under System Diagnostic Reports for crash or panic logs, and post the entire contents of the most recent one, if any. In the interest of privacy, I suggest you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if present (it may not be.) Please don’t post shutdownStall, spin, or hang logs — they're very long and not helpful.

Oct 21, 2012 9:00 AM in response to Linc Davis

Thanks for trying to help me.


Although I've gathered the info you requested I think I have to tell you my iMac doesn't really freeze but stalls - nothing happens for minutes but it continues its tasks after that.


It doesn't reboot (unless I make it) or generate a diagnostics report (reports are empty).


Do you want me to post the requested info anyway? Is it helpful nonetheless? I also saved what shows in the Console under "string matching" during a stall.


Thanks

Oct 21, 2012 9:30 AM in response to Wil12345

The next time you have the problem, note the exact times when it starts and ends: hour, minute, second.


If you have more than one user account, these instructions must be carried out as an administrator.


Launch the Console application. Make sure the title of the Console window is All Messages.


Scroll back in the log to the time you noted above. Post any messages timestamped during that interval – the text, please, not a screenshot.

When posting a log extract, be selective. In most cases, a few dozen lines are more than enough.


Important: Some private information, such as your name, may appear in the log. Edit it out by search-and-replace in a text editor before posting.

Oct 22, 2012 4:29 AM in response to Linc Davis

The episode below started at 06.20.32 (it began when TC started backingup). I tried closing an application and launching Console - without success.


At 06.23.11 I tried stopping the backup and shutting down TC (I think it shows first at 06.23.15).


At 06.23.41 my iMac was responsive again.


The info below only covers 06.23.04 till 06.23.45 (it seems way too much data and I don't know what's useful and what isn't).


Thanks


10/21/12 6:23:04.000 PM kernel[0]: [2808|0] backupd async. scan: #'/Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/DDB40444-AE E8-4D4B-88EC-78FF16069F44.iba' act=0x02000000 rsn='ETYP1' ln='1591'

10/21/12 6:23:07.000 PM kernel[0]: [2776|501] mdworker async. scan: #'/Users/Willem/Library/Saved Application State/com.apple.iChat.savedState/data.data' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:08.940 PM esets_daemon[178]: warning[00b201c3]: /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd - OPEN - Long scan time:15sec [ts:Sun Oct 21 18:22:53 2012 te:Sun Oct 21 18:23:08 2012] for /Users/Willem/Library/Caches/com.apple.helpd/Generated/com.apple.DVDPlayer.help /English.helpindex

10/21/12 6:23:08.941 PM esets_daemon[178]: warning[00b2023e]: /usr/sbin/cfprefsd - OPEN - Long scan time:15sec [ts:Sun Oct 21 18:22:53 2012 te:Sun Oct 21 18:23:08 2012] for /Users/Willem/Library/Preferences/ByHost/.GlobalPreferences.74CC5827-4267-55FD- A361-8AD537F43775.plist

10/21/12 6:23:08.000 PM kernel[0]: /SourceCache/AppleFSCompression_kexts/AppleFSCompression-49/Compressors/Datales s/compressorType5Kext.c:532: Error: post_request error for /Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/C2BEADB6-CA A7-496A-96E4-5F7C255C8F28.iba: 35

10/21/12 6:23:08.000 PM kernel[0]: decmpfs.c:1339:decmpfs_read_compressed: decmpfs_fetch_uncompressed_data err -35

10/21/12 6:23:09.000 PM kernel[0]: /SourceCache/AppleFSCompression_kexts/AppleFSCompression-49/Compressors/Datales s/compressorType5Kext.c:532: Error: post_request error for /Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/DD2FF75A-9A 43-4DF5-9363-E3DE770EF032.iba: 35

10/21/12 6:23:09.000 PM kernel[0]: decmpfs.c:1339:decmpfs_read_compressed: decmpfs_fetch_uncompressed_data err -35

10/21/12 6:23:11.000 PM kernel[0]: [2888|501] Console async. scan: #'/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.f ramework/Versions/A/Resources/Info.plist' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:11.000 PM kernel[0]: [2886|501] mdworker async. scan: #'/usr/share/icu/icudt49l.dat' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:11.000 PM kernel[0]: [2885|89] mdworker async. scan: #'/Library/Spotlight/iBooksAuthor.mdimporter/Contents/MacOS/iBooksAuthor' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:12.000 PM kernel[0]: [248|501] Finder async. scan: #'/System/Library/CoreServices/Finder.app/Contents/Resources/English.lproj/Slic esStrings.strings' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:14.000 PM kernel[0]: [2775|501] helpd async. scan: #'/Users/Willem/Library/Caches/com.apple.helpd/Generated/com.apple.iChat.help/E nglish.helpindex' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:15.647 PM com.apple.backupd[2808]: Error: (-8084) SrcErr:YES Copying /Applications/ESET Cybersecurity.app/Contents/var/lib/data/updfiles/http_um10.eset.com/update.ver to (null)

10/21/12 6:23:15.000 PM kernel[0]: [2808|0] backupd async. scan: #'/Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/E8CEA697-46 63-459A-8A88-DCD20A3DBCB0.iba' act=0x02000000 rsn='ETYP1' ln='1591'

10/21/12 6:23:15.649 PM com.apple.backupd[2808]: Copied 108 files (Zero KB) from volume Macintosh HD.

10/21/12 6:23:15.991 PM com.apple.backupd[2808]: Backup canceled.

10/21/12 6:23:21.000 PM kernel[0]: [203|501] cfprefsd async. scan: #'/Users/Willem/Library/Preferences/ByHost/com.apple.loginwindow.74CC5827-4267- 55FD-A361-8AD537F43775.plist' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:23.000 PM kernel[0]: [2888|501] Console async. scan: #'/System/Library/Frameworks/AppKit.framework/Versions/C/Resources/Info.plist' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:23.000 PM kernel[0]: [2886|501] mdworker async. scan: #'/Users/Willem/Library/Spotlight/EndNote.mdimporter/Contents/Info.plist' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:23.000 PM kernel[0]: [2885|89] mdworker async. scan: #'/Library/Spotlight/iBooksAuthor.mdimporter/Contents/MacOS/iBooksAuthor' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:23.941 PM esets_daemon[178]: warning[00b202bd]: /System/Library/CoreServices/backupd - OPEN - Long scan time:15sec [ts:Sun Oct 21 18:23:08 2012 te:Sun Oct 21 18:23:23 2012] for /Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/DDB40444-AE E8-4D4B-88EC-78FF16069F44.iba

10/21/12 6:23:23.000 PM kernel[0]: [248|501] Finder async. scan: #'/System/Library/CoreServices/Finder.app/Contents/Resources/English.lproj/Colu mnNameField.nib' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:23.000 PM kernel[0]: /SourceCache/AppleFSCompression_kexts/AppleFSCompression-49/Compressors/Datales s/compressorType5Kext.c:532: Error: post_request error for /Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/DDB40444-AE E8-4D4B-88EC-78FF16069F44.iba: 35

10/21/12 6:23:23.000 PM kernel[0]: decmpfs.c:1339:decmpfs_read_compressed: decmpfs_fetch_uncompressed_data err -35

10/21/12 6:23:23.942 PM esets_daemon[178]: warning[00b201be]: mdworker - OPEN - Long scan time:15sec [ts:Sun Oct 21 18:23:08 2012 te:Sun Oct 21 18:23:23 2012] for /Users/Willem/Library/Saved Application State/com.apple.iChat.savedState/data.data

10/21/12 6:23:27.006 PM diskarbitrationd[21]: Finder [248]:27955 not responding.

10/21/12 6:23:27.000 PM kernel[0]: [2776|501] mdworker async. scan: #'/Users/Willem/Library/Saved Application State/com.apple.iChat.savedState/windows.plist' act=0x00000002 rsn='ETYP1' ln='747'

10/21/12 6:23:27.000 PM kernel[0]: [247|501] SystemUIServer async. scan: #'/private/var/folders/jc/8vfqhfbd0_14108dqmkkvrqm0000gn/C/mds/mdsObject.db' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:27.000 PM kernel[0]: [2775|501] helpd async. scan: #'/Users/Willem/Library/Caches/com.apple.helpd/Generated/com.apple.AppStore.hel p/English.helpindex' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:28.000 PM kernel[0]: [2892|0] launchd async. scan: #'/usr/libexec/launchdadd' act=0x00000008 rsn='ETYP1' ln='1591'

10/21/12 6:23:28.000 PM kernel[0]: [200|501] UserEventAgent async. scan: #'/private/var/db/launchd.db/com.apple.launchd.peruser.501/overrides.plist' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:35.000 PM kernel[0]: [2888|501] Console async. scan: #'/Applications/Utilities/Console.app/Contents/Resources/English.lproj/Console. nib' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:35.000 PM kernel[0]: [2886|501] mdworker async. scan: #'/Users/Willem/Library/Spotlight/EndNote.mdimporter/Contents/MacOS/EndNote' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:35.000 PM kernel[0]: [2885|89] mdworker async. scan: #'/Library/Spotlight/iBooksAuthor.mdimporter/Contents/MacOS/iBooksAuthor' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:36.000 PM kernel[0]: [248|501] Finder async. scan: #'/System/Library/CoreServices/Finder.app/Contents/Resources/English.lproj/Grou pNameField.nib' act=0x00000002 rsn='ETYP1' ln='1591'

10/21/12 6:23:38.943 PM esets_daemon[178]: warning[00b20144]: Unknown - OPEN - Long scan time:15sec [ts:Sun Oct 21 18:23:23 2012 te:Sun Oct 21 18:23:38 2012] for /Users/Willem/Library/Saved Application State/com.apple.iChat.savedState/windows.plist

10/21/12 6:23:38.000 PM kernel[0]: /SourceCache/AppleFSCompression_kexts/AppleFSCompression-49/Compressors/Datales s/compressorType5Kext.c:532: Error: post_request error for /Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/E8CEA697-46 63-459A-8A88-DCD20A3DBCB0.iba: 35

10/21/12 6:23:38.000 PM kernel[0]: decmpfs.c:1339:decmpfs_read_compressed: decmpfs_fetch_uncompressed_data err -35

10/21/12 6:23:38.943 PM esets_daemon[178]: warning[00b20240]: /System/Library/CoreServices/backupd - OPEN - Long scan time:15sec [ts:Sun Oct 21 18:23:23 2012 te:Sun Oct 21 18:23:38 2012] for /Volumes/Time Machine Backups/Backups.backupdb/Willem’s iMac/2012-10-21-104600/Macintosh HD/.DocumentRevisions-V100/PerUID/501/66/com.apple.documentVersions/E8CEA697-46 63-459A-8A88-DCD20A3DBCB0.iba

10/21/12 6:23:39.439 PM Finder[248]: ISGetIconFamilyFromStorage: seed mismatch for 26b90043, actual seed is 7c6e151c

1 OSServices 0x00007fff84e58950 _ZL26ISGetIconFamilyFromStoragejPP17CIconStorageArrayPj + 140

2 OSServices 0x00007fff84e8708b _ISIsStorageOnTheVolume + 23

3 OSServices 0x00007fff84eb15ce _ISIsAnyOfImageStoragesOnTheVolume + 47

4 LaunchServices 0x00007fff8ec38313 _ZN13CIconRefEntry23DataChangedAfterUnmountEs + 13

5 LaunchServices 0x00007fff8ec374a8 _ZN13CIconRefArray13UnmountVolumeEs + 82

6 LaunchServices 0x00007fff8ec382fc _ZL21MountNotificationHookP15VolumeNoticeBlk + 39

7 CarbonCore 0x00007fff8a2ed8db _Z29_FSVolumeNotificationCallbacksPK10__CFStringPKvPv + 282

8 CarbonCore 0x00007fff8a2b9e4e _FSVolumeObserverCallback + 165

9 CoreFoundation 0x00007fff88007410 __CFMachPortPerform + 288

10 CoreFoundation 0x00007fff880072d9 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41

11 CoreFoundation 0x00007fff88007019 __CFRunLoopDoSource1 + 153

12 CoreFoundation 0x00007fff8803a19f __CFRunLoopRun + 1775

13 CoreFoundation 0x00007fff880396b2 CFRunLoopRunSpecific + 290

14 HIToolbox 0x00007fff8419c0a4 RunCurrentEventLoopInMode + 209

15 HIToolbox 0x00007fff8419bd84 ReceiveNextEventCommon + 166

16 HIToolbox 0x00007fff8419bcd3 BlockUntilNextEventMatchingListInMode + 62

17 AppKit 0x00007fff8fb42613 _DPSNextEvent + 685

18 AppKit 0x00007fff8fb41ed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128

19 AppKit 0x00007fff8fb39283 -[NSApplication run] + 517

20 AppKit 0x00007fff8faddcb6 NSApplicationMain + 869

21 Finder 0x0000000100f91b46 Finder + 23366

22 libdyld.dylib 0x00007fff879347e1 start + 0

10/21/12 6:23:39.564 PM com.apple.backupd[2808]: Ejected Time Machine disk image: /Volumes/Data-1/Willem’s iMac.sparsebundle

10/21/12 6:23:39.922 PM Finder[248]: ISGetIconFamilyFromStorage: seed mismatch for 26b90043, actual seed is 7c6e151c

1 OSServices 0x00007fff84e58950 _ZL26ISGetIconFamilyFromStoragejPP17CIconStorageArrayPj + 140

2 OSServices 0x00007fff84e8708b _ISIsStorageOnTheVolume + 23

3 OSServices 0x00007fff84eb15ce _ISIsAnyOfImageStoragesOnTheVolume + 47

4 LaunchServices 0x00007fff8ec38313 _ZN13CIconRefEntry23DataChangedAfterUnmountEs + 13

5 LaunchServices 0x00007fff8ec374a8 _ZN13CIconRefArray13UnmountVolumeEs + 82

6 LaunchServices 0x00007fff8ec382fc _ZL21MountNotificationHookP15VolumeNoticeBlk + 39

7 CarbonCore 0x00007fff8a2ed8db _Z29_FSVolumeNotificationCallbacksPK10__CFStringPKvPv + 282

8 CarbonCore 0x00007fff8a2b9e4e _FSVolumeObserverCallback + 165

9 CoreFoundation 0x00007fff88007410 __CFMachPortPerform + 288

10 CoreFoundation 0x00007fff880072d9 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41

11 CoreFoundation 0x00007fff88007019 __CFRunLoopDoSource1 + 153

12 CoreFoundation 0x00007fff8803a19f __CFRunLoopRun + 1775

13 CoreFoundation 0x00007fff880396b2 CFRunLoopRunSpecific + 290

14 HIToolbox 0x00007fff8419c0a4 RunCurrentEventLoopInMode + 209

15 HIToolbox 0x00007fff8419be42 ReceiveNextEventCommon + 356

16 HIToolbox 0x00007fff8419bcd3 BlockUntilNextEventMatchingListInMode + 62

17 AppKit 0x00007fff8fb42613 _DPSNextEvent + 685

18 AppKit 0x00007fff8fb41ed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128

19 AppKit 0x00007fff8fb39283 -[NSApplication run] + 517

20 AppKit 0x00007fff8faddcb6 NSApplicationMain + 869

21 Finder 0x0000000100f91b46 Finder + 23366

22 libdyld.dylib 0x00007fff879347e1 start + 0

10/21/12 6:23:39.923 PM com.apple.backupd[2808]: Ejected Time Machine network volume.

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount: /Volumes/Data-1, flags 0, pid 2898

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount : We are the last mnt/sbmnt using volume /Volumes/Data-1 0xffffff8146e99008

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount : We are the last volume using socket /Volumes/Data-1 0xffffff8146e99008

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount : afpfs_DoReconnect sent signal for unmount to proceed

10/21/12 6:23:39.564 PM com.apple.backupd[2808]: Ejected Time Machine disk image: /Volumes/Data-1/Willem’s iMac.sparsebundle

10/21/12 6:23:39.922 PM Finder[248]: ISGetIconFamilyFromStorage: seed mismatch for 26b90043, actual seed is 7c6e151c

1 OSServices 0x00007fff84e58950 _ZL26ISGetIconFamilyFromStoragejPP17CIconStorageArrayPj + 140

2 OSServices 0x00007fff84e8708b _ISIsStorageOnTheVolume + 23

3 OSServices 0x00007fff84eb15ce _ISIsAnyOfImageStoragesOnTheVolume + 47

4 LaunchServices 0x00007fff8ec38313 _ZN13CIconRefEntry23DataChangedAfterUnmountEs + 13

5 LaunchServices 0x00007fff8ec374a8 _ZN13CIconRefArray13UnmountVolumeEs + 82

6 LaunchServices 0x00007fff8ec382fc _ZL21MountNotificationHookP15VolumeNoticeBlk + 39

7 CarbonCore 0x00007fff8a2ed8db _Z29_FSVolumeNotificationCallbacksPK10__CFStringPKvPv + 282

8 CarbonCore 0x00007fff8a2b9e4e _FSVolumeObserverCallback + 165

9 CoreFoundation 0x00007fff88007410 __CFMachPortPerform + 288

10 CoreFoundation 0x00007fff880072d9 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41

11 CoreFoundation 0x00007fff88007019 __CFRunLoopDoSource1 + 153

12 CoreFoundation 0x00007fff8803a19f __CFRunLoopRun + 1775

13 CoreFoundation 0x00007fff880396b2 CFRunLoopRunSpecific + 290

14 HIToolbox 0x00007fff8419c0a4 RunCurrentEventLoopInMode + 209

15 HIToolbox 0x00007fff8419be42 ReceiveNextEventCommon + 356

16 HIToolbox 0x00007fff8419bcd3 BlockUntilNextEventMatchingListInMode + 62

17 AppKit 0x00007fff8fb42613 _DPSNextEvent + 685

18 AppKit 0x00007fff8fb41ed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128

19 AppKit 0x00007fff8fb39283 -[NSApplication run] + 517

20 AppKit 0x00007fff8faddcb6 NSApplicationMain + 869

21 Finder 0x0000000100f91b46 Finder + 23366

22 libdyld.dylib 0x00007fff879347e1 start + 0

10/21/12 6:23:39.923 PM com.apple.backupd[2808]: Ejected Time Machine network volume.

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount: /Volumes/Data-1, flags 0, pid 2898

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount : We are the last mnt/sbmnt using volume /Volumes/Data-1 0xffffff8146e99008

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount : We are the last volume using socket /Volumes/Data-1 0xffffff8146e99008

10/21/12 6:23:40.000 PM kernel[0]: AFP_VFS afpfs_unmount : afpfs_DoReconnect sent signal for unmount to proceed

10/21/12 6:23:45.482 PM mdworker[2885]: Unable to talk to lsboxd

10/21/12 6:23:45.665 PM mdworker[2886]: Unable to talk to lsboxd

Oct 22, 2012 7:19 AM in response to Wil12345

This comment applies to malicious software ("malware") that's installed unwittingly by the victim of a network attack. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an attacker who has hands-on access to the victim's computer. That threat is in a different category, and there's no easy way to defend against it. If you have reason to suspect that you're the target of such an attack, you need expert help.

All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files. The recognition database is automatically updated once a day; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders. In most cases, there’s no benefit from any other automated protection against malware.


Starting with OS X 10.7.5, there is another layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications that are downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Applications certified in this way haven't actually been tested by Apple (unless they come from the Mac App Store), but you can be sure that they haven't been modified by anyone other than the developer, and his identity is known, so he could be held responsible if he knowingly released malware. For most practical purposes, applications recognized by Gatekeeper as signed can be considered safe. Note, however, that there are some caveats concerning Gatekeeper:

  1. It doesn't apply to software that comes packaged as an installer. Treat all third-party installers with caution.
  2. It can be disabled or overridden by the user.
  3. It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets (see below.)
  4. It only applies to applications downloaded from the network. Software installed from a CD or other media is not checked.
For more information about Gatekeeper, see this Apple Support article .


Notwithstanding the above, the most effective defense against malware attacks is your own intelligence. All known malware on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "trojan horses," which can only have an effect if the victim is duped into running them. If you're smarter than the malware attacker thinks you are, you won't be duped. That means, primarily, that you never install software from an untrustworthy source. How do you know a source is untrustworthy?

  1. Any website that prompts you to install a “codec,” “plug-in,” or “certificate” that comes from that same site, or an unknown one, is untrustworthy.
  2. A web operator who tells you that you have a “virus,” or that anything else is wrong with your computer, or that you have won a prize in a contest you never entered, is trying to commit a crime with you as the victim. [Some reputable websites did legitimately warn users who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.]
  3. “Cracked” copies of commercial software downloaded from a bittorrent are likely to be infected.
  4. Software with a corporate brand, such as Adobe Flash Player, must be downloaded directly from the developer’s website. No intermediary is acceptable.
Java on the network (not to be confused with JavaScript, to which it's not related) is always a potential weak spot in the security of any operating system. If a Java web plugin is not installed, don't install it unless you really need it. If it is installed, you should disable it (not JavaScript) in your web browsers. Few websites have Java content nowadays, so you won’t be missing much. This setting is mandatory in OS X 10.5.8 or earlier, because Java in those obsolete versions has known security flaws that make it unsafe to use on the Internet. The flaws will never be fixed. Regardless of version, experience has shown that Java can never be fully trusted , even if no vulnerabilities are publicly known at the moment.

Follow these guidelines, and you’ll be as safe from malware as you can reasonably be.

Never install any commercial "anti-virus" products for the Mac, as they all do more harm than good. If you need to be able to detect Windows malware in your files, use the free software ClamXav — nothing else.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

iMac freezes during TC backup

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.