Periodic spinning color wheel

Question

Level 1

16 points

Periodic spinning color wheel

I have a periodically appearing spinning color wheel. Every 3 minutes or so. It appears for a very short time. I can not trace its source. I have seen in the youtube there are some worms which are designed to do a screenshot etc. periodiaclly. Can it be something like this? Is there a way to trace the cause of this spininning wheel? It does not appear in the task manager. Also, is there a netstat -ap equivalent in OsX? There are lots of udp ports open, and I don't have a clue what they are. Also, I don't have a clue which programs are connecting to that addresses I don't recognize. What are those open streams in the /tmp and /var/tmp?. I've tried sophos and clamxav, all reported no malware.

System 2012 Retina Macbook with 16 gb ram

OsX 10.9.1

The open applications are firefox and chrome browsers (sites:Grooveshark and Gmail) imessage skype Mad Catz mouse software. Synology icloud. Nothing dissimilar I've been using for many years.

tcp4 0 0 gravitagravitas..55437 mad01s14-in-f15..https ESTABLISHED

tcp4 0 0 gravitagravitas..55434 bk-in-f113.1e100.https ESTABLISHED

tcp4 0 0 gravitagravitas..55421 alumnos162.cmlv..https ESTABLISHED

tcp4 0 0 gravitagravitas..55411 host1-208-dynami.https ESTABLISHED

tcp4 0 0 gravitagravitas..55237 a23-63-145-54.de.https ESTABLISHED

tcp4 0 0 gravitagravitas..54660 8.20.213.43.https ESTABLISHED

tcp4 0 0 localhost.socks *.* LISTEN

tcp6 0 0 localhost.socks *.* LISTEN

tcp4 0 0 gravitagravitas..53808 ber01s08-in-f22..https ESTABLISHED

tcp4 0 0 gravitagravitas..50959 157.55.133.143.https ESTABLISHED

tcp4 0 0 gravitagravitas..50958 db3msgr6011408.g.https ESTABLISHED

tcp4 0 0 gravitagravitas..50957 111.221.77.146.https ESTABLISHED

tcp4 0 0 *.46375 *.* LISTEN

tcp4 0 0 gravitagravitas..49796 bk-in-f125.1e100.https ESTABLISHED

tcp4 0 0 gravitagravitas..49653 17.172.232.12.https ESTABLISHED

tcp4 0 0 gravitagravitas..49652 17.130.254.25.https ESTABLISHED

tcp4 0 0 localhost.62272 localhost.62276 ESTABLISHED

tcp4 0 0 localhost.62276 localhost.62272 ESTABLISHED

tcp4 0 0 localhost.62273 *.* LISTEN

tcp4 0 0 localhost.62272 *.* LISTEN

tcp4 0 0 localhost.49246 localhost.1024 CLOSE_WAIT

tcp4 0 0 localhost.blackjack *.* LISTEN

tcp4 0 0 localhost.1024 *.* LISTEN

tcp6 0 0 localhost.intu-ec- *.* LISTEN

tcp4 0 0 localhost.intu-ec-clie *.* LISTEN

tcp6 0 0 localhost.intu-ec- *.* LISTEN

tcp4 0 0 *.ssh *.* LISTEN

tcp6 0 0 *.ssh *.* LISTEN

tcp4 0 0 localhost.ipp *.* LISTEN

tcp6 0 0 localhost.ipp *.* LISTEN

udp4 0 0 *.59906 *.*

udp4 0 0 *.65142 *.*

udp4 0 0 *.46375 *.*

udp4 0 0 *.* *.*

udp4 0 0 localhost.58784 *.*

udp4 0 0 *.49850 *.*

udp4 0 0 gravitagravitas..ntp *.*

udp6 0 0 *.52380 *.*

udp4 0 0 *.52380 *.*

udp6 0 0 *.60652 *.*

udp4 0 0 *.60652 *.*

udp6 0 0 *.59992 *.*

udp4 0 0 *.59992 *.*

udp6 0 0 *.54268 *.*

udp4 0 0 *.54268 *.*

udp6 0 0 *.59362 *.*

udp4 0 0 *.59362 *.*

udp6 0 0 *.58000 *.*

udp4 0 0 *.58000 *.*

udp6 0 0 gravitas-what-gr.ntp *.*

udp46 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.51516 *.*

udp6 0 0 localhost.ntp *.*

udp4 0 0 localhost.ntp *.*

udp6 0 0 localhost.ntp *.*

udp6 0 0 *.ntp *.*

udp4 0 0 *.ntp *.*

udp4 0 0 *.* *.*

udp4 29241 0 *.bootps *.*

udp4 0 0 *.* *.*

udp46 0 0 *.* *.*

udp6 0 0 *.mdns *.*

udp4 0 0 *.mdns *.*

udp4 0 0 *.* *.*

udp4 0 0 *.netbios-dgm *.*

udp4 0 0 *.netbios-ns *.*

icm6 0 0 *.* *.*

Active LOCAL (UNIX) domain sockets

Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr

5d553a828257bc5f stream 0 0 0 5d553a825903d8d7 0 0 /var/run/mDNSResponder

5d553a825903d8d7 stream 0 0 0 5d553a828257bc5f 0 0

5d553a825903f367 stream 0 0 0 5d553a82428a74f7 0 0

5d553a82428a74f7 stream 0 0 0 5d553a825903f367 0 0

5d553a82428a6c5f stream 0 0 0 5d553a82428a7d8f 0 0

5d553a82428a7d8f stream 0 0 0 5d553a82428a6c5f 0 0

5d553a8241f4910f stream 0 0 0 5d553a823f1acb97 0 0

5d553a823f1acb97 stream 0 0 0 5d553a8241f4910f 0 0

5d553a8244996cbf stream 0 0 0 5d553a825903fbff 0 0

5d553a825903fbff stream 0 0 0 5d553a8244996cbf 0 0

5d553a8241f47747 stream 0 0 0 5d553a825903ec5f 0 0

5d553a825903ec5f stream 0 0 0 5d553a8241f47747 0 0

5d553a828257b93f stream 0 0 0 5d553a82415c4e4f 0 0

5d553a82415c4e4f stream 0 0 0 5d553a828257b93f 0 0

5d553a8244997557 stream 0 0 0 5d553a82428a710f 0 0

5d553a82428a710f stream 0 0 0 5d553a8244997557 0 0

5d553a82428a661f stream 0 0 0 5d553a823f239237 0 0

5d553a823f239237 stream 0 0 0 5d553a82428a661f 0 0

5d553a825c1c4def stream 0 0 0 5d553a82428a71d7 0 0 /var/run/mDNSResponder

5d553a82428a71d7 stream 0 0 0 5d553a825c1c4def 0 0

5d553a8241f483c7 stream 0 0 0 5d553a82428a7f1f 0 0

5d553a82428a7f1f stream 0 0 0 5d553a8241f483c7 0 0

5d553a82428a6877 stream 0 0 0 5d553a82449972ff 0 0 /var/run/mDNSResponder

5d553a82449972ff stream 0 0 0 5d553a82428a6877 0 0

5d553a823f1abe4f stream 0 0 0 5d553a82449977af 0 0 /var/run/mDNSResponder

5d553a82449977af stream 0 0 0 5d553a823f1abe4f 0 0

5d553a825903f8df stream 0 0 0 5d553a825903e3c7 0 0 /var/run/mDNSResponder

5d553a825903e3c7 stream 0 0 0 5d553a825903f8df 0 0

5d553a82415c5def stream 0 0 0 5d553a825c1c4557 0 0

5d553a825c1c4557 stream 0 0 0 5d553a82415c5def 0 0

5d553a8243693047 stream 0 0 0 5d553a82428a648f 0 0 /var/run/mDNSResponder

5d553a82428a648f stream 0 0 0 5d553a8243693047 0 0

5d553a824499842f stream 0 0 0 5d553a8243691e4f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a8243691e4f stream 0 0 0 5d553a824499842f 0 0

5d553a823f1ad74f stream 0 0 0 5d553a82436915b7 0 0

5d553a82436915b7 stream 0 0 0 5d553a823f1ad74f 0 0

5d553a82415c5557 stream 0 0 0 5d553a828257c74f 0 0

5d553a828257c74f stream 0 0 0 5d553a82415c5557 0 0

5d553a823f23a8df stream 0 0 0 5d553a824369310f 0 0

5d553a824369310f stream 8 0 0 5d553a823f23a8df 0 0

5d553a824499761f stream 0 0 0 5d553a825903f9a7 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a825903f9a7 stream 0 0 0 5d553a824499761f 0 0

5d553a828257b61f stream 0 0 0 5d553a8241f4893f 0 0

5d553a8241f4893f stream 0 0 0 5d553a828257b61f 0 0

5d553a825c1c46e7 stream 0 0 0 5d553a824369167f 0 0

5d553a824369167f stream 0 0 0 5d553a825c1c46e7 0 0

5d553a82436938df stream 0 0 0 5d553a828257b48f 0 0

5d553a828257b48f stream 0 0 0 5d553a82436938df 0 0

5d553a82428a55b7 stream 0 0 0 5d553a82428a7817 0 0

5d553a82428a7817 stream 0 0 0 5d553a82428a55b7 0 0

5d553a82428a5e4f stream 0 0 0 5d553a824369248f 0 0

5d553a824369248f stream 0 0 0 5d553a82428a5e4f 0 0

5d553a825903ed27 stream 0 0 0 5d553a82428a79a7 0 0 /var/run/mDNSResponder

5d553a82428a79a7 stream 0 0 0 5d553a825903ed27 0 0

5d553a82428a60a7 stream 0 0 5d553a824ba41bf7 0 0 0 /Users/obm/Library/Application Support/Google/Chrome/App Shim Socket

5d553a82436926e7 stream 0 0 0 5d553a825c1c4f7f 0 0

5d553a825c1c4f7f stream 0 0 0 5d553a82436926e7 0 0

5d553a82449973c7 stream 0 0 0 5d553a828257c687 0 0

5d553a828257c687 stream 0 0 0 5d553a82449973c7 0 0

5d553a825c1c461f stream 0 0 0 5d553a828257c10f 0 0 /var/run/mDNSResponder

5d553a828257c10f stream 0 0 0 5d553a825c1c461f 0 0

5d553a825c1c54f7 stream 0 0 0 5d553a828257c42f 0 0 /var/run/mDNSResponder

5d553a828257c42f stream 0 0 0 5d553a825c1c54f7 0 0

5d553a8241f4735f stream 0 0 0 5d553a82449984f7 0 0 /var/run/mDNSResponder

5d553a82449984f7 stream 0 0 0 5d553a8241f4735f 0 0

5d553a8244997b97 stream 0 0 0 5d553a82428a580f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a82428a580f stream 0 0 0 5d553a8244997b97 0 0

5d553a8243691297 stream 0 0 0 5d553a825903edef 0 0

5d553a825903edef stream 0 0 0 5d553a8243691297 0 0

5d553a8241f4861f stream 0 0 0 5d553a8241f48557 0 0

5d553a8241f48557 stream 0 0 0 5d553a8241f4861f 0 0

5d553a8243692557 stream 0 0 0 5d553a8241f486e7 0 0 /var/run/mDNSResponder

5d553a8241f486e7 stream 0 0 0 5d553a8243692557 0 0

5d553a8241f47b2f stream 0 0 0 5d553a8241f4767f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a8241f4767f stream 0 0 0 5d553a8241f47b2f 0 0

5d553a8241f47cbf stream 0 0 0 5d553a825903f5bf 0 0

5d553a825903f5bf stream 0 0 0 5d553a8241f47cbf 0 0

5d553a82415c6d8f stream 0 0 0 5d553a825903ef7f 0 0

5d553a825903ef7f stream 0 0 0 5d553a82415c6d8f 0 0

5d553a828257bd27 stream 0 0 0 5d553a828257b557 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a828257b557 stream 0 0 0 5d553a828257bd27 0 0

5d553a8243693f1f stream 0 0 0 5d553a8241f49fe7 0 0

5d553a8241f49fe7 stream 0 0 0 5d553a8243693f1f 0 0

5d553a828257cb37 stream 0 0 0 5d553a828257c9a7 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a828257c9a7 stream 0 0 0 5d553a828257cb37 0 0

5d553a82428a58d7 stream 0 0 0 5d553a828257c367 0 0

5d553a828257c367 stream 0 0 0 5d553a82428a58d7 0 0

5d553a825c1c58df stream 0 0 0 5d553a82415c6b37 0 0

5d553a82415c6b37 stream 0 0 0 5d553a825c1c58df 0 0

5d553a825c1c448f stream 0 0 5d553a8251cddec7 0 0 0 /tmp/launchd-8494.2JQXxi/sock

5d553a82415c4f17 stream 0 0 0 5d553a825c1c4b97 0 0

5d553a825c1c4b97 stream 0 0 0 5d553a82415c4f17 0 0

5d553a825c1c59a7 stream 0 0 0 5d553a825c1c4877 0 0

5d553a825c1c4877 stream 0 0 0 5d553a825c1c59a7 0 0

5d553a825903f74f stream 0 0 0 5d553a823f23ab37 0 0

5d553a823f23ab37 stream 0 0 0 5d553a825903f74f 0 0

5d553a8241f47bf7 stream 0 0 0 5d553a824499829f 0 0

5d553a824499829f stream 0 0 0 5d553a8241f47bf7 0 0

5d553a82428a7cc7 stream 0 0 0 5d553a823d073747 0 0

5d553a823d073747 stream 0 0 0 5d553a82428a7cc7 0 0

5d553a8241f478d7 stream 0 0 0 5d553a823f12f0af 0 0

5d553a823f12f0af stream 0 0 0 5d553a8241f478d7 0 0

5d553a825903d67f stream 0 0 0 5d553a823f1ac93f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a823f1ac93f stream 0 0 0 5d553a825903d67f 0 0

5d553a823f1adbff stream 0 0 0 5d553a825903df17 0 0

5d553a825903df17 stream 0 0 0 5d553a823f1adbff 0 0

5d553a825c1c5367 stream 0 0 0 5d553a823f12cf17 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a823f12cf17 stream 0 0 0 5d553a825c1c5367 0 0

5d553a823f12c5b7 stream 0 0 0 5d553a8244996427 0 0 /var/run/mDNSResponder

5d553a8244996427 stream 0 0 0 5d553a823f12c5b7 0 0

5d553a8243691bf7 stream 0 0 0 5d553a823d07335f 0 0 /var/run/mDNSResponder

5d553a823d07335f stream 0 0 0 5d553a8243691bf7 0 0

5d553a825903f42f stream 0 0 0 5d553a825903f1d7 0 0 /var/run/mDNSResponder

5d553a825903f1d7 stream 0 0 0 5d553a825903f42f 0 0

5d553a825c1c6177 stream 0 0 0 5d553a825903fa6f 0 0

5d553a825903fa6f stream 0 0 0 5d553a825c1c6177 0 0

5d553a823f12e4f7 stream 0 0 0 5d553a8241f480a7 0 0

5d553a8241f480a7 stream 0 0 0 5d553a823f12e4f7 0 0

5d553a825c1c47af stream 0 0 0 5d553a8243693687 0 0

5d553a8243693687 stream 0 0 0 5d553a825c1c47af 0 0

5d553a823f1ad10f stream 0 0 0 5d553a825903eeb7 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a825903eeb7 stream 0 0 0 5d553a823f1ad10f 0 0

5d553a825903eb97 stream 0 0 0 5d553a825903d4ef 0 0

5d553a825903d4ef stream 0 0 0 5d553a825903eb97 0 0

5d553a825903d297 stream 0 0 0 5d553a825903dd87 0 0

5d553a825903dd87 stream 0 0 0 5d553a825903d297 0 0

5d553a825c1c510f stream 0 0 0 5d553a8244997def 0 0

5d553a8244997def stream 0 0 0 5d553a825c1c510f 0 0

5d553a825c1c493f stream 0 0 0 5d553a825903dfdf 0 0

5d553a825903dfdf stream 0 0 0 5d553a825c1c493f 0 0

5d553a82415c5877 stream 0 0 0 5d553a825c1c5a6f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a825c1c5a6f stream 0 0 0 5d553a82415c5877 0 0

5d553a825c1c5d8f stream 0 0 0 5d553a82415c593f 0 0

5d553a82415c593f stream 0 0 0 5d553a825c1c5d8f 0 0

5d553a825c1c4d27 stream 0 0 0 5d553a825903ea07 0 0 /var/run/mDNSResponder

5d553a825903ea07 stream 0 0 0 5d553a825c1c4d27 0 0

5d553a825903e2ff stream 0 0 0 5d553a825903d80f 0 0

5d553a825903d80f stream 0 0 0 5d553a825903e2ff 0 0

5d553a825903da67 stream 0 0 0 5d553a825903db2f 0 0

5d553a825903db2f stream 0 0 0 5d553a825903da67 0 0

5d553a82449976e7 stream 0 0 0 5d553a8244997a07 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a8244997a07 stream 0 0 0 5d553a82449976e7 0 0

5d553a8244997eb7 stream 0 0 0 5d553a8241f47d87 0 0

5d553a8241f47d87 stream 0 0 0 5d553a8244997eb7 0 0

5d553a8243691f17 stream 0 0 0 5d553a823f23a74f 0 0 /var/run/mDNSResponder

5d553a823f23a74f stream 0 0 0 5d553a8243691f17 0 0

5d553a824499748f stream 0 0 0 5d553a8241f47fdf 0 0

5d553a8241f47fdf stream 0 0 0 5d553a824499748f 0 0

5d553a823f12c8d7 stream 0 0 0 5d553a82436931d7 0 0

5d553a82436931d7 stream 0 0 0 5d553a823f12c8d7 0 0

5d553a8241f4929f stream 0 0 0 5d553a8241f4942f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a8241f4942f stream 0 0 0 5d553a8241f4929f 0 0

5d553a8241f49e57 stream 0 0 0 5d553a823f12d93f 0 0

5d553a823f12d93f stream 0 0 0 5d553a8241f49e57 0 0

5d553a82449965b7 stream 0 0 5d553a8258eec657 0 0 0 /tmp/launchd-1207.lh6cqb/sock

5d553a8241f49cc7 stream 0 0 0 5d553a82415c6367 0 0

5d553a82415c6367 stream 0 0 0 5d553a8241f49cc7 0 0

5d553a8241f49a6f stream 0 0 0 5d553a82415c48d7 0 0

5d553a82415c48d7 stream 0 0 0 5d553a8241f49a6f 0 0

5d553a82449968d7 stream 0 0 0 5d553a8241f49d8f 0 0

5d553a8241f49d8f stream 0 0 0 5d553a82449968d7 0 0

5d553a823f12cfdf stream 0 0 0 5d553a8243691d87 0 0

5d553a8243691d87 stream 0 0 0 5d553a823f12cfdf 0 0

5d553a8243693cc7 stream 0 0 0 5d553a823f12cbf7 0 0

5d553a823f12cbf7 stream 0 0 0 5d553a8243693cc7 0 0

5d553a8244997237 stream 0 0 0 5d553a823f12d61f 0 0

5d553a823f12d61f stream 0 0 0 5d553a8244997237 0 0

5d553a82415c6a6f stream 0 0 0 5d553a823f12ed8f 0 0 /var/run/mDNSResponder

5d553a823f12ed8f stream 0 0 0 5d553a82415c6a6f 0 0

5d553a8243691a67 stream 0 0 0 5d553a8243691427 0 0

5d553a8243691427 stream 0 0 0 5d553a8243691a67 0 0

5d553a82415c5b97 stream 0 0 0 5d553a8243692237 0 0

5d553a8243692237 stream 0 0 0 5d553a82415c5b97 0 0

5d553a82415c44ef stream 0 0 0 5d553a82436935bf 0 0

5d553a82436935bf stream 0 0 0 5d553a82415c44ef 0 0

5d553a82449989a7 stream 0 0 0 5d553a823d07367f 0 0

5d553a823d07367f stream 0 0 0 5d553a82449989a7 0 0

5d553a823f238bf7 stream 0 0 0 5d553a8241f495bf 0 0

5d553a8241f495bf stream 0 0 0 5d553a823f238bf7 0 0

5d553a8244996a67 stream 0 0 0 5d553a8244996b2f 0 0 /var/run/cloud-socket

5d553a8244996b2f stream 0 0 0 5d553a8244996a67 0 0

5d553a823f12e74f stream 0 0 0 5d553a823f1acf7f 0 0

5d553a823f1acf7f stream 0 0 0 5d553a823f12e74f 0 0

5d553a8244996d87 stream 0 0 5d553a824618abf7 0 0 0 /var/run/cloud-socket

5d553a8244996fdf stream 0 0 5d553a8246142ce7 0 0 0 /var/folders/wf/b0vssn213r72pmvzmfc46mhh0000gn/T/qtsingleapp-Synolo-2595-1f5

5d553a8243693fe7 stream 0 0 0 5d553a8244999177 0 0 /var/run/mDNSResponder

5d553a8244999177 stream 0 0 0 5d553a8243693fe7 0 0

5d553a823f239d27 stream 0 0 0 5d553a823f1abf17 0 0

5d553a823f1abf17 stream 0 0 0 5d553a823f239d27 0 0

5d553a82436939a7 stream 0 0 0 5d553a823f1ac61f 0 0 /var/tmp/launchd/sock

5d553a823f1ac61f stream 0 0 0 5d553a82436939a7 0 0

5d553a823f12ccbf stream 0 0 0 5d553a823d0734ef 0 0

5d553a823d0734ef stream 0 0 0 5d553a823f12ccbf 0 0

5d553a8243693a6f stream 0 0 0 5d553a82449990af 0 0 /var/run/usbmuxd

5d553a82449990af stream 0 0 0 5d553a8243693a6f 0 0

5d553a823f238a67 stream 0 0 0 5d553a823f12d3c7 0 0

5d553a823f12d3c7 stream 0 0 0 5d553a823f238a67 0 0

5d553a823f239def stream 0 0 0 5d553a824499874f 0 0

5d553a824499874f stream 0 0 0 5d553a823f239def 0 0

5d553a824369199f stream 0 0 0 5d553a823f12ddef 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a823f12ddef stream 0 0 0 5d553a824369199f 0 0

5d553a823d07542f stream 0 0 0 5d553a823d0754f7 0 0

5d553a823d0754f7 stream 0 0 0 5d553a823d07542f 0 0

5d553a823f1abb2f stream 0 0 0 5d553a823f1abbf7 0 0

5d553a823f1abbf7 stream 0 0 0 5d553a823f1abb2f 0 0

5d553a823f12d237 stream 0 0 0 5d553a823f12c80f 0 0

5d553a823f12c80f stream 0 0 0 5d553a823f12d237 0 0

5d553a823f12db97 stream 0 0 0 5d553a8244998d8f 0 0

5d553a8244998d8f stream 0 0 0 5d553a823f12db97 0 0

5d553a8244998e57 stream 0 0 5d553a824579c297 0 0 0 /tmp/launchd-477.m7k0gv/sock

5d553a82415c61d7 stream 0 0 0 5d553a82415c5c5f 0 0

5d553a82415c5c5f stream 0 0 0 5d553a82415c61d7 0 0

5d553a823f23a29f stream 0 0 0 5d553a823f23a10f 0 0 /var/run/mDNSResponder

5d553a823f23a10f stream 0 0 0 5d553a823f23a29f 0 0

5d553a8243693d8f stream 0 0 0 5d553a8243693e57 0 0

5d553a8243693e57 stream 0 0 0 5d553a8243693d8f 0 0

5d553a8243692b97 stream 0 0 0 5d553a8243692c5f 0 0

5d553a8243692c5f stream 0 0 0 5d553a8243692b97 0 0

5d553a82436934f7 stream 0 0 0 5d553a824369342f 0 0

5d553a824369342f stream 0 0 0 5d553a82436934f7 0 0

5d553a82436940af stream 0 0 0 5d553a8243694177 0 0

5d553a8243694177 stream 0 0 0 5d553a82436940af 0 0

5d553a8241f47f17 stream 0 0 0 5d553a8241f47e4f 0 0

5d553a8241f47e4f stream 0 0 0 5d553a8241f47f17 0 0

5d553a8241f48b97 stream 0 0 0 5d553a8241f48c5f 0 0

5d553a8241f48c5f stream 0 0 0 5d553a8241f48b97 0 0

5d553a8241f48eb7 stream 0 0 0 5d553a8241f48def 0 0 /var/run/mDNSResponder

5d553a8241f48def stream 0 0 0 5d553a8241f48eb7 0 0

5d553a8241f48f7f stream 0 0 0 5d553a8241f49047 0 0

5d553a8241f49047 stream 0 0 0 5d553a8241f48f7f 0 0

5d553a8241f49817 stream 0 0 0 5d553a8241f4974f 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a8241f4974f stream 0 0 0 5d553a8241f49817 0 0

5d553a8241f499a7 stream 0 0 0 5d553a8241f498df 0 0

5d553a8241f498df stream 0 0 0 5d553a8241f499a7 0 0

5d553a82415c499f stream 0 0 5d553a82425d5927 0 0 0 /var/folders/wf/b0vssn213r72pmvzmfc46mhh0000gn/T/icssuis501

5d553a8241f49b37 stream 0 0 0 5d553a8241f49bff 0 0

5d553a8241f49bff stream 0 0 0 5d553a8241f49b37 0 0

5d553a82415c4297 stream 0 0 0 5d553a82415c435f 0 0 /var/run/pppconfd

5d553a82415c435f stream 0 0 0 5d553a82415c4297 0 0

5d553a82415c467f stream 0 0 0 5d553a82415c45b7 0 0

5d553a82415c45b7 stream 0 0 0 5d553a82415c467f 0 0

5d553a82415c4a67 stream 0 0 0 5d553a82415c4b2f 0 0

5d553a82415c4b2f stream 0 0 0 5d553a82415c4a67 0 0

5d553a82415c50a7 stream 0 0 0 5d553a82415c516f 0 0

5d553a82415c516f stream 0 0 0 5d553a82415c50a7 0 0

5d553a82415c57af stream 0 0 0 5d553a82415c56e7 0 0 /var/run/mDNSResponder

5d553a82415c56e7 stream 0 0 0 5d553a82415c57af 0 0

5d553a82415c5acf stream 0 0 0 5d553a82415c5a07 0 0

5d553a82415c5a07 stream 0 0 0 5d553a82415c5acf 0 0

5d553a82415c5eb7 stream 0 0 0 5d553a82415c5d27 0 0

5d553a82415c5d27 stream 0 0 0 5d553a82415c5eb7 0 0

5d553a82415c5f7f stream 0 0 0 5d553a82415c6047 0 0 /var/run/mDNSResponder

5d553a82415c6047 stream 0 0 0 5d553a82415c5f7f 0 0

5d553a82415c629f stream 0 0 0 5d553a82415c610f 0 0 /var/run/mDNSResponder

5d553a82415c610f stream 0 0 0 5d553a82415c629f 0 0

5d553a82415c65bf stream 0 0 0 5d553a82415c64f7 0 0

5d553a82415c64f7 stream 0 0 0 5d553a82415c65bf 0 0

5d553a82415c69a7 stream 0 0 0 5d553a82415c6687 0 0

5d553a82415c6687 stream 0 0 0 5d553a82415c69a7 0 0

5d553a82415c6817 stream 0 0 0 5d553a82415c68df 0 0

5d553a82415c68df stream 0 0 0 5d553a82415c6817 0 0

5d553a823f1ae177 stream 0 0 0 5d553a823f1ade57 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a823f1ade57 stream 0 0 0 5d553a823f1ae177 0 0

5d553a823f238427 stream 0 0 0 5d553a823f23835f 0 0

5d553a823f23835f stream 0 0 0 5d553a823f238427 0 0

5d553a823f238297 stream 0 0 0 5d553a823f2384ef 0 0

5d553a823f2384ef stream 0 0 0 5d553a823f238297 0 0

5d553a82415c6cc7 stream 0 0 0 5d553a823f239c5f 0 0

5d553a823f239c5f stream 0 0 0 5d553a82415c6cc7 0 0

5d553a82415c6bff stream 0 0 0 5d553a823f239acf 0 0

5d553a823f239acf stream 0 0 0 5d553a82415c6bff 0 0

5d553a82415c70af stream 0 0 0 5d553a82415c7177 0 0

5d553a82415c7177 stream 0 0 0 5d553a82415c70af 0 0

5d553a823f12cb2f stream 0 0 0 5d553a823f12ca67 0 0

5d553a823f12ca67 stream 0 0 0 5d553a823f12cb2f 0 0

5d553a823f23867f stream 0 0 0 5d553a823f2385b7 0 0

5d553a823f2385b7 stream 0 0 0 5d553a823f23867f 0 0

5d553a823f23880f stream 0 0 0 5d553a823f238747 0 0

5d553a823f238747 stream 0 0 0 5d553a823f23880f 0 0

5d553a823f238cbf stream 0 0 0 5d553a823f23899f 0 0

5d553a823f23899f stream 0 0 0 5d553a823f238cbf 0 0

5d553a823f2388d7 stream 0 0 0 5d553a823f238b2f 0 0

5d553a823f238b2f stream 0 0 0 5d553a823f2388d7 0 0

5d553a823f238f17 stream 0 0 0 5d553a823f238e4f 0 0

5d553a823f238e4f stream 0 0 0 5d553a823f238f17 0 0

5d553a823f238fdf stream 0 0 0 5d553a823f2392ff 0 0

5d553a823f2392ff stream 0 0 0 5d553a823f238fdf 0 0

5d553a823f2390a7 stream 0 0 0 5d553a823f23916f 0 0 /var/run/mDNSResponder

5d553a823f23916f stream 0 0 0 5d553a823f2390a7 0 0

5d553a823f2393c7 stream 0 0 0 5d553a823f23948f 0 0

5d553a823f23948f stream 0 0 0 5d553a823f2393c7 0 0

5d553a823f23961f stream 0 0 0 5d553a823f239557 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a823f239557 stream 0 0 0 5d553a823f23961f 0 0

5d553a823f2396e7 stream 0 0 0 5d553a823f2397af 0 0

5d553a823f2397af stream 0 0 0 5d553a823f2396e7 0 0

5d553a823f23a5bf stream 0 0 0 5d553a823f23a4f7 0 0 /var/run/mDNSResponder

5d553a823f23a4f7 stream 0 0 0 5d553a823f23a5bf 0 0

5d553a823f12e1d7 stream 0 0 0 5d553a823f1ab8d7 0 0

5d553a823f1ab8d7 stream 0 0 0 5d553a823f12e1d7 0 0

5d553a823f12deb7 stream 0 0 0 5d553a823f239a07 0 0

5d553a823f239a07 stream 0 0 0 5d553a823f12deb7 0 0

5d553a823f1ab80f stream 0 0 0 5d553a823f12d7af 0 0

5d553a823f12d7af stream 0 0 0 5d553a823f1ab80f 0 0

5d553a823f23aa6f stream 0 0 0 5d553a823f12e5bf 0 0

5d553a823f12e5bf stream 0 0 0 5d553a823f23aa6f 0 0

5d553a823f12ea6f stream 0 0 5d553a8241158657 0 0 0 /tmp/launch-iJi2RL/Listeners

5d553a823f12e42f stream 0 0 5d553a8241158837 0 0 0 /tmp/launch-WPipDD/Render

5d553a823f12d2ff stream 0 0 5d553a8241158a17 0 0 0 /var/tmp/filesystemui.socket

5d553a823f12e29f stream 0 0 5d553a8241158b07 0 0 0 /tmp/launch-i0TgEu/org.macosforge.xquartz:0

5d553a823f12d48f stream 0 0 0 5d553a823f12dc5f 0 0

5d553a823f12dc5f stream 0 0 0 5d553a823f12d48f 0 0

5d553a823f12e8df stream 0 0 5d553a8241150a17 0 0 0 /tmp/launchd-164.OPA1pk/sock

5d553a823f1adcc7 stream 0 0 0 5d553a823f1ad9a7 0 0

5d553a823f1ad9a7 stream 0 0 0 5d553a823f1adcc7 0 0

5d553a823f23a047 stream 0 0 0 5d553a823f239f7f 0 0

5d553a823f239f7f stream 0 0 0 5d553a823f23a047 0 0

5d553a823f23a1d7 stream 0 0 0 5d553a823f12dd27 0 0

5d553a823f12dd27 stream 0 0 0 5d553a823f23a1d7 0 0

5d553a823f1ab99f stream 0 0 0 5d553a823f1ac237 0 0

5d553a823f1ac237 stream 0 0 0 5d553a823f1ab99f 0 0

5d553a823f23a687 stream 0 0 0 5d553a823f23a817 0 0

5d553a823f23a817 stream 0 0 0 5d553a823f23a687 0 0

5d553a823f1ab67f stream 0 0 0 5d553a823f12c99f 0 0

5d553a823f12c99f stream 0 0 0 5d553a823f1ab67f 0 0

5d553a823f1aca07 stream 0 0 0 5d553a823f1ac6e7 0 0

5d553a823f1ac6e7 stream 0 0 0 5d553a823f1aca07 0 0

5d553a823f1ad4f7 stream 0 0 0 5d553a823f1ad817 0 0

5d553a823f1ad817 stream 0 0 0 5d553a823f1ad4f7 0 0

5d553a823f1ad1d7 stream 0 0 0 5d553a823f1ad047 0 0

5d553a823f1ad047 stream 0 0 0 5d553a823f1ad1d7 0 0

5d553a823f1ab297 stream 0 0 0 5d553a823f1ac0a7 0 0

5d553a823f1ac0a7 stream 0 0 0 5d553a823f1ab297 0 0

5d553a823f1ac3c7 stream 0 0 0 5d553a823f1abd87 0 0

5d553a823f1abd87 stream 0 0 0 5d553a823f1ac3c7 0 0

5d553a823f1aceb7 stream 0 0 0 5d553a823f1acd27 0 0 /var/run/mDNSResponder

5d553a823f1acd27 stream 0 0 0 5d553a823f1aceb7 0 0

5d553a823f1aba67 stream 0 0 0 5d553a823f1ab747 0 0

5d553a823f1ab747 stream 0 0 0 5d553a823f1aba67 0 0

5d553a823f1ab5b7 stream 0 0 0 5d553a823f23af1f 0 0 /var/run/mDNSResponder

5d553a823f23af1f stream 0 0 0 5d553a823f1ab5b7 0 0

5d553a823f23abff stream 0 0 0 5d553a823f12d6e7 0 0

5d553a823f12d6e7 stream 0 0 0 5d553a823f23abff 0 0

5d553a823f12c427 stream 0 0 0 5d553a823f1ae0af 0 0 /var/run/mDNSResponder

5d553a823f1ae0af stream 0 0 0 5d553a823f12c427 0 0

5d553a823f1acc5f stream 0 0 0 5d553a823f1ad8df 0 0 /var/tmp/launchd/sock

5d553a823f1ad8df stream 0 0 0 5d553a823f1acc5f 0 0

5d553a823f1abfdf stream 0 0 0 5d553a823f1abcbf 0 0

5d553a823f1abcbf stream 0 0 0 5d553a823f1abfdf 0 0

5d553a823f12e367 stream 0 0 0 5d553a823f1add8f 0 0

5d553a823f1add8f stream 0 0 0 5d553a823f12e367 0 0

5d553a823f23acc7 stream 0 0 0 5d553a823f23ad8f 0 0

5d553a823f23ad8f stream 0 0 0 5d553a823f23acc7 0 0

5d553a823f23afe7 stream 0 0 0 5d553a823f23b0af 0 0

5d553a823f23b0af stream 0 0 0 5d553a823f23afe7 0 0

5d553a823f1ab35f stream 0 0 0 5d553a823f1ab427 0 0

5d553a823f1ab427 stream 0 0 0 5d553a823f1ab35f 0 0

5d553a823f1ac48f stream 0 0 0 5d553a823f1ac557 0 0

5d553a823f1ac557 stream 0 0 0 5d553a823f1ac48f 0 0

5d553a823f1ac7af stream 0 0 0 5d553a823f1ac877 0 0

5d553a823f1ac877 stream 0 0 0 5d553a823f1ac7af 0 0

5d553a823f1ad29f stream 0 0 0 5d553a823f1ad367 0 0

5d553a823f1ad367 stream 0 0 0 5d553a823f1ad29f 0 0

5d553a823f1ad5bf stream 0 0 0 5d553a823f1ad687 0 0

5d553a823f1ad687 stream 0 0 0 5d553a823f1ad5bf 0 0

5d553a823f1ada6f stream 0 0 0 5d553a823f1adb37 0 0

5d553a823f1adb37 stream 0 0 0 5d553a823f1ada6f 0 0

5d553a823f1adf1f stream 0 0 0 5d553a823f1adfe7 0 0

5d553a823f1adfe7 stream 0 0 0 5d553a823f1adf1f 0 0

5d553a823f12c297 stream 0 0 0 5d553a823f12c35f 0 0

5d553a823f12c35f stream 0 0 0 5d553a823f12c297 0 0

5d553a823f12cd87 stream 0 0 0 5d553a823f12ce4f 0 0

5d553a823f12ce4f stream 0 0 0 5d553a823f12cd87 0 0

5d553a823f12d0a7 stream 0 0 0 5d553a823f12d16f 0 0

5d553a823f12d16f stream 0 0 0 5d553a823f12d0a7 0 0

5d553a823f12da07 stream 0 0 0 5d553a823f12dacf 0 0

5d553a823f12dacf stream 0 0 0 5d553a823f12da07 0 0

5d553a823f12e047 stream 0 0 0 5d553a823f12e10f 0 0

5d553a823f12e10f stream 0 0 0 5d553a823f12e047 0 0

5d553a823f12eb37 stream 0 0 0 5d553a823f12ebff 0 0

5d553a823f12ebff stream 0 0 0 5d553a823f12eb37 0 0

5d553a823f12ee57 stream 0 0 0 5d553a823f12ef1f 0 0

5d553a823f12ef1f stream 0 0 0 5d553a823f12ee57 0 0

5d553a823f12f177 stream 0 0 0 5d553a823d073297 0 0

5d553a823d073297 stream 0 0 0 5d553a823f12f177 0 0

5d553a823d07380f stream 0 0 0 0 0 0

5d553a823d0738d7 stream 0 0 0 5d553a823d073a67 0 0

5d553a823d073a67 stream 0 0 0 5d553a823d0738d7 0 0

5d553a823d07399f stream 0 0 5d553a823e1b5927 0 0 0 /var/run/pppconfd

5d553a823d073bf7 stream 0 0 0 5d553a823d073b2f 0 0

5d553a823d073b2f stream 0 0 0 5d553a823d073bf7 0 0

5d553a823d073cbf stream 0 0 0 5d553a823d073d87 0 0

5d553a823d073d87 stream 0 0 0 5d553a823d073cbf 0 0

5d553a823d0740a7 stream 0 0 0 5d553a823d074237 0 0

5d553a823d074237 stream 0 0 0 5d553a823d0740a7 0 0

5d553a823d07416f stream 0 0 0 5d553a823d073fdf 0 0

5d553a823d073fdf stream 0 0 0 5d553a823d07416f 0 0

5d553a823d0742ff stream 0 0 0 5d553a823d0743c7 0 0

5d553a823d0743c7 stream 0 0 0 5d553a823d0742ff 0 0

5d553a823d07461f stream 0 0 0 5d553a823d07448f 0 0 /var/tmp/launchd/sock

5d553a823d07448f stream 0 0 0 5d553a823d07461f 0 0

5d553a823d0747af stream 0 0 0 5d553a823d074557 0 0

5d553a823d074557 stream 0 0 0 5d553a823d0747af 0 0

5d553a823d0746e7 stream 0 0 0 5d553a823d074877 0 0

5d553a823d074877 stream 0 0 0 5d553a823d0746e7 0 0

5d553a823d074a07 stream 0 0 0 5d553a823d07493f 0 0

5d553a823d07493f stream 0 0 0 5d553a823d074a07 0 0

5d553a823d074acf stream 0 0 0 5d553a823d074b97 0 0

5d553a823d074b97 stream 0 0 0 5d553a823d074acf 0 0

5d553a823d074c5f stream 0 0 0 5d553a823d074def 0 0 /var/tmp/launchd/sock

5d553a823d074def stream 0 0 0 5d553a823d074c5f 0 0

5d553a823d074d27 stream 0 0 0 5d553a823d075367 0 0

5d553a823d075367 stream 0 0 0 5d553a823d074d27 0 0

5d553a823d074f7f stream 0 0 0 5d553a823d074eb7 0 0

5d553a823d074eb7 stream 0 0 0 5d553a823d074f7f 0 0

5d553a823d075047 stream 0 0 0 5d553a823d07529f 0 0

5d553a823d07529f stream 0 0 0 5d553a823d075047 0 0

5d553a823d07510f stream 0 0 0 5d553a823d0751d7 0 0

5d553a823d0751d7 stream 0 0 0 5d553a823d07510f 0 0

5d553a823d0755bf stream 0 0 5d553a823dd2b837 0 0 0 /var/tmp/launchd/sock

5d553a823d075687 stream 0 0 5d553a823dd2ba17 0 0 0 /private/var/run/cupsd

5d553a823d07574f stream 0 0 5d553a823dd2bb07 0 0 0 /var/run/usbmuxd

5d553a823d075817 stream 0 0 5d553a823dd2bbf7 0 0 0 /var/run/systemkeychaincheck.socket

5d553a823d0759a7 stream 0 0 5d553a823dd2bdd7 0 0 0 /var/run/portmap.socket

5d553a823d075a6f stream 0 0 5d553a823dd2bec7 0 0 0 /var/run/vpncontrol.sock

5d553a823d075b37 stream 0 0 5d553a823dd2c197 0 0 0 /var/rpc/ncalrpc/wkssvc

5d553a823d075bff stream 0 0 5d553a823dd20297 0 0 0 /var/rpc/ncacn_np/wkssvc

5d553a823d075cc7 stream 0 0 5d553a823dd20387 0 0 0 /var/rpc/ncalrpc/srvsvc

5d553a823d075d8f stream 0 0 5d553a823dd20477 0 0 0 /var/rpc/ncacn_np/srvsvc

5d553a823d075e57 stream 0 0 5d553a823dd20567 0 0 0 /var/rpc/ncalrpc/NETLOGON

5d553a823d075f1f stream 0 0 5d553a823dd20657 0 0 0 /var/rpc/ncacn_np/mdssvc

5d553a823d075fe7 stream 0 0 5d553a823dd20747 0 0 0 /var/rpc/ncalrpc/lsarpc

5d553a823d076177 stream 0 0 5d553a823dd20927 0 0 0 /var/rpc/ncacn_np/lsarpc

5d553a823d0760af stream 0 0 5d553a823dd20bf7 0 0 0 /var/run/mDNSResponder

5d553a82415c4bf7 dgram 0 0 0 0 0 0

5d553a825903e6e7 dgram 0 0 0 5d553a828257c1d7 5d553a828257c1d7 0

5d553a828257c1d7 dgram 0 0 0 5d553a825903e6e7 5d553a825903e6e7 0

5d553a8241f475b7 dgram 0 0 0 5d553a825c1c4c5f 5d553a825c1c4c5f 0

5d553a825c1c4c5f dgram 0 0 0 5d553a8241f475b7 5d553a8241f475b7 0

5d553a825903fe57 dgram 0 0 0 5d553a823d0758df 0 5d553a823f1ad42f

5d553a82428a6eb7 dgram 0 0 0 5d553a825903d99f 5d553a825903d99f 0

5d553a825903d99f dgram 0 0 0 5d553a82428a6eb7 5d553a82428a6eb7 0

5d553a82428a6a07 dgram 0 0 0 5d553a825c1c542f 5d553a825c1c542f 0

5d553a825c1c542f dgram 0 0 0 5d553a82428a6a07 5d553a82428a6a07 0

5d553a82428a6557 dgram 0 0 0 5d553a82428a616f 5d553a82428a616f 0

5d553a82428a616f dgram 0 0 0 5d553a82428a6557 5d553a82428a6557 0

5d553a8243691cbf dgram 0 0 0 5d553a825903e237 5d553a825903e237 0

5d553a825903e237 dgram 0 0 0 5d553a8243691cbf 5d553a8243691cbf 0

5d553a82428a63c7 dgram 0 0 0 5d553a82428a6f7f 5d553a82428a6f7f 0

5d553a82428a6f7f dgram 0 0 0 5d553a82428a63c7 5d553a82428a63c7 0

5d553a82428a7b37 dgram 0 0 0 5d553a825c1c5b37 5d553a825c1c5b37 0

5d553a825c1c5b37 dgram 0 0 0 5d553a82428a7b37 5d553a82428a7b37 0

5d553a825c1c55bf dgram 0 0 0 5d553a82415c4cbf 5d553a82415c4cbf 0

5d553a82415c4cbf dgram 0 0 0 5d553a825c1c55bf 5d553a825c1c55bf 0

5d553a825c1c5817 dgram 0 0 0 5d553a82415c4427 5d553a82415c4427 0

5d553a82415c4427 dgram 0 0 0 5d553a825c1c5817 5d553a825c1c5817 0

5d553a82436918d7 dgram 0 0 0 5d553a823f12ecc7 5d553a823f12ecc7 0

5d553a823f12ecc7 dgram 0 0 0 5d553a82436918d7 5d553a82436918d7 0

5d553a823f238d87 dgram 0 0 0 5d553a8244996bf7 5d553a8244996bf7 0

5d553a8244996bf7 dgram 0 0 0 5d553a823f238d87 5d553a823f238d87 0

5d553a823f1ad42f dgram 0 0 0 5d553a823d0758df 0 5d553a8241f48acf

5d553a8244996e4f dgram 0 0 0 5d553a8244996f17 5d553a8244996f17 0

5d553a8244996f17 dgram 0 0 0 5d553a8244996e4f 5d553a8244996e4f 0

5d553a82449970a7 dgram 0 0 0 5d553a824499716f 5d553a824499716f 0

5d553a824499716f dgram 0 0 0 5d553a82449970a7 5d553a82449970a7 0

5d553a8244997877 dgram 0 0 0 5d553a824499793f 5d553a824499793f 0

5d553a824499793f dgram 0 0 0 5d553a8244997877 5d553a8244997877 0

5d553a8244998047 dgram 0 0 0 5d553a824499810f 5d553a824499810f 0

5d553a824499810f dgram 0 0 0 5d553a8244998047 5d553a8244998047 0

5d553a8243693b37 dgram 0 0 0 5d553a823f12df7f 5d553a823f12df7f 0

5d553a823f12df7f dgram 0 0 0 5d553a8243693b37 5d553a8243693b37 0

5d553a823f239eb7 dgram 0 0 0 5d553a8243691b2f 5d553a8243691b2f 0

5d553a8243691b2f dgram 0 0 0 5d553a823f239eb7 5d553a823f239eb7 0

5d553a8244998cc7 dgram 0 0 0 5d553a8244998bff 5d553a8244998bff 0

5d553a8244998bff dgram 0 0 0 5d553a8244998cc7 5d553a8244998cc7 0

5d553a823d0735b7 dgram 0 0 0 5d553a823d073427 5d553a823d073427 0

5d553a823d073427 dgram 0 0 0 5d553a823d0735b7 5d553a823d0735b7 0

5d553a8243691747 dgram 0 0 0 5d553a824369180f 5d553a824369180f 0

5d553a824369180f dgram 0 0 0 5d553a8243691747 5d553a8243691747 0

5d553a8241f48acf dgram 0 0 0 5d553a823d0758df 0 5d553a823f12d557

5d553a8241f49367 dgram 0 0 0 5d553a8241f494f7 5d553a8241f494f7 0

5d553a8241f494f7 dgram 0 0 0 5d553a8241f49367 5d553a8241f49367 0

5d553a82415c5237 dgram 0 0 0 5d553a82415c52ff 5d553a82415c52ff 0

5d553a82415c52ff dgram 0 0 0 5d553a82415c5237 5d553a82415c5237 0

5d553a82415c6f1f dgram 0 0 0 5d553a82415c6fe7 5d553a82415c6fe7 0

5d553a82415c6fe7 dgram 0 0 0 5d553a82415c6f1f 5d553a82415c6f1f 0

5d553a823f12e817 dgram 0 0 0 5d553a823f239b97 5d553a823f239b97 0

5d553a823f239b97 dgram 0 0 0 5d553a823f12e817 5d553a823f12e817 0

5d553a823f12d557 dgram 0 0 0 5d553a823d0758df 0 0

5d553a823f239877 dgram 0 0 0 5d553a823f23993f 5d553a823f23993f 0

5d553a823f23993f dgram 0 0 0 5d553a823f239877 5d553a823f239877 0

5d553a823f12c4ef dgram 0 0 0 5d553a823f12c67f 5d553a823f12c67f 0

5d553a823f12c67f dgram 0 0 0 5d553a823f12c4ef 5d553a823f12c4ef 0

5d553a823f12c747 dgram 0 0 0 5d553a823f1acdef 5d553a823f1acdef 0

5d553a823f1acdef dgram 0 0 0 5d553a823f12c747 5d553a823f12c747 0

5d553a823f12e9a7 dgram 0 0 0 5d553a823f1ac2ff 5d553a823f1ac2ff 0

5d553a823f1ac2ff dgram 0 0 0 5d553a823f12e9a7 5d553a823f12e9a7 0

5d553a823f1ab4ef dgram 0 0 0 5d553a823f23b177 5d553a823f23b177 0

5d553a823f23b177 dgram 0 0 0 5d553a823f1ab4ef 5d553a823f1ab4ef 0

5d553a823d073e4f dgram 0 0 0 5d553a823d073f17 5d553a823d073f17 0

5d553a823d073f17 dgram 0 0 0 5d553a823d073e4f 5d553a823d073e4f 0

5d553a823d0758df dgram 0 0 5d553a823dd2bce7 0 5d553a825903fe57 0 /var/run/syslog

Macbook Pro

Posted on Feb 20, 2014 1:49 AM

Reply

Answer 1

MichelPM

Level 10

80,958 points

Feb 20, 2014 2:16 AM in response to mbaris

I would completely uninstall Sophos Antivirus.

Antivirus apps have adverse performance effects on the normal operation of OS X.

http://www.sophos.com/en-us/support/knowledgebase/119182.aspx

Do you have any totally uneccesary "crapware" installed like Zeobit MacKeeper, CleanMyMac, TuneUpMyMac or the like installled?

Google software installled? Google apps, currently, do not play well with Mavericks.

Try using Mozilla FireFox, instead.

Update your third party device drivers.

Reply

Answer 2

mbaris Author

Level 1

16 points

Feb 20, 2014 2:12 AM in response to MichelPM

Zeobit MacKeeper: no

CleanMyMac:no

TuneUpMyMac:no

I use google apps via google chrome (gmail etc)

I am not aware of any other application I might have installed that might run hiddenly from the activity monitor.

What I really need is a way to see what pid(s) is(are) opening those numerous udp sockets, and what applications are connecting to those unknown ips using those strange ports

Reply

Answer 3

MichelPM

Level 10

80,958 points

Feb 20, 2014 2:21 AM in response to mbaris

I would completely uninstall Sophos Antivirus.

Antivirus apps have adverse performance effects on the normal operation of OS X, and is not really needed.

You'll see a performance difference when you uninstall this antivirus software and restart your Mac.

http://www.sophos.com/en-us/support/knowledgebase/119182.aspx

Reply

Answer 4

MichelPM

Level 10

80,958 points

Feb 20, 2014 2:21 AM in response to mbaris

It would help us to help you if we could have some more technical info about your iMac.

If you so wish, Please download, install and run Etrecheck.

Etrecheck was developed as a simple Mac diagnostic tool by a regular Apple Support forum user and technical support contributor named Etresoft.

Etrecheck is a small, unobstrusive app that compiles a static snapshot of your entire Mac hardware system and installed software.

This is a free app that has been honestly created to provided help in diagnosing issues with Macs running the new OS X 10.9 Mavericks.

It is not malware and can be safely downloaded and installed onto your Mac.

http://www.etresoft.com/etrecheck

Copy/paste and post its report here in another reply thread so that we have a complete profile of your Mac's hardware and installed software so we can all help with your Mac performance issues.

Reply

Answer 5

Linc Davis

Level 10

209,541 points

Feb 20, 2014 7:22 AM in response to mbaris

When you have the problem, note the exact time: hour, minute, second.

If you have more than one user account, these instructions must be carried out as an administrator.

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Console in the icon grid.

Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left. If you don't see that menu, select

View ▹ Show Log List

from the menu bar.

Each message in the log begins with the date and time when it was entered. Scroll back to the time you noted above. Select the messages entered from then until the end of the episode, or until they start to repeat, whichever comes first. Copy the messages to the Clipboard by pressing the key combination command-C. Paste into a reply to this message (command-V).

The log contains a vast amount of information, almost all of it useless for solving any particular problem. When posting a log extract, be selective. In most cases, a few dozen lines are more than enough. It is never necessary or helpful to post more than about 100 lines. "The more, the better" is not the rule here.

Please do not indiscriminately dump thousands of lines from the log into this discussion.

Important: Some private information, such as your name, may appear in the log. Anonymize before posting.

Reply

Answer 6

mbaris Author

Level 1

16 points

Feb 20, 2014 8:23 AM in response to Linc Davis

I see a possible time correlation with the following events. Is it possible that there might be more than one thing going wrong?

20/02/14 16:10:37,428 xpcproxy[20416]: assertion failed: 13B42: xpcproxy + 3438 [EE7817B0-1FA1-3603-B88A-BD5E595DA86F]: 0x2

20/02/14 16:16:07,340 WindowServer[85]: Received display connect changed for display 0x4280380

This is suspicious, I do not have external displays attached

20/02/14 16:16:07,340 WindowServer[85]: Received display connect changed for display 0x4280380

20/02/14 16:16:07,359 WindowServer[85]: Found 62 modes for display 0x04280380 [36, 26]

20/02/14 16:16:07,387 WindowServer[85]: Received display connect changed for display 0x3f003d

20/02/14 16:16:07,387 WindowServer[85]: Found 1 modes for display 0x003f003d [1, 0]

20/02/14 16:16:07,388 WindowServer[85]: Received display connect changed for display 0x3f003e

20/02/14 16:16:07,388 WindowServer[85]: Found 1 modes for display 0x003f003e [1, 0]

20/02/14 16:16:07,388 WindowServer[85]: Received display connect changed for display 0x3f003f

20/02/14 16:16:07,388 WindowServer[85]: Found 1 modes for display 0x003f003f [1, 0]

20/02/14 16:16:07,390 WindowServer[85]: CGXMuxAcknowledge: Posting glitchless acknowledge

20/02/14 16:16:07,394 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x573c requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,394 WindowServer[85]: CGXMoveWindow: Operation on a window 0x573c requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,394 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:07,395 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:07,395 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x573b requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,396 WindowServer[85]: CGXMoveWindow: Operation on a window 0x573b requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,396 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:07,396 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:07,397 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x5739 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,397 WindowServer[85]: CGXMoveWindow: Operation on a window 0x5739 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,397 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:07,397 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:07,398 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x5738 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,398 WindowServer[85]: CGXMoveWindow: Operation on a window 0x5738 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:07,398 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:07,398 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:07,406 WindowServer[85]: MPAccessSurfaceForDisplayDevice: Set up page flip mode on display 0x04280380 device: 0x7fc8b850b270 isBackBuffered: 1 numComp: 3 numDisp: 3

20/02/14 16:16:07,512 WindowServer[85]: Received display connect changed for display 0x4280380

20/02/14 16:16:07,512 WindowServer[85]: Found 1 modes for display 0x04280380 [1, 0]

20/02/14 16:16:16,058 WindowServer[85]: Received display connect changed for display 0x4280380

20/02/14 16:16:16,079 WindowServer[85]: Found 29 modes for display 0x04280380 [18, 11]

20/02/14 16:16:16,108 WindowServer[85]: CGXMuxAcknowledge: Posting glitchless acknowledge

20/02/14 16:16:16,113 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x573c requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,113 WindowServer[85]: CGXMoveWindow: Operation on a window 0x573c requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,113 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:16,114 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:16,115 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x573b requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,115 WindowServer[85]: CGXMoveWindow: Operation on a window 0x573b requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,115 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:16,115 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:16,116 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x5739 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,116 WindowServer[85]: CGXMoveWindow: Operation on a window 0x5739 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,117 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:16,117 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:16,118 WindowServer[85]: _CGXGetWindowMovementGroup: Operation on a window 0x5738 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,119 WindowServer[85]: CGXMoveWindow: Operation on a window 0x5738 requiring rights 0x5 by caller Dashboard

20/02/14 16:16:16,119 DashboardClient[18036]: CGSMoveWindowList

20/02/14 16:16:16,119 DashboardClient[18036]: _NXMoveWindow: error moving window (1001)

20/02/14 16:16:16,142 WindowServer[85]: MPAccessSurfaceForDisplayDevice: Set up page flip mode on display 0x04280380 device: 0x7fc8b850b270 isBackBuffered: 1 numComp: 3 numDisp: 3

20/02/14 16:16:16,194 WindowServer[85]: Received display connect changed for display 0x4280380

20/02/14 16:16:16,195 WindowServer[85]: Found 1 modes for display 0x04280380 [1, 0]

20/02/14 16:16:16,207 WindowServer[85]: Received display connect changed for display 0x3f003d

20/02/14 16:16:16,208 WindowServer[85]: Found 1 modes for display 0x003f003d [1, 0]

20/02/14 16:16:16,208 WindowServer[85]: Received display connect changed for display 0x3f003e

20/02/14 16:16:16,208 WindowServer[85]: Found 1 modes for display 0x003f003e [1, 0]

20/02/14 16:16:16,208 WindowServer[85]: Received display connect changed for display 0x3f003f

20/02/14 16:16:16,208 WindowServer[85]: Found 1 modes for display 0x003f003f [1, 0]

This is another culprit

20/02/14 17:03:40,943 Google Chrome Helper[20472]: Process unable to create connection because the sandbox denied the right to lookup com.apple.coreservices.launchservicesd and so this process cannot talk to launchservicesd. : LSXPCClient.cp #426 ___ZN26LSClientToServerConnection21setupServerConnectionEiPK14__CFDictionary_bl ock_invoke() q=com.apple.main-thread

20/02/14 17:03:40,943 Google Chrome Helper[20472]: Process unable to create connection because the sandbox denied the right to lookup com.apple.coreservices.launchservicesd and so this process cannot talk to launchservicesd.

20/02/14 17:06:08,419 Console[20477]: setPresentationOptions called with NSApplicationPresentationFullScreen when there is no visible fullscreen window; this call will be ignored.

20/02/14 17:08:46,000 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=20481[GoogleSoftwareUp] final status 0x0, allow (remove VALID)ing page

Reply

Answer 7

Linc Davis

Level 10

209,541 points

Feb 20, 2014 8:34 AM in response to mbaris

Back up all data.

This procedure will reset your Dashboard configuration to the default.

Please triple-click anywhere in the line below on this page to select it:

defaults delete com.apple.dashboard layer-gadgets && killall Dock

Copy the selected text to the Clipboard by pressing the key combination command-C.

Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.

Wait for a new line ending in a dollar sign ($) to appear below what you entered. You can then quit Terminal. Test.

Reply

Answer 8

mbaris Author

Level 1

16 points

Feb 21, 2014 2:07 AM in response to Linc Davis

At the moment, things seem to be okay, but I am still curious about those numerous UDP ports that are open, and what is that "display device" which is not a display. Is there a way to identify those.

Reply

Answer 9

Linc Davis

Level 10

209,541 points

Feb 21, 2014 7:02 AM in response to mbaris

sudo lsof -i4udp

Reply

Answer 10

mbaris Author

Level 1

16 points

Feb 24, 2014 2:45 AM in response to Linc Davis

The spinning wheel is still there, however not periodic anymore. Just comes and goes.

There might be a slight time correlation with the following event:

24/02/14 11:33:14,525 Console[5872]: setPresentationOptions called with NSApplicationPresentationFullScreen when there is no visible fullscreen window; this call will be ignored.

However, since the event is so short, I can not trace it manually.

Side info:

The UDP ports are airportd (so many of them!) ntpd, mDNSresponder, Skype, canon IJ scanner, eapolclie, netbios, SystemUIS, Userevent,launchd,internetS correspondingly.

Reply

Answer 11

Linc Davis

Level 10

209,541 points

Feb 24, 2014 10:27 AM in response to mbaris

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger on a public message board. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

Here's a summary of what you need to do, if you choose to proceed: Copy a line of text from this web page into the window of another application. Wait for the script to run. It usually takes a few minutes. Then paste the results, which will have been copied automatically, back into a reply on this page. The sequence is: copy, paste, wait, paste again. Details follow.

4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply.

6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"[$((l-25)) more line(s)]"; Pm "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$/d; s/^ */ /; s/[-0-9A-Fa-f]{22,}/UUID/g' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed '8!d;s/^ *//'; o=`SP Hardware | awk '/Mem/{print $2}'`; o=$((o<4?o:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^O]|x([^08]||0[^2]8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/{s/^.*://p;}' <<< "$p"`; Ps "Battery condition"; for b in Thunderbolt USB; do o=`SP $b | sed -En '1d;/:$/{s/ *:$//;x;s/\n//p;};/^ *V.* [0N].* /{s/ 0x.... //;s/[()]//g;s/(.*: )(.*)/ $\2$/;H;};/Apple|Genesy|SMSC/{s/.//g;h;}'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && e=\* || e=; echo $d ${f%_$d*} ${f##*.} "$e"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; [[ "$o" =~ \*$ ]] && printf $'\n* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'GPU |hfs: Ru|I/O e|last value [1-9]|n Cause: -|NVDA\(|pagin|SATA W|ssert|Thrott|timed? ?o' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | awk 'NR>1 && !/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|post[fg]|x)/{print $3}'`; Pm "Extrinsic daemons"; o=`launchctl list | awk 'NR>1 && !/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | grep -v com\.apple\.CSConfig | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/Star*; do M; done`; Pm "Startup items"; o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | while read d; do ID=$($PB\ :CFBundleIdentifier "$d/Info.plist") || ID="No bundle ID"; [[ "$ID" =~ ^com\.apple\.[^x]|Accusys|ArcMSR|ATTO|HDPro|HighPoint|driver\.stex|hp-fax|\.hpio|JMicron|microsoft\.MDI|print|SoftRAID ]] || printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; o=`find -L /u*/{,*/}lib -type f | while read f; do file -b "$f" | grep -qw shared && ! codesign -v "$f" && echo $f; done`; Pm "Unsigned shared libraries"; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Environment"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; Ps "DNS"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; Pc "hosts" <(grep -v 'host *$' /etc/hosts); Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l | sed -E 's:/Users/[^/]+/:/Users/USER/:g'); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. $ -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $ | wc -l`; Ps "Restricted user files"; cd; o=`SP Fonts | egrep "Valid: N|Duplicate: Y" | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps "UID"; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-

Copy the selected text to the Clipboard by pressing the key combination command-C.

7. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Click anywhere in the Terminal window and paste (command-V). The text you pasted should vanish immediately. If it doesn't, press the return key.

8. If you see an error message in the Terminal window such as "syntax error," enter

exec bash

and press return. Then paste the script again.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test will take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line "[Process completed]" to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

________________________________

Copyright © 2014 Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Terms of Use of Apple Support Communities ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 12

mbaris Author

Level 1

16 points

Feb 25, 2014 1:08 AM in response to Linc Davis

Thank you very much the script. It was really helpfull. There were no spinning wheels at the time (probably I was working with something else), but I noticed something as I write this reply, javascript (i.e. highlighted buttons in the editor) result in a spinning wheel the first time they are initiated. Nowadays I'm documenting my research in a web based datalog, and it might explain why I see this behaviour.

I've removed the hosts section, since it contains ip addresses of our compute clusters.

Boot Mode: Normal

USB

Hub (Intel Corporation)

Hub (Intel Corporation)

System diagnostics

2014-02-02 cloud-eventd,launchd,prl_event_tap,prl_naptd,Synology Cloud Stat_2014-01-31-090643_Gravitas-what-gravitas.shutdownStall shutdownStall

2014-02-05 bootpd,cloud-eventd,launchd,natpmpd,pcscd,rmiregistry,Synology C_2014-02-03-150356_Gravitas-what-gravitas.shutdownStall shutdownStall

2014-02-11 bootpd,cloud-eventd,CVMServer,dbfseventsd,dbfseventsd,launchd,na_2014-02-10-084 525_Gravitas-what-gravitas.shutdownStall shutdownStall

2014-02-11 client-mac,cloud-eventd,gamed,launchd,Synology Cloud Station_2014-02-10-221130_Gravitas-what-gravitas.shutdownStall shutdownStall

2014-02-11 cloud-eventd,gamed,launchd,locationd,Synology Cloud Station_2014-02-10-085922_Gravitas-what-gravitas.shutdownStall shutdownStall

2014-02-13 Kernel_2014-02-12-210728_Gravitas-what-gravitas.panic panic

2014-02-21 aosnotifyd,diskarbitrationd_2014-02-20-174453_Gravitas-what-gravitas.shutdownSt all shutdownStall

2014-02-21 client-mac,cloud-eventd,gamed,launchd,Synology Cloud Station_2014-02-20-174214_Gravitas-what-gravitas.shutdownStall shutdownStall

2014-02-21 cloud-eventd,CVMServer,gamed,InternetSharing,launchd,Synology Cl_2014-02-20-173906_Gravitas-what-gravitas.shutdownStall shutdownStall

User diagnostics

2014-01-30 Finder crash

2014-02-05 Installer_2014-02-03-110321_Gravitas-what-gravitas.crash crash

2014-02-07 Sony Ericsson Bridge Helper_2014-02-06-150341_Gravitas-what-gravitas.crash crash

2014-02-11 a.out_2014-02-10-143324_Gravitas-what-gravitas.crash crash

2014-02-11 pycharm_2014-02-10-112956_Gravitas-what-gravitas.crash crash

2014-02-11 pycharm_2014-02-10-113000_Gravitas-what-gravitas.crash crash

2014-02-11 pycharm_2014-02-10-113004_Gravitas-what-gravitas.crash crash

2014-02-14 Google Chrome_2014-02-13-161023_Gravitas-what-gravitas.crash crash

2014-02-16 iTunes_2014-02-14-133408_Gravitas-what-gravitas.crash crash

Kernel messages

Feb 20 17:38:00 Sound assertion in IOHDACodecDevice at line 144

Feb 20 17:38:00 Sound assertion in AppleHDANode at line 290

Feb 20 17:38:00 Sound assertion in AppleHDAFunctionGroup at line 1150

Feb 20 17:38:00 Sound assertion in AppleHDAFunctionGroup at line 1065

Feb 20 17:38:00 Sound assertion in AppleHDAFunctionGroup at line 1190

Feb 20 17:38:00 Sound assertion in AppleHDADriver at line 3381

Feb 20 17:38:00 Sound assertion in AppleHDADriver at line 3324

Feb 20 20:58:18 Sound assertion - Command/Response TIMED OUT and ( kRequestStateMatch == fCodecRequest->state = 2 ), fCodecRequest->command->codec: 0xffffff80527efa00, fCodecRequest->command->verb: 0x1F0500, fPoweredDown: 1, fAppleGraphicsControllerPoweredOn: 0

Feb 20 20:58:18 Sound assertion in AppleHDAController at line 5461

Feb 20 20:58:18 Sound assertion in IOHDACodecDevice at line 144

Feb 20 20:58:18 Sound assertion in AppleHDANode at line 290

Feb 20 20:58:18 Sound assertion in AppleHDAFunctionGroup at line 1150

Feb 20 20:58:18 Sound assertion in AppleHDAFunctionGroup at line 1065

Feb 20 20:58:18 Sound assertion in AppleHDAFunctionGroup at line 1190

Feb 20 20:58:18 Sound assertion in AppleHDADriver at line 3381

Feb 20 20:58:18 Sound assertion in AppleHDADriver at line 3324

Feb 21 16:58:12 MacAuthEvent en0 Auth result for: f8:c0:01:a8:74:40 Auth timed out

Feb 24 09:04:01 IOPPF: Sent cpu-plimit-notification last value 1 (rounded time weighted average 1)

Feb 24 09:04:01 IOPPF: Sent cpu-plimit-notification last value 29 (rounded time weighted average 29)

Feb 24 09:04:01 IOPPF: Sent gpu-external-plimit-notification last value 15 (rounded time weighted average 15)

Feb 24 09:04:01 IOPPF: Sent gpu-internal-plimit-notification last value 14 (rounded time weighted average 14)

Feb 24 09:04:07 MacAuthEvent en0 Auth result for: f8:c0:01:a8:e5:83 Auth timed out

Feb 24 10:53:30 MacAuthEvent en0 Auth result for: f8:c0:01:a8:e5:81 Auth timed out

Feb 25 08:37:10 IOPPF: Sent cpu-plimit-notification last value 1 (rounded time weighted average 1)

Feb 25 08:37:15 MacAuthEvent en0 Auth result for: f8:c0:01:a8:e5:81 Auth timed out

Loaded extrinsic kernel extensions

com.madcatz.driver.CyborgRAT (1.62)

Extrinsic daemons

org.macosforge.xquartz.privileged_startx

com.microsoft.office.licensing.helper

com.google.keystone.daemon

com.adobe.SwitchBoard

com.adobe.fpsaud

Extrinsic agents

com.google.GoogleTalkPluginD.69024.UUID

org.macosforge.xquartz.startx

com.MadCatz.SmartTechnology

com.google.keystone.system.agent

com.vladalexa.MagicPrefs

com.valvesoftware.steamclean

com.synology.Synology

com.google.GoogleContactSyncAgent

com.adobe.ARM.UUID

launchd items

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

(com.adobe.AAM.Startup-1.0)

/Library/LaunchAgents/com.google.keystone.agent.plist

(com.google.keystone.system.agent)

/Library/LaunchAgents/com.MadCatz.MadCatzSmartTechnology.plist

(com.MadCatz.SmartTechnology)

/Library/LaunchAgents/org.macosforge.xquartz.startx.plist

(org.macosforge.xquartz.startx)

/Library/LaunchDaemons/com.adobe.fpsaud.plist

(com.adobe.fpsaud)

/Library/LaunchDaemons/com.adobe.SwitchBoard.plist

(com.adobe.SwitchBoard)

/Library/LaunchDaemons/com.google.keystone.daemon.plist

(com.google.keystone.daemon)

/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

(com.microsoft.office.licensing.helper)

/Library/LaunchDaemons/org.macosforge.xquartz.privileged_startx.plist

(org.macosforge.xquartz.privileged_startx)

Library/LaunchAgents/com.adobe.ARM.UUID.plist

(com.adobe.ARM.UUID)

Library/LaunchAgents/com.google.GoogleContactSyncAgent.plist

(com.google.GoogleContactSyncAgent)

Library/LaunchAgents/com.valvesoftware.steamclean.plist

(com.valvesoftware.steamclean)

Library/LaunchAgents/com.vladalexa.MagicPrefs.plist

(com.vladalexa.MagicPrefs)

Startup items

/Library/StartupItems/Fantom/Fantom

/Library/StartupItems/Fantom/StartupParameters.plist

Extrinsic loadable bundles

/System/Library/Extensions/CyborgRAT.kext

(com.madcatz.driver.CyborgRAT)

/System/Library/Extensions/Fantom.kext

(com.ni.Fantom.nxtfwdl)

/System/Library/Extensions/ssuddrv.kext

(com.devguru.driver.SamsungComposite)

/System/Library/Extensions/UsbEthernetGadget.kext

(com.tomtom.driver.UsbEthernetGadget)

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

(com.adobe.acrobat.pdfviewer)

/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

(com.adobe.acrobat.pdfviewerNPAPI)

/Library/Internet Plug-Ins/EPPEX Plugin.plugin

(jp.co.canon.EPPEX Plugin)

/Library/Internet Plug-Ins/Flash Player.plugin

(com.macromedia.Flash Player.plugin)

/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin

(com.google.googletalkbrowserplugin)

/Library/Internet Plug-Ins/net.juniper.DSSafariExtensions.plugin

(net.juniper.DSSafariExtensions.plugin)

/Library/Internet Plug-Ins/npgtpo3dautoplugin.plugin

(com.google.o3d)

/Library/Internet Plug-Ins/o1dbrowserplugin.plugin

(com.google.o1dbrowserplugin)

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

(com.microsoft.sharepoint.browserplugin)

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

(com.microsoft.sharepoint.webkitplugin)

/Library/Internet Plug-Ins/Silverlight.plugin

(com.microsoft.SilverlightPlugin)

/Library/PreferencePanes/Flash Player.prefPane

(com.adobe.flashplayerpreferences)

/Library/PreferencePanes/MadCatzRAT.prefPane

(com.madcatz.prefPane.MadCatz)

/Library/PreferencePanes/MenuMeters.prefPane

(com.ragingmenace.MenuMeters)

/Library/PreferencePanes/TeXDistPrefPane.prefPane

(comp.text.tex.distribution.preference)

/Library/ScriptingAdditions/Adobe Unit Types.osax

(No bundle ID)

/Library/ScriptingAdditions/SynoSIMBL.osax

(net.culater.SynoSIMBL.osax)

Library/Address Book Plug-Ins/SkypeABDialer.bundle

(com.skype.skypeabdialer)

Library/Address Book Plug-Ins/SkypeABSMS.bundle

(com.skype.skypeabsms)

Library/PreferencePanes/MagicPrefs.prefPane

(com.vladalexa.MagicPrefs)

Library/Services/ENService.app

(com.ThomsonResearchSoft.EndNote.ENService)

Library/Spotlight/EndNote.mdimporter

(com.ThomsonResearchSoft.EndNote)

Unsigned shared libraries

/usr/lib/libdvdcss.2.dylib

/usr/lib/libtcl.dylib

/usr/lib/libtcl8.5.dylib

/usr/lib/libtk.dylib

/usr/lib/libtk8.5.dylib

/usr/local/lib/libfuse.0.dylib

/usr/local/lib/libfuse.2.dylib

/usr/local/lib/libfuse.dylib

/usr/local/lib/libfuse_ino64.2.dylib

/usr/local/lib/libfuse_ino64.dylib

/usr/local/lib/libinchi.0.3.1.dylib

/usr/local/lib/libinchi.0.dylib

/usr/local/lib/libinchi.dylib

/usr/local/lib/libmacfuse_i32.2.dylib

/usr/local/lib/libmacfuse_i32.dylib

/usr/local/lib/libmacfuse_i64.2.dylib

/usr/local/lib/libmacfuse_i64.dylib

/usr/local/lib/libopenbabel.4.0.1.dylib

/usr/local/lib/libopenbabel.4.dylib

/usr/local/lib/libopenbabel.dylib

/usr/local/lib/libosxfuse.2.7.3.dylib

/usr/local/lib/libosxfuse.2.dylib

/usr/local/lib/libosxfuse.dylib

/usr/local/lib/libosxfuse_i32.2.7.3.dylib

/usr/local/lib/libosxfuse_i32.2.dylib

/usr/local/lib/libosxfuse_i32.dylib

/usr/local/lib/libosxfuse_i64.2.7.3.dylib

/usr/local/lib/libosxfuse_i64.2.dylib

/usr/local/lib/libosxfuse_i64.dylib

Proxies

ProxyAutoConfigEnable : 1

ProxyAutoConfigURLString : http://wpad/wpad.dat

ProxyAutoDiscoveryEnable : 1

User login items

iTunesHelper.app

Canon IJ Network Scanner Selector EX.app

Sony Ericsson Bridge Helper.app

KiesAgent

fuspredownloader.app

Safari extensions

OpenIE

Restricted user files: 7188

Font problems: 45

Elapsed time (s): 165

Reply

Answer 13

Linc Davis

Level 10

209,541 points

Feb 25, 2014 10:08 AM in response to mbaris

Your system is heavily modified by third-party software, but before you undertake the difficult task of troubleshooting that, I suggest you take the steps below. They may or may not be enough to solve the problem.

Some of your user files (not system files) have incorrect permissions or are locked. This procedure will unlock all your user files, reset their ownership, and remove their access-control lists. If you've set special values for those attributes, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it.

Back up all data.

Step 1

If you have more than one user account, and the one in question is not an administrator account, then temporarily promote it to administrator status in the Users & Groups preference pane. To do that, unlock the preference pane using the credentials of an administrator, check the box marked

Allow user to administer this computer

Then reboot. You can demote the problem account back to standard status when this step has been completed.

Enter the following command in the Terminal window in the same way as before (triple-click, copy, and paste):

{ sudo chflags -R nouchg,nouappnd ~ $TMPDIR..; sudo chown -R $UID:staff ~ $_; sudo chmod -R u+rwX ~ $_; chmod -R -N ~ $_; } 2>&-

This time you'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.

The command may take several minutes to run, depending on how many files you have. Wait for a new line ending in a dollar sign ($) to appear, then quit Terminal.

Step 2 (optional)

Take this step only if you have trouble with Step 1, if you prefer not to take it, or if it doesn't solve the problem.

Boot into Recovery. When the OS X Utilities screen appears, select

Utilities ▹ Terminal

from the menu bar. A Terminal window will open. In that window, type this:

res

Press the tab key. The partial command you typed will automatically be completed to this:

resetpassword

Press return. A Reset Password window will open. You’re not going to reset a password.

Select your startup volume ("Macintosh HD," unless you gave it a different name) if not already selected.

Select your username from the menu labeled Select the user account if not already selected.

Under Reset Home Directory Permissions and ACLs, click the Reset button.

Select

 ▹ Restart

from the menu bar.

Reply

Answer 14

mbaris Author

Level 1

16 points

Mar 7, 2014 12:39 AM in response to Linc Davis

Sorry for the late reply,

Things got worse for me, most probably irraleted to your last sugestion.

I use the dock on the right hand side, with autohide. Randomly, it refused to appear. Also the finder stoped responsing from time to time.

Also randomly, the mouse stopped responding to clicks etc.

I suspect something low level, a kext or etc was causing all these, and I suspect a few programs, but I don't know how to remove them and their modifications to the system.

I think I'll format and reinstall the OsX. It will be a shame to install all those programs I have from the scratch.

Reply