Recently in Safari I am seeing an ad showing in the lower left corner. I'm wondering about possible malware but don't know how to fix it. Also I use AOL Mail and am unable to get it to load in Safari. All other sites load ust fine. I have checked all my extensions as well as tried reseting Safari with no luck.
iMac, OS X Mavericks (10.9.1)
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Turn all extensions OFF and test. If the problem is resolved, turn extensions back ON and then disable them one or a few at a time until you find the culprit.
Still no change.
1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger on a public message board. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed: Copy a line of text from this web page into the window of another application. Wait for the script to run. It usually takes a few minutes. Then paste the results, which will have been copied automatically, back into a reply on this page. The sequence is: copy, paste, wait, paste again. Details follow.
4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; AC="com.autodesk.AutoCAD"; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"[$((l-25)) more line(s)]"; Pm "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$/d; s/^ */ /; s/[-0-9A-Fa-f]{22,}/UUID/g' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed '8!d;s/^ *//'; h=(`SP Hardware | awk '/ Id/{print $3}; /Mem/{print $2}'`); o=$h; Ps "Model"; o=$((h[1]<4?h[1]:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^O]|x([^08]||0[^2]8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/{s/^.*://p;}' <<< "$p"`; Ps "Battery condition"; for b in Thunderbolt USB; do o=`SP $b | sed -En '1d;/:$/{s/ *:$//;x;s/\n//p;};/^ *V.* [0N].* /{s/ 0x.... //;s/[()]//g;s/(.*: )(.*)/ \(\2\)/;H;};/Apple|Genesy|Intel|SMSC/{s/.//g;h;}'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && f="$f *"; echo "$d ${f%%_2*} ${f##*.}"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; grep -q '*$' <<< "$o" && printf $'\n* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'GPU |hfs: Ru|I/O e|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|SATA W|ssert|Thrott|timed? ?o' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | awk 'NR>1 && !/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|post[fg]|x)/{print $3}'`; Pm "Extrinsic daemons"; o=`launchctl list | awk 'NR>1 && !/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | grep -v com\.apple\.CSConfig | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/Star*; do M; done`; Pm "Startup items"; o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | while read d; do ID=$($PB\ :CFBundleIdentifier "$d/Info.plist") || ID="No bundle ID"; [[ "$ID" =~ ^com\.apple\.[^x]|Accusys|ArcMSR|ATTO|HDPro|HighPoint|driver\.stex|hp-fax|\.hpio|JMicron|microsoft\.MDI|print|SoftRAID ]] || printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; LD="$(`find /S*/*/F* -type f -name lsregister | head -n1` -dump)"; o=`for ID in $AC; do [[ "$LD" =~ $ID ]] && echo $ID; done`; Pm "Application check"; o=`find -L /u*/{,*/}lib -type f | while read f; do file -b "$f" | grep -qw shared && ! codesign -v "$f" && echo $f; done`; Pm "Unsigned shared libraries"; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Environment"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; d=`ipconfig getoption $(route -n get default | awk '/e:/{print $2}') domain_name_server`; [[ "$d" != "$o" ]] && n="not " || n=; Ps "DNS (${n}from DHCP)"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; Pc "hosts" <(grep -v 'host *$' /etc/hosts); Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l | sed -E 's:/Users/[^/]+/:/Users/USER/:g'); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \) | wc -l`; Ps "Restricted user files"; cd; o=`SP Fonts | egrep "Valid: N|Duplicate: Y" | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps "UID"; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-
7. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste (command-V). The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "syntax error," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test will take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line "[Process completed]" to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
________________________________
Boot Mode: Normal
Model: MacBookPro10,2
System diagnostics
2014-03-01 firefox spin
2014-03-01 firefox spin
2014-03-02 Norton AntiVirus spin
2014-03-02 SymDaemon spin
2014-03-02 SymDaemon spin
2014-03-02 dbfseventsd,dbfseventsd,diskarbitrationd,HWNetCfg,HWPortCfg,HWPo shutdownStall
2014-03-02 firefox spin
2014-03-02 firefox spin
2014-03-02 firefox spin
2014-03-02 firefox spin
User diagnostics
2014-02-02 Finder crash *
2014-02-08 SIMBL Agent crash
2014-02-10 SIMBL Agent crash
2014-02-12 SIMBL Agent crash
2014-02-22 LogMeIn Hamachi Menubar crash
2014-02-22 SIMBL Agent crash
2014-03-01 LogMeIn Hamachi Menubar crash
* Code injection
Kernel messages
Feb 24 18:10:18 IOPPF: Sent cpu-plimit-notification last value 18 (rounded time weighted average 17)
Feb 24 18:10:18 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 18:10:32 IOPPF: Sent cpu-plimit-notification last value 18 (rounded time weighted average 19)
Feb 24 18:10:32 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 18:10:54 IOPPF: Sent cpu-plimit-notification last value 18 (rounded time weighted average 18)
Feb 24 18:10:54 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 18:11:06 IOPPF: Sent cpu-plimit-notification last value 20 (rounded time weighted average 19)
Feb 24 18:11:06 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 18:11:20 IOPPF: Sent cpu-plimit-notification last value 20 (rounded time weighted average 20)
Feb 24 18:11:20 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 18:11:37 IOPPF: Sent cpu-plimit-notification last value 19 (rounded time weighted average 19)
Feb 24 18:11:37 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 18:11:48 IOPPF: Sent cpu-plimit-notification last value 20 (rounded time weighted average 20)
Feb 24 18:11:48 IOPPF: Sent gpu-internal-plimit-notification last value 7 (rounded time weighted average 7)
Feb 24 19:33:01 MacAuthEvent en0 Auth result for: 00:1a:1e:91:08:b2 Auth timed out
Feb 24 19:51:31 PM notification timeout (pid 3946, Messages)
--- last message repeated 1 time ---
Feb 28 17:34:32 Process Setup Assistant [239] disabling system-wide I/O Throttling
Feb 28 17:34:32 Process Setup Assistant [239] disabling system-wide CPU Throttling
Feb 28 17:49:13 PM notification timeout (pid 455, Creative Cloud)
Feb 28 17:49:13 PM notification timeout (pid 519, Adobe CEF Helper)
Feb 28 17:49:13 PM notification timeout (pid 526, Adobe CEF Helper)
Mar 1 23:54:20 MacAuthEvent en0 Auth result for: 00:1a:1e:91:08:b2 Auth timed out
Mar 2 15:44:17 PM notification timeout (pid 209, Finder)
--- last message repeated 1 time ---
Total CPU usage: user 34%, system 3%
CPU usage by process "MacScan" with UID 502: 100.4%
Loaded extrinsic kernel extensions
com.symantec.kext.internetSecurity (5.3.1f8)
com.symantec.kext.ips (3.9.1f9)
org.virtualbox.kext.VBoxDrv (4.0.8)
org.virtualbox.kext.VBoxUSB (4.0.8)
com.Cycling74.driver.Soundflower (1.6.6)
com.logmein.hamachi (1.0)
com.symantec.kext.SymAPComm (12.6.1f9)
Extrinsic daemons
scManagerD
org.macosforge.xquartz.privileged_startx
com.openbase.com.openexec
net.sourceforge.MonolingualHelper
com.symantec.symdaemon
com.symantec.sharedsettings
com.symantec.liveupdate.daemon
com.symantec.liveupdate.daemon.ondemand
com.symantec.errorreporting.periodic
com.parallels.mobile.kextloader.launchdaemon
com.parallels.mobile.dispatcher.launchdaemon
com.microsoft.office.licensing.helper
com.micromat.TechToolProDaemon
com.machangout.glims.loader
com.luthresearch.scservice
com.logmein.hamachi
com.google.keystone.daemon
com.cocoatech.pathfinder.SMFHelper7
com.cloudpath.maccmd
com.adobe.fpsaud
Extrinsic agents
com.flexibits.chatology.helper
N4RA379GBW.com.busymac.busycal2.alarm
scClient
org.macosforge.xquartz.startx
net.culater.SIMBL.Agent
com.symantec.uiagent.application
com.symantec.errorreporting.periodic-agent
com.parallels.mobile.startgui.launchagent
com.parallels.mobile.prl_deskctl_agent.launchagent
com.netopia.timbuktu.pro.host
com.micromat.TechToolProAgent
com.machangout.glims.agent
com.luthresearch.savvyconnectmenu
com.logmein.hamachimb
com.hp.help.tocgenerator
com.google.keystone.system.agent
com.adobe.AdobeCreativeCloud
net.infinite-labs.SIMBLEnablerForSandboxedApps
com.adobe.ARM.UUID
com.adobe.ARM.UUID
launchd items
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist
(com.adobe.AdobeCreativeCloud)
/Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.system.agent)
/Library/LaunchAgents/com.hp.help.tocgenerator.plist
(com.hp.help.tocgenerator)
/Library/LaunchAgents/com.logmein.hamachimb.plist
(com.logmein.hamachimb)
/Library/LaunchAgents/com.luthresearch.savvyconnectmenu.plist
(com.luthresearch.savvyconnectmenu)
/Library/LaunchAgents/com.machangout.glims.agent.plist
(com.machangout.glims.agent)
/Library/LaunchAgents/com.micromat.TechToolProAgent.plist
(com.micromat.TechToolProAgent)
/Library/LaunchAgents/com.netopia.timbuktu.pro.host.plist
(com.netopia.timbuktu.pro.host)
/Library/LaunchAgents/com.parallels.mobile.prl_deskctl_agent.launchagent.plist
(com.parallels.mobile.prl_deskctl_agent.launchagent)
/Library/LaunchAgents/com.parallels.mobile.startgui.launchagent.plist
(com.parallels.mobile.startgui.launchagent)
/Library/LaunchAgents/com.symantec.errorreporter-periodicagent.plist
(com.symantec.errorreporting.periodic-agent)
/Library/LaunchAgents/com.symantec.uiagent.application.plist
(com.symantec.uiagent.application)
/Library/LaunchAgents/com.teamviewer.teamviewer.plist
(com.teamviewer.teamviewer)
/Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist
(com.teamviewer.desktop)
/Library/LaunchAgents/net.culater.SIMBL.Agent.plist
(net.culater.SIMBL.Agent)
/Library/LaunchAgents/org.macosforge.xquartz.startx.plist
(org.macosforge.xquartz.startx)
/Library/LaunchAgents/Safe.Connect.client.plist
(scClient)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.apple.third_party_32b_kext_logger.plist
(com.apple.third_party_32b_kext_logger)
/Library/LaunchDaemons/com.cloudpath.maccmd.plist
(com.cloudpath.maccmd)
/Library/LaunchDaemons/com.cocoatech.pathfinder.SMFHelper7.plist
(com.cocoatech.pathfinder.SMFHelper7)
/Library/LaunchDaemons/com.google.keystone.daemon.plist
(com.google.keystone.daemon)
/Library/LaunchDaemons/com.logmein.hamachi.plist
(com.logmein.hamachi)
/Library/LaunchDaemons/com.luthresearch.scservice.plist
(com.luthresearch.scservice)
/Library/LaunchDaemons/com.machangout.glims.loader.plist
(com.machangout.glims.loader)
/Library/LaunchDaemons/com.micromat.TechToolProDaemon.plist
(com.micromat.TechToolProDaemon)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.parallels.mobile.dispatcher.launchdaemon.plist
(com.parallels.mobile.dispatcher.launchdaemon)
/Library/LaunchDaemons/com.parallels.mobile.kextloader.launchdaemon.plist
(com.parallels.mobile.kextloader.launchdaemon)
/Library/LaunchDaemons/com.symantec.errorreporter-periodic.plist
(com.symantec.errorreporting.periodic)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.ondemand.plist
(com.symantec.liveupdate.daemon.ondemand)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.plist
(com.symantec.liveupdate.daemon)
/Library/LaunchDaemons/com.symantec.nav.migrateqtf.plist
(com.symantec.nav.migrateqtf)
/Library/LaunchDaemons/com.symantec.sharedsettings.plist
(com.symantec.sharedsettings)
/Library/LaunchDaemons/com.symantec.symdaemon.plist
(com.symantec.symdaemon)
/Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist
(com.teamviewer.service)
/Library/LaunchDaemons/net.sourceforge.MonolingualHelper.plist
(net.sourceforge.MonolingualHelper)
/Library/LaunchDaemons/openbase.plist
(com.openbase.com.openexec)
/Library/LaunchDaemons/org.macosforge.xquartz.privileged_startx.plist
(org.macosforge.xquartz.privileged_startx)
/Library/LaunchDaemons/Safe.Connect.plist
(scManagerD)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.apple.SafariBookmarksSyncer.plist
(com.apple.Safari)
Library/LaunchAgents/net.infinite-labs.SIMBLEnablerForSandboxedApps.plist
(net.infinite-labs.SIMBLEnablerForSandboxedApps)
Startup items
/Library/StartupItems/HP Trap Monitor/HP Trap Monitor
/Library/StartupItems/HP Trap Monitor/Resources/English.lproj/Localizable.strings
/Library/StartupItems/HP Trap Monitor/StartupParameters.plist
/Library/StartupItems/HWNetMgr/HWNetCfg
/Library/StartupItems/HWNetMgr/HWNetMgr
/Library/StartupItems/HWPortDetect/HWPortCfg
/Library/StartupItems/HWPortDetect/HWPortDetect
/Library/StartupItems/HWPortDetect/StartupParameters.plist
/Library/StartupItems/TiVoDesktop/TiVoDesktop
/Library/StartupItems/VirtualBox/Resources/English.lproj/Localizable.strings
/Library/StartupItems/VirtualBox/VirtualBox
/Library/StartupItems(Disabled)/NUDC/NUDC
/Library/StartupItems(Disabled)/NUDC/nudcd
/Library/StartupItems(Disabled)/NUDC/quickdayd.app/Contents/Info.plist
/Library/StartupItems(Disabled)/NUDC/quickdayd.app/Contents/MacOS/quickdayd
/Library/StartupItems(Disabled)/NUDC/Resources/English.lproj/Localizable.string s
/Library/StartupItems(Disabled)/NUDC/StartupParameters.plist
Extrinsic loadable bundles
/System/Library/Extensions/BJUSBMP.kext
(jp.co.canon.bj.kext.BJUSBMP)
/System/Library/Extensions/com.aol.net.ppp
(com.aol.net.ppp)
/System/Library/Extensions/EyeTVAfaTechHidBlock.kext
(com.elgato.driver.DontMatchAfaTech)
/System/Library/Extensions/EyeTVCinergy450AudioBlock.kext
(com.elgato.driver.DontMatchCinergy450)
/System/Library/Extensions/EyeTVCinergyXSAudioBlock.kext
(com.elgato.driver.DontMatchCinergyXS)
/System/Library/Extensions/EyeTVEmpiaAudioBlock.kext
(com.elgato.driver.DontMatchEmpia)
/System/Library/Extensions/EyeTVVoyagerAudioBlock.kext
(com.elgato.driver.DontMatchVoyager)
/System/Library/Extensions/HuaweiDataCardDriver.kext
(com.huawei.driver.HuaweiDataCardDriver)
/System/Library/Extensions/Lexmark X422.kext
(com.lexmark.iokit.x422scanner)
/System/Library/Extensions/Soundflower.kext
(com.Cycling74.driver.Soundflower)
/System/Library/Extensions/SymInternetSecurity.kext
(com.symantec.kext.internetSecurity)
/System/Library/Extensions/SymIPS.kext
(com.symantec.kext.ips)
/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
(info.emagic.driver.unitor)
/Library/Audio/Plug-Ins/Components/A52Codec.component
(com.shepmater.A52Codec)
/Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component
(net.telestream.wmv.import)
/Library/Extensions/ham.kext
(com.logmein.hamachi)
/Library/Extensions/SymAPComm.kext
(com.symantec.kext.SymAPComm)
/Library/Extensions/SymInternetSecurity.kext
(com.symantec.kext.internetSecurity)
/Library/Extensions/SymIPS.kext
(com.symantec.kext.ips)
/Library/Extensions/VBoxDrv.kext
(org.virtualbox.kext.VBoxDrv)
/Library/Extensions/VBoxNetAdp.kext
(org.virtualbox.kext.VBoxNetAdp)
/Library/Extensions/VBoxNetFlt.kext
(org.virtualbox.kext.VBoxNetFlt)
/Library/Extensions/VBoxUSB.kext
(org.virtualbox.kext.VBoxUSB)
/Library/Input Methods/ParallelsIM.app
(com.parallels.inputmethod.ParallelsIM)
/Library/InputManagers/Menu Extra Enabler/Menu Extra Enabler.bundle
(com.unsanity.menuextraenabler)
/Library/InputManagers/Safari AdBlock/Safari AdBlock Loader.bundle
(net.sourceforge.SafariAdBlockLoader)
/Library/Internet Plug-Ins/AdobeAAMDetect.plugin
(com.AdobeAAMDetectLib.AdobeAAMDetect)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
(com.adobe.acrobat.pdfviewerNPAPI)
/Library/Internet Plug-Ins/DirectorShockwave.plugin
(com.adobe.director_12_0.shockwave.pluginshim)
/Library/Internet Plug-Ins/DivXBrowserPlugin.plugin
(com.divx.DivXBrowserPlugin)
/Library/Internet Plug-Ins/DRM Plugin.bundle
(com.microsoft.DRMPlugin)
/Library/Internet Plug-Ins/Flash Player.plugin
(com.macromedia.Flash Player.plugin)
/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
(net.telestream.wmv.plugin)
/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
(com.google.googletalkbrowserplugin)
/Library/Internet Plug-Ins/LogMeIn.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeIn.plugin/LogMeInPluginHost.app
(com.logmein.logmeinpluginhost)
/Library/Internet Plug-Ins/LogMeInSafari32.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/net.juniper.DSSafariExtensions.plugin
(net.juniper.DSSafariExtensions.plugin)
/Library/Internet Plug-Ins/npgtpo3dautoplugin.plugin
(com.google.o3d)
/Library/Internet Plug-Ins/o1dbrowserplugin.plugin
(com.google.o1dbrowserplugin)
/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin
(com.microsoft.officelive.browserplugin)
/Library/Internet Plug-Ins/RealPlayer Plugin.plugin
(com.RealNetworks.RealPlayerPlugin)
/Library/Internet Plug-Ins/RhapsodyPlayerEngine.plugin
(com.RealNetworks.RhapsodyPlayerEngine)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/Internet Plug-Ins/Unity Web Player.plugin
(com.unity.UnityWebPlayer)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Flip4Mac WMV.prefPane
(net.telestream.wmv.prefpane)
/Library/PreferencePanes/OSXFUSE.prefPane
(com.github.osxfuse.OSXFUSEPrefPane)
/Library/PreferencePanes/Perian.prefPane
(org.perian.PerianPane)
/Library/PreferencePanes/SymantecQuickMenu.prefPane
(com.symantec.quickmenu.prefpane)
/Library/PreferencePanes/TechTool Protection.prefPane
(com.micromat.TechToolProProtection)
/Library/PreferencePanes/Xmarks.prefPane
(com.xmarks.safariprefs)
/Library/QuickTime/AC3MovieImport.component
(com.cod3r.ac3movieimport)
/Library/QuickTime/EyeTV MPEG Support.component
(com.elgato.mpegsupport)
/Library/QuickTime/Flip4Mac WMV Advanced.component
(net.telestream.wmv.advanced)
/Library/QuickTime/Flip4Mac WMV Export.component
(net.telestream.wmv.export)
/Library/QuickTime/Flip4Mac WMV Import.component
(net.telestream.wmv.import)
/Library/QuickTime/FLV.component
(com.macromedia.FLVExporter)
/Library/QuickTime/Perian.component
(org.perian.Perian)
/Library/ScriptingAdditions/24U Appearance OSAX.osax
(com.24u.appearanceosax)
/Library/ScriptingAdditions/Adobe Unit Types.osax
(No bundle ID)
/Library/ScriptingAdditions/Glims.osax
(com.machangout.glims.osax)
/Library/ScriptingAdditions/SIMBL.osax
(net.culater.SIMBL.osax)
/Library/ScriptingAdditions/XtraFinder.osax
(com.trankynam.XtraFinder)
/Library/Services/Capture Screen to Facebook.workflow
(No bundle ID)
/Library/Services/Capture Selection to Facebook.workflow
(No bundle ID)
/Library/Services/Capture Window to Facebook.workflow
(No bundle ID)
/Library/Services/Facebook • Share Link on Clipboard.workflow
(No bundle ID)
/Library/Services/Facebook • Share Selected URL.workflow
(No bundle ID)
/Library/Services/Image • Upload to Facebook.workflow
(No bundle ID)
/Library/Services/MappingService.service
(com.mac.rjsdev.MappingService)
/Library/Spotlight/iWeb.mdimporter
(No bundle ID)
/Library/Spotlight/Microsoft Entourage.mdimporter
(com.microsoft.entourageMDImporter)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
(com.Google.GoogleEarthPlugin.plugin)
Library/PreferencePanes/AppTrap.prefPane
(se.konstochvanligasaker.AppTrap.prefpanel)
Library/PreferencePanes/BTTPrefs.prefPane
(com.hegenberg.bttprefs)
Library/ScriptingAdditions/SIMBL.osax
(Bitcasa.SIMBL.osax)
Library/Services/Add Reminder.workflow
(No bundle ID)
Unsigned shared libraries
/usr/lib/libgimpprint.7.0.0.dylib
/usr/lib/libgimpprint.7.dylib
/usr/lib/libgimpprint.dylib
/usr/lib/libtcl.dylib
/usr/lib/libtcl8.5.dylib
/usr/lib/libtk.dylib
/usr/lib/libtk8.5.dylib
/usr/local/lib/audacity/libmp3lame.dylib
/usr/local/lib/libecomlodr.dylib
/usr/local/lib/libfuse.0.dylib
/usr/local/lib/libfuse.2.7.3.dylib
/usr/local/lib/libfuse.2.dylib
/usr/local/lib/libfuse.dylib
/usr/local/lib/libfuse_ino64.2.7.3.dylib
/usr/local/lib/libfuse_ino64.2.dylib
/usr/local/lib/libfuse_ino64.dylib
/usr/local/lib/libltdl.3.1.0.dylib
/usr/local/lib/libltdl.3.dylib
/usr/local/lib/libltdl.dylib
/usr/local/lib/libmacfuse_i32.2.dylib
/usr/local/lib/libmacfuse_i32.dylib
/usr/local/lib/libmacfuse_i64.2.dylib
/usr/local/lib/libmacfuse_i64.dylib
/usr/local/lib/libMagick++.6.1.7.dylib
/usr/local/lib/libMagick++.6.dylib
/usr/local/lib/libMagick++.dylib
/usr/local/lib/libMagick.6.1.7.dylib
/usr/local/lib/libMagick.6.dylib
/usr/local/lib/libMagick.dylib
/usr/local/lib/libosxfuse.2.dylib
/usr/local/lib/libosxfuse.dylib
/usr/local/lib/libosxfuse_i32.2.dylib
/usr/local/lib/libosxfuse_i32.dylib
/usr/local/lib/libosxfuse_i64.2.dylib
/usr/local/lib/libosxfuse_i64.dylib
/usr/local/lib/libWand.6.1.7.dylib
Profiles: 1
Safari extensions
LastPass
Social Fixer
feedly
OpenIE
Restricted user files: 297
Font problems: 45
Elapsed time (s): 159
How block "Visual match" pop-ups?
This isn't directly responsive to your question, but the computer is being slowed down and destabilized by useless garbage software such as "Norton Anti-Virus" and "MacScan," among others. You're also running "ZQ Digital Tribe" or similar, which is some kind of behavior-tracking rootkit. If you know it's there and want it, that's your choice, but if you don't know, it's spyware. If I were you, I would erase the startup volume, reinstall OS X, and restore only documents from a backup. Then install only the software you really need, not including trash like "Glims" and the others mentioned.
All of these have been installed for some time now so I find it hard to believe they would cause issues now. Is there a Malware scanner I can use? Maybe a Mac equivelant of Malwarebytes? This started happening today on both my iMac and Macbook Pro. Funny it would start today on both.
Is there a Malware scanner I can use?
You don't need a malware scanner, because you don't have malware. You have garbage software that you willingly installed. Good luck.
Since this just started happening and I have not changed anything recently can anyone give me a meaningful answer? Instead of just telling me I've installed garbage. That really does not answer my question.
I had the same problem, just solved it.
You are probabely using Glims...
If so go to Safari->Preferences->Glims->Ads/Shopping and turn off the ads.
The ads are enabled since the last version of Glims - 1.0.41 and that's why you got the popus on 10.8.5.
Hope this helps. (Copied from https://discussions.apple.com/thread/5470784?answerId=25030728022#25030728022)
I would have to agree with Linc. You have a lot of crap on there. Norton is junk on the Mac, notorious for its ability to bring a healthy Mac to its knees and without a decent detection rate for Mac malware. MacScan should be called "MacScam," because it barely detects anything. (See the results of my Mac anti-virus testing 2014.)
Linc also refers to spyware you have installed. You've got something from luthresearch.com, which is a market research company that creates software that spies on you for "market research" purposes. You've also got SIMBL installed, which allows for application behaviors to be modified and causes problems, as well as being something often abused by adware programs to inject ads into your web browser.
Honestly, you have so much junk on your machine that my recommendation would be to wipe it clean and reinstall the system and legit apps from scratch. Since I don't think you'll do that, though, I'd say that you need to get rid of the programs that have been mentioned, if you can. (I don't know how to remove the luthresearch.com spyware, so hopefully you do.) I'd also tell you to look at the Glims preferences, as JohnnyK said. Finally, I'd recommend looking for and removing any other adware found in my Adware Removal Guide.
Regarding anti-virus software, see my Mac Malware Guide.
When did you come up with MacScam? I like it 😀 Mind if I keep that one on file for future use?
Thank you for your Adware Removal Guide. I didn't have any extensions or Glims but It solved my problem!
Boot Mode: Normal
Model: MacBookPro9,2
Battery cycles: 335
System load advisory
combined level = Bad
- user level = OK
- battery level = Bad
- thermal level = Great
User diagnostics
2014-05-02 Google Drive crash
2014-05-02 Google Drive crash
2014-05-02 Google Drive crash
2014-05-02 Google Drive crash
Kernel messages
Apr 30 10:57:53 (default pager): [KERNEL]: Failed to recover emergency paging segment
Apr 30 15:10:59 (default pager): [KERNEL]: Switching ON Emergency paging segment
Apr 30 15:10:59 (default pager): [KERNEL]: Failed to recover emergency paging segment
--- last message repeated 4 times ---
Apr 30 20:21:58 (default pager): [KERNEL]: Switching ON Emergency paging segment
Apr 30 20:22:07 (default pager): [KERNEL]: Failed to recover emergency paging segment
May 2 01:24:19 (default pager): [KERNEL]: Switching ON Emergency paging segment
May 2 01:24:21 (default pager): [KERNEL]: Failed to recover emergency paging segment
--- last message repeated 4 times ---
May 2 10:59:29 (default pager): [KERNEL]: Switching ON Emergency paging segment
May 2 10:59:32 (default pager): [KERNEL]: Failed to recover emergency paging segment
--- last message repeated 3 times ---
May 2 11:05:08 (default pager): [KERNEL]: System is out of paging space.
May 2 11:05:09 (default pager): [KERNEL]: Failed to recover emergency paging segment
May 2 12:29:58 (default pager): [KERNEL]: Switching ON Emergency paging segment
May 2 12:30:01 (default pager): [KERNEL]: Failed to recover emergency paging segment
--- last message repeated 1 time ---
May 2 12:33:05 (default pager): [KERNEL]: System is out of paging space.
May 2 12:33:09 (default pager): [KERNEL]: Failed to recover emergency paging segment
--- last message repeated 2 times ---
May 2 13:07:15 (default pager): [KERNEL]: Switching ON Emergency paging segment
May 2 13:07:21 (default pager): [KERNEL]: Failed to recover emergency paging segment
May 2 13:08:15 (default pager): [KERNEL]: System is out of paging space.
May 2 13:08:16 (default pager): [KERNEL]: Failed to recover emergency paging segment
--- last message repeated 3 times ---
Loaded extrinsic kernel extensions
com.protech.NoSleep (1.3.0)
Extrinsic daemons
com.vsearch.helper
com.microsoft.office.licensing.helper
com.macpaw.CleanMyMac2.Agent
com.adobe.fpsaud
Extrinsic agents
com.vsearch.agent
launchd items
/Library/LaunchAgents/com.vsearch.agent.plist
(com.vsearch.agent)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.apple.remotepairtool.plist
(com.apple.RemotePairTool)
/Library/LaunchDaemons/com.macpaw.CleanMyMac2.Agent.plist
(com.macpaw.CleanMyMac2.Agent)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.vsearch.daemon.plist
(com.vsearch.daemon)
/Library/LaunchDaemons/com.vsearch.helper.plist
(com.vsearch.helper)
Extrinsic loadable bundles
/System/Library/Extensions/NoSleep.kext
(com.protech.NoSleep)
/Library/Internet Plug-Ins/DirectorShockwave.plugin
(com.adobe.director.shockwave.pluginshim)
/Library/Internet Plug-Ins/DivXBrowserPlugin.plugin
(com.divx.DivXBrowserPlugin)
/Library/Internet Plug-Ins/Flash Player.plugin
(com.macromedia.Flash Player.plugin)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/Internet Plug-Ins/Unity Web Player.plugin
(com.unity.UnityWebPlayer)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/NoSleep.prefPane
(com.protech.NoSleepPref)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
(com.conduit.ConduitNPAPIPlugin)
Restricted user files: 46
Font problems: 20
Bad plists
Library/Preferences/com.apple.Safari.plist.plist
Library/Preferences/com.solidstatenetworks.awkhost.plist
Elapsed time (s): 275
In the future, you would do better to describe your problem, and start your own topic, rather than just posting a system profile without any other information.
However, I see that you have the Downlite adware installed, as well as a component of the Conduit adware. You'll find removal instructions in my Adware Removal Guide.
You also have CleanMyMac installed, which should not be used. Macs do not need "cleaning," so any apps that profess to do this for you for a price are basically scams. Uninstall it immediately.
Those kernel messages are concerning as well... I'm not sure exactly what they mean, but would guess 1) you're out of free space on the hard drive, 2) you have a badly damaged or dying hard drive or 3) you've got some extremely bad third-party software installed.
(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)
ad showing in lower left corner
