Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

finder crashes and restarts 5 times on login

My iMac has started with an issue that I have seen posted where upon Login on my iMac Finder will crash and finder appears to restart 5 times, then all is OK. I've seen the Google drive can cuase it, so I removed it, the problem persists. Any assistance would be appreciated.


OS X Maverick updated

10.9.2


User uploaded file

iMac (21.5-inch Late 2009), OS X Mavericks (10.9.2)

Posted on May 10, 2014 7:32 AM

Reply
16 replies

May 10, 2014 8:30 AM in response to gzing2

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Console in the icon grid.

Step 1

For this step, the title of the Console window should be All Messages. If it isn't, select

SYSTEM LOG QUERIES All Messages

from the log list on the left. If you don't see that list, select

View Show Log List

from the menu bar at the top of the screen.

In the top right corner of the Console window, there's a search box labeled Filter. Initially the words "String Matching" are shown in that box. Enter the name of the crashed application or process. For example, if iTunes crashed, you would enter "iTunes" (without the quotes.)

Each message in the log begins with the date and time when it was entered. Select the messages from the time of the last crash, if any. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.

☞ The log contains a vast amount of information, almost all of which is irrelevant to solving any particular problem. When posting a log extract, be selective. A few dozen lines are almost always more than enough.

Please do not indiscriminately dump thousands of lines from the log into this discussion.

☞ Some private information, such as your name, may appear in the log. Anonymize before posting.

Step 2

In the Console window, select

DIAGNOSTIC AND USAGE INFORMATION User Diagnostic Reports

(not Diagnostic and Usage Messages) from the log list on the left. There is a disclosure triangle to the left of the list item. If the triangle is pointing to the right, click it so that it points down. You'll see a list of crash reports. The name of each report starts with the name of the process, and ends with ".crash". Select the most recent report related to the process in question. The contents of the report will appear on the right. Use copy and paste to post the entire contents—the text, not a screenshot.

I know the report is long, maybe several hundred lines. Please post all of it anyway.

☞ If you don't see any reports listed, but you know there was a crash, you may have chosen Diagnostic and Usage Messages from the log list. Choose DIAGNOSTIC AND USAGE INFORMATION instead.

In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)

☞ Please don’t post other kinds of diagnostic report—they're very long and rarely helpful.

May 10, 2014 8:57 AM in response to Linc Davis

Hope this is the correct info...Finder appeared to crash about 10 times on this login...Thanks


Process: Finder [11242]

Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

Identifier: com.apple.finder

Version: 10.9.2 (10.9.2)

Build Info: Finder_FE-885002006000000~2

Code Type: X86-64 (Native)

Parent Process: launchd [359]

Responsible: Finder [11242]

User ID: 501



Date/Time: 2014-05-10 11:48:51.242 -0400

OS Version: Mac OS X 10.9.2 (13C1021)

Report Version: 11

Anonymous UUID: xxxxxxxxxxxxxxx





Crashed Thread: 10



Exception Type: EXC_BAD_ACCESS (SIGSEGV)

Exception Codes: KERN_INVALID_ADDRESS at 0x0000000102d17f9c



External Modification Warnings:

Thread creation by external task.



VM Regions Near 0x102d17f9c:

-->

__TEXT 0000000104653000-0000000104b22000 [ 4924K] r-x/rwx SM=COW /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder



Thread 0:: Dispatch queue: com.apple.main-thread

0 libsystem_kernel.dylib 0x000000010ad64a1a mach_msg_trap + 10

1 libsystem_kernel.dylib 0x000000010ad63d18 mach_msg + 64

2 com.apple.CoreFoundation 0x0000000109993fc5 __CFRunLoopServiceMachPort + 181

3 com.apple.CoreFoundation 0x00000001099935e9 __CFRunLoopRun + 1161

4 com.apple.CoreFoundation 0x0000000109992f25 CFRunLoopRunSpecific + 309

5 com.apple.HIToolbox 0x0000000107476a0d RunCurrentEventLoopInMode + 226

6 com.apple.HIToolbox 0x00000001074767b7 ReceiveNextEventCommon + 479

7 com.apple.HIToolbox 0x00000001074765bc _BlockUntilNextEventMatchingListInModeWithFilter + 65

8 com.apple.AppKit 0x00000001086453de _DPSNextEvent + 1434

9 com.apple.AppKit 0x0000000108644a2b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122

10 com.apple.AppKit 0x00000001089a3e2e -[NSApplication _realDoModalLoop:peek:] + 642

11 com.apple.AppKit 0x00000001089a254e -[NSApplication runModalForWindow:] + 117

12 com.apple.AppKit 0x00000001089a20fd -[NSAlert runModal] + 145

13 com.apple.AppKit 0x000000010864a2a9 __55-[NSPersistentUIRestorer promptToIgnorePersistentState]_block_invoke + 1054

14 com.apple.AppKit 0x0000000108649e4e -[NSApplication _suppressFinishLaunchingFromEventHandlersWhilePerformingBlock:] + 28

15 com.apple.AppKit 0x0000000108649def -[NSPersistentUIRestorer promptToIgnorePersistentState] + 213

16 com.apple.AppKit 0x0000000108649d13 -[NSPersistentUIManager promptToIgnorePersistentState] + 28

17 com.apple.AppKit 0x0000000108649b34 -[NSApplication _reopenWindowsAsNecessaryIncludingRestorableState:registeringAsReady:completion Handler:] + 252

18 com.apple.AppKit 0x000000010864c9f7 -[NSApplication _sendFinishLaunchingNotification] + 142

19 com.apple.AppKit 0x000000010864531a _DPSNextEvent + 1238

20 com.apple.AppKit 0x0000000108644a2b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122

21 com.apple.AppKit 0x0000000108638b2c -[NSApplication run] + 553

22 com.apple.AppKit 0x0000000108623913 NSApplicationMain + 940

23 com.apple.finder 0x0000000104659770 0x104653000 + 26480

24 libdyld.dylib 0x000000010abc35fd start + 1



Thread 1:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 2:: Dispatch queue: com.apple.libdispatch-manager

0 libsystem_kernel.dylib 0x000000010ad69662 kevent64 + 10

1 libdispatch.dylib 0x000000010ab8d43d _dispatch_mgr_invoke + 239

2 libdispatch.dylib 0x000000010ab8d152 _dispatch_mgr_thread + 52



Thread 3:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 4:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 5:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 6:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 7:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 8:

0 libsystem_kernel.dylib 0x000000010ad68e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x000000010ae80f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x000000010ae83fb9 start_wqthread + 13



Thread 9:

0 libsystem_kernel.dylib 0x000000010ad68716 __psynch_cvwait + 10

1 libsystem_pthread.dylib 0x000000010ae81c77 _pthread_cond_wait + 787

2 com.apple.finder 0x000000010467d0ac 0x104653000 + 172204

3 com.apple.finder 0x00000001046a6959 0x104653000 + 342361

4 com.apple.finder 0x0000000104899cee 0x104653000 + 2387182

5 com.apple.finder 0x000000010465ac70 0x104653000 + 31856

6 libsystem_pthread.dylib 0x000000010ae7f899 _pthread_body + 138

7 libsystem_pthread.dylib 0x000000010ae7f72a _pthread_start + 137

8 libsystem_pthread.dylib 0x000000010ae83fc9 thread_start + 13



Thread 10 Crashed:

0 ??? 0x0000000102d17f9c 0 + 4342251420



Thread 10 crashed with X86 Thread State (64-bit):

rax: 0x0000000000000000 rbx: 0x000000010816e000 rcx: 0x000000010786b000 rdx: 0x000000000000007d

rdi: 0x000000010786b000 rsi: 0x000000010816e000 rbp: 0x000000010786cff4 rsp: 0x000000010786cf7c

r8: 0x0000000000000000 r9: 0x0000000000000000 r10: 0x0000000000000000 r11: 0x0000000000000000

r12: 0x0000000000000000 r13: 0x0000000000000000 r14: 0x0000000000000000 r15: 0x0000000000000000

rip: 0x0000000102d17f9c rfl: 0x0000000000010206 cr2: 0x0000000102d17f9c


Logical CPU: 0

Error Code: 0x00000014

Trap Number: 14

May 10, 2014 9:26 AM in response to gzing2

That's not a complete crash report, and you skipped Step 1, but on the basis of what you've provided, it looks like a crash caused by Google Drive. If it's installed, I suggest you first check for an update. If that doesn't solve the problem, remove it according to the developer's instructions. You may need to start the computer in safe mode to do so. Back up all data before making any changes.

If you use Google Drive and don't want to remove it, then try deselecting the option in its preferences to "show status icons." According to reports, that may be enough.

A similar cloud-data product called "Open Drive" can cause the same problem. Perhaps there are others.

May 10, 2014 11:11 AM in response to Linc Davis

Lets try again...


Google Drive has been removed from the computer


Step 1


5/10/14 1:57:29.164 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[325]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:31.000 PM kernel[0]: Data/Stack execution not permitted: Finder[pid 466] at virtual address 0x102d17000, protections were read-write

5/10/14 1:57:31.574 PM ReportCrash[397]: Saved crash report for Finder[325] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135731_Macintosh -d49a20c22c78.crash

5/10/14 1:57:31.642 PM ReportCrash[397]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130802_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:31.822 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[466]) Job appears to have crashed: Bus error: 10

5/10/14 1:57:32.104 PM ReportCrash[397]: Saved crash report for Finder[466] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135732_Macintosh -d49a20c22c78.crash

5/10/14 1:57:32.143 PM ReportCrash[397]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130805_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:34.356 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[470]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:34.619 PM ReportCrash[397]: Saved crash report for Finder[470] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135734_Macintosh -d49a20c22c78.crash

5/10/14 1:57:34.650 PM ReportCrash[397]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130808_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:37.773 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[473]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:38.556 PM ReportCrash[477]: Saved crash report for Finder[473] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135738_Macintosh -d49a20c22c78.crash

5/10/14 1:57:38.590 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130811_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:40.321 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[478]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:40.458 PM ReportCrash[477]: Saved crash report for Finder[478] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135740_Macintosh -d49a20c22c78.crash

5/10/14 1:57:40.463 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130814_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:43.666 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[486]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:43.995 PM ReportCrash[477]: Saved crash report for Finder[486] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135743_Macintosh -d49a20c22c78.crash

5/10/14 1:57:44.008 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130817_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:46.342 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[491]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:46.655 PM ReportCrash[477]: Saved crash report for Finder[491] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135746_Macintosh -d49a20c22c78.crash

5/10/14 1:57:46.685 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130823_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:49.369 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[494]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:49.521 PM ReportCrash[477]: Saved crash report for Finder[494] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135749_Macintosh -d49a20c22c78.crash

5/10/14 1:57:49.539 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130826_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:52.000 PM kernel[0]: Data/Stack execution not permitted: Finder[pid 502] at virtual address 0x102d17000, protections were read-write

5/10/14 1:57:52.408 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[502]) Job appears to have crashed: Bus error: 10

5/10/14 1:57:52.797 PM ReportCrash[477]: Saved crash report for Finder[502] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135752_Macintosh -d49a20c22c78.crash

5/10/14 1:57:52.803 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-130832_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:55.000 PM kernel[0]: Data/Stack execution not permitted: Finder[pid 504] at virtual address 0x102d17000, protections were read-only

5/10/14 1:57:56.139 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[504]) Job appears to have crashed: Bus error: 10

5/10/14 1:57:56.938 PM ReportCrash[477]: Saved crash report for Finder[504] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135756_Macintosh -d49a20c22c78.crash

5/10/14 1:57:56.952 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-133649_Ma cintosh-d49a20c22c78.crash

5/10/14 1:57:58.344 PM com.apple.launchd.peruser.501[312]: (com.apple.Finder[508]) Job appears to have crashed: Segmentation fault: 11

5/10/14 1:57:58.521 PM ReportCrash[477]: Saved crash report for Finder[508] version 10.9.2 (10.9.2) to /Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-135758_Macintosh -d49a20c22c78.crash

5/10/14 1:57:58.544 PM ReportCrash[477]: Removing excessive log: file:///Users/gzing2/Library/Logs/DiagnosticReports/Finder_2014-05-10-133651_Ma cintosh-d49a20c22c78.crash



===========

Step 2


Process: Finder [508]

Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

Identifier: com.apple.finder

Build Info: Finder_FE-885002006000000~2

Responsible: Finder [508]

__TEXT 0000000100dde000-00000001012ad000 [ 4924K] r-x/rwx SM=COW /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

12 com.apple.finder 0x0000000100de4770 0x100dde000 + 26480

2 com.apple.finder 0x0000000100e080ac 0x100dde000 + 172204

3 com.apple.finder 0x0000000100e31959 0x100dde000 + 342361

4 com.apple.finder 0x0000000101024cee 0x100dde000 + 2387182

5 com.apple.finder 0x0000000100de5c70 0x100dde000 + 31856

0x100dde000 - 0x1012acff5 com.apple.finder (10.9.2 - 10.9.2) <44F7D842-1D12-392F-AFF7-FEEA9FD48D36> /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

May 10, 2014 11:29 AM in response to gzing2

Please read this whole message before doing anything.


This procedure is a test, not a solution. Don’t be disappointed when you find that nothing has changed after you complete it.


Step 1


The purpose of this step is to determine whether the problem is localized to your user account.


Enable guest logins* and log in as Guest. Don't use the Safari-only “Guest User” login created by “Find My Mac.”


While logged in as Guest, you won’t have access to any of your personal files or settings. Applications will behave as if you were running them for the first time. Don’t be alarmed by this; it’s normal. If you need any passwords or other personal data in order to complete the test, memorize, print, or write them down before you begin.


Test while logged in as Guest. Same problem?


After testing, log out of the guest account and, in your own account, disable it if you wish. Any files you created in the guest account will be deleted automatically when you log out of it.


*Note: If you’ve activated “Find My Mac” or FileVault, then you can’t enable the Guest account. The “Guest User” login created by “Find My Mac” is not the same. Create a new account in which to test, and delete it, including its home folder, after testing.


Step 2


The purpose of this step is to determine whether the problem is caused by third-party system modifications that load automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.


Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem. You must hold down the shift key twice: once when you turn on the computer, and again when you log in.

Note: If FileVault is enabled, or if a firmware password is set, or if the startup volume is a Fusion Drive or a software RAID, you can’t do this. Ask for further instructions.


Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.


The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.


Test while in safe mode. Same problem?


After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of Steps 1 and 2.

May 10, 2014 12:57 PM in response to gzing2

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts 51 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports 'com.autodesk.AutoCad com.evenflow.dropbox com.google.GoogleDrive' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[45]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n\t(%s)\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}')printf("%s (UID %s) is using %s '${p[$2]}'\n",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ s/ *:$//;x;s/\n//;/Apple|Genesy|Intel|SMSC/d;s/\n.*//;/\)/p;};/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;} ' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/:/;END { if(NR<100)print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { $4="";gsub(" "," ");gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}')print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR==2'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' ' s/^.{52}//;s/ .+//p ' ' /Launch[AD].+\.plist$/;END{if(NR<100)print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' '/\.(framew|lproj)/d;/plist:|:.+(M.+exec|scrip)/s/:[^:]+//p' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/;END{if(NR<100)print "/System/"};' '/^\/usr\/lib\/.+dylib$/p' '/\/etc\/(auto_m|hosts[^.]|peri)/s/^\.\/[^/]+//p' ' /\/(Contents\/.+\/Contents|Frameworks)\//d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| ","||kMDItem'${p[35]}'=");sub("^.."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[9]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a)print "CPU: "a;if(b)print "I/O: "b;if(c)print "Net: "c" (KiB/s)";if(d)print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' /lR/ { if($2<='${p[25]}')print $2;} ' ' BEGIN { FS=":";} $3~/(sh|ng|ic)$/ { n=split($3,a,".");sub(/_2.+/,"",a[n-1]);b=b"\n"$2" "a[n-1]" "a[n]" "$1;c=c$1;} END { d="sort|tail -n'${p[38]}'";print b|d;close(d);if(c)print("\n\t* Code injection");} ' ' NR!=4{next} {$NF=int($NF/10240)} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L)f=f"\n "$0;} END { F=FILENAME;if(!F)exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(A.+ E.+ text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ +B/{ s/.+= |(-[0-9]+)?\.s.+//g;p;} ' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' /:/{$0="'"${p[28]}"'"};1;' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil PlistBuddy whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup );c2=(com.apple.loginwindow\ LoginHook '-c Print /L*/P*/loginw*' '-c Print L*/P*/*loginit*' '-c Print L*/Saf*/*/E*.plist' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' '-c Print\ :'${p[35]}' 2>&1' '-c Print\ :Label 2>&1' '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status '-F bsd -k Sender kernel -k Message CReq "Beac|caug|dead[^bl]|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN" -k Message Rne "Goog|SMC:" -o -k Sender fseventsd -k Message CReq "SL"' '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/*/*.{BS,Bas,Es,OSXU,Rem}*.bom' '{/,}L*/Lo*/Diag* -type f \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;' '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto_master,{cron,fs}tab,hosts,{launchd,sysctl}.conf} /usr/local/etc/periodic/*/* .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l );N1=${#c2[@]};for j in {0..8};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n 'syscall::'${p[33+j]}':return {@out[execname,uid]=sum(arg0)} tick-10sec {trunc(@out,1);exit(0)}'";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP RSSI Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear;};for i in 0 1;do eval ' A'$((1+i))'() { v[0]=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "${v[0]}" ]];};A'$((3+i))'() { v[0]=` while read i;do eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "${v[0]}" ]];};A'$((5+i))'() { v[0]=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "${v[0]}" ]];};';done;A7(){ v[0]=$((`date +%s`-v[3]));};B2(){ v[$1]="${v[0]}";};for i in 0 1;do eval ' B'$i'() { unset v[0];((v['$((i+1))']==0))||{ v[0]=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v[0]=` paste -d: <(echo "${v[$1]}") <(echo "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v[0]=`grep -Fv "${v[$1]}"<<<"${v[0]}"`;};C0(){ test "${v[0]}"&&echo "$_";};C1() { [[ "${v[0]}" ]]&&printf "${f[$1]}" "${l[$2]}" "${v[0]}";};C2() { v[0]=`echo ${v[0]}`;[[ "${v[0]}" != 0 ]]&&C1 0 $1;};C3() { v[0]=`sed -E "${s[0]}"<<<"${v[0]}"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;A0;{ A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D22 0 $((N1+4)) 5 4;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&D22 11 17 17 20;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A4 14 6 11 0;B2 0 5;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A4 14 7 11 6;B2 0 7;B3 4 0 22;A4 14 6 11 0;B2 0 8;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D23 24 24 32 31;A1 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&D13 21 0 32 19;D23 14 1 48 42;D23 14 2 48 43;D13 14 3 49 5;D22 4 4 50 0;D13 4 5 32 1;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D23 22 9 37 7;B1&&D13 10 42 32 40;D23 20 42 32 41;D13 25 37 32 33;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;D22 32 31 43 38;B1&&for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;B1&&D22 29 35 46 39;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

Copy the selected text to the Clipboard by pressing the key combination command-C.

7. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

8. If you see an error message in the Terminal window such as "syntax error," enter

exec bash

and press return. Then paste the script again.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

[Process completed]

to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with "Model Identifier." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

________________________________


Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

May 11, 2014 4:08 AM in response to Linc Davis

Here you go!


Model Identifier: iMac10,1

System Version: OS X 10.9.2 (13C1021)

Kernel Version: Darwin 13.1.0

Boot Mode: Normal

Time since boot: 15:50



USB



My Passport 0748 (Western Digital Technologies, Inc.)

Back-UPS ES 550G FW:904.W1 .D USB FW:W1 (American Power Conversion)



Diagnostic reports



2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 Finder crash *

2014-05-10 secd crash

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

2014-05-11 Finder crash *

* Code injection



Log



May 10 14:51:02 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=2974[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 14:51:04 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=2980[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 14:55:38 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=3409[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 14:55:38 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=3412[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 14:59:32 kernel[0]: 4.261020: Use hw queue 9 for beacons

May 10 15:02:42 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=255[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:02:50 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=262[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:05:08 kernel[0]: 2.508394: Use hw queue 9 for beacons

May 10 15:06:40 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=426[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:06:46 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=453[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:09:07 kernel[0]: 2.528743: Use hw queue 9 for beacons

May 10 15:10:14 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=408[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:10:15 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=414[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:18:28 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=1096[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:18:29 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=1103[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:19:56 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=1384[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 15:19:57 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=1386[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 16:38:37 kernel[0]: process WindowServer[1244] caught causing excessive wakeups. Observed wakeups rate (per sec): 338; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 108963

May 10 16:51:13 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=4531[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 16:51:16 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=4534[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 17:10:03 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=5286[ksadmin] final status 0x0, allowing (remove VALID) page

May 10 17:10:05 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=5289[ksadmin] final status 0x0, allowing (remove VALID) page

May 11 06:43:25 kernel[0]: process IDriveDaemon[70504] caught causing excessive wakeups. Observed wakeups rate (per sec): 2626; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45523

May 11 06:45:51 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=70828[ksadmin] final status 0x0, allowing (remove VALID) page

May 11 06:46:04 kernel[0]: CODE SIGNING: cs_invalid_page(0x1000): p=70848[ksadmin] final status 0x0, allowing (remove VALID) page



Activity



Net: 9 in, 486 out (KiB/s)



launchd



/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist

(com.apple.AirPortBaseStationAgent)

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

(com.adobe.AAM.Startup-1.0)

/Library/LaunchAgents/com.adobe.CS4ServiceManager.plist

(com.adobe.CS4ServiceManager)

/Library/LaunchAgents/com.epson.eventmanager.agent.plist

(com.epson.eventmanager.agent)

/Library/LaunchAgents/com.motorola.MDMUpdater.plist

(com.motorola.MDMUpdaterPlist)

/Library/LaunchAgents/com.motorola.motohelper.plist

(com.motorola.motohelper)

/Library/LaunchAgents/com.motorola.motohelperUpdater.plist

(com.motorola.motohelperUpdater)

/Library/LaunchAgents/com.parallels.mobile.prl_deskctl_agent.launchagent.plist

(com.parallels.mobile.prl_deskctl_agent.launchagent)

/Library/LaunchDaemons/com.adobe.fpsaud.plist

(com.adobe.fpsaud)

/Library/LaunchDaemons/com.adobe.SwitchBoard.plist

(com.adobe.SwitchBoard)

/Library/LaunchDaemons/com.barebones.textwrangler.plist

(com.barebones.textwrangler)

/Library/LaunchDaemons/com.motorola-mobility.mmcfgd.plist

(com.motorola-mobility.mmcfgd)

/Library/LaunchDaemons/com.parallels.mobile.dispatcher.launchdaemon.plist

(com.parallels.mobile.dispatcher.launchdaemon)

/Library/LaunchDaemons/com.parallels.mobile.kextloader.launchdaemon.plist

(com.parallels.mobile.kextloader.launchdaemon)

/Library/LaunchDaemons/com.prosoftnet.idrivedaemon.plist

(IDriveDaemon)

/Library/LaunchDaemons/com.prosoftnet.idsyncdaemon.plist

(IDSyncDaemon)

/Library/LaunchDaemons/com.prosoftnet.idwebdaemon.plist

(IDWebManagement)

Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

(com.adobe.AAM.Scheduler-1.0)

Library/LaunchAgents/com.adobe.ARM.UUID.plist

(com.adobe.ARM.UUID)

Library/LaunchAgents/com.akamai.single-user-client.plist

(com.akamai.single-user-client)

Library/LaunchAgents/com.parallels.mobile.startgui.launchagent.plist

(com.parallels.mobile.startgui.launchagent)

Library/LaunchAgents/ws.agile.1PasswordAgent.plist

(ws.agile.1PasswordAgent)



Bundles



/System/Library/Extensions/CiscoVPN.kext

(com.cisco.nke.ipsec)

/System/Library/Extensions/MotMobileUSB.kext

(com.motorola-mobility.driver.MotMobileUSB)

/System/Library/Extensions/RIMBBUSB.kext

(com.rim.driver.BlackBerryUSBDriverInt)

/System/Library/Extensions/RIMBBVSP.kext

(com.rim.driver.BlackBerryUSBDriverVSP)

/System/Library/Extensions/SiLabsUSBDriver.kext

(com.silabs.driver.CP210xVCPDriver)

/System/Library/Extensions/SiLabsUSBDriver64.kext

(com.silabs.driver.CP210xVCPDriver64)

/System/Library/Extensions/SLAB_USBtoUART.kext

(com.MCCI.SLAB_USBtoUART)

/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin

(info.emagic.driver.unitor)

/Library/Input Methods/ParallelsIM.app

(com.parallels.inputmethod.ParallelsIM)

/Library/Internet Plug-Ins/AdobeAAMDetect.plugin

(com.AdobeAAMDetectLib.AdobeAAMDetect)

/Library/Internet Plug-Ins/AdobeExManDetect.plugin

(com.AdobeExManDetectLib.AdobeExManDetect)

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

(com.adobe.acrobat.pdfviewer)

/Library/Internet Plug-Ins/CouponPrinter-FireFox.plugin

(com.coupons.application/couponsinc-printer-plugin)

/Library/Internet Plug-Ins/CouponPrinter-Safari.webplugin

(com.coupons.application/couponsinc-printer-plugin)

/Library/Internet Plug-Ins/Flash Player.plugin

(com.macromedia.Flash Player.plugin)

/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

(net.telestream.wmv.plugin)

/Library/Internet Plug-Ins/GarminGpsControl.plugin

(com.garmin.GarminGpsControl)

/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin

(com.google.googletalkbrowserplugin)

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

(com.apple.java.JavaAppletPlugin)

/Library/Internet Plug-Ins/npgtpo3dautoplugin.plugin

(com.google.o3d)

/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin

(com.microsoft.officelive.browserplugin)

/Library/Internet Plug-Ins/Silverlight.plugin

(com.microsoft.SilverlightPlugin)

/Library/Internet Plug-Ins/SkyCaddiePlugIn.plugin

(com.skyhawke.skycaddieplugin)

/Library/Internet Plug-Ins/Unity Web Player.plugin

(com.unity.UnityWebPlayer)

/Library/PreferencePanes/Flash Player.prefPane

(com.adobe.flashplayerpreferences)

/Library/PreferencePanes/Flip4Mac WMV.prefPane

(net.telestream.wmv.prefpane)

/Library/PreferencePanes/MacFUSE.prefPane

(com.google.MacFUSE)

/Library/QuickTime/SoundboothScoreCodec.component

(com.adobe.SoundboothScoreAudioCodec)

/Library/ScriptingAdditions/Adobe Unit Types.osax

(N/A)

Library/Address Book Plug-Ins/SkypeABDialer.bundle

(com.skype.skypeabdialer)

Library/Address Book Plug-Ins/SkypeABSMS.bundle

(com.skype.skypeabsms)

Library/Internet Plug-Ins/fbplugin_1_0_1.plugin

(com.facebook.plugin)

Library/Internet Plug-Ins/fbplugin_1_0_3.plugin

(com.facebook.plugin)

Library/Internet Plug-Ins/Picasa.plugin

(com.google.PicasaPlugin)

Library/PreferencePanes/AkamaiNetSession.prefPane

(com.yourcompany.AkamaiNetSession)

Library/PreferencePanes/AkamaiNetSession.prefPane/Contents/Resources

(N/A)

Library/ScriptingAdditions/1Password Addition.osax

(ws.agile.1PasswordAddition)



Contents of /etc/hosts



127.0.0.1 localhost

255.255.255.255 broadcasthost

127.0.0.1 activate.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 lm.licenses.adobe.com

127.0.0.1 lmlicenses.wip4.adobe.com

::1 localhost

fe80::1%lo0 localhost



User login items



/Applications/iTunes.app/Contents/Resources/iTunesHelper.app

/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ SpeechSynthesis.framework/Versions/A/Resources/SpeechSynthesisServer.app

/Applications/IDriveforMac/IDriveMonitor.app

/Applications/RemoteSupportHost/RemoteSHC.app

/Applications/IDrive/IDriveMonitor.app



Safari extensions



Ultimate

OpenIE



Restricted files: 76350



Font issues: 40



Bad plists



/Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Scan.UnInstallList.plist

/Library/Preferences/com.epson.EpsonNet Config v4.UnInstallList.plist

/Library/Preferences/com.epson.PC-FAX Driver.UnInstallList.plist



Root crontab



#do not send mail

MAILTO=""

0 */2 * * * perl /Scripts/Interfacelift/interfaceliftAI.pl > /Scripts/Interfacelift/intlift.log

0 0 * * * rsync -avz --delete -e "ssh -i /var/root/rsync-key" backup@192.168.1.111:/var/www/localhost/htdocs/golf/ ~/Documents/golf.sugarvale.com.backup/



Firewall: On



Elapsed time (s): 331

May 11, 2014 5:59 AM in response to gzing2

A.


Remove iDrive.

Any third-party software that doesn't install by drag-and-drop into the Applications folder, and uninstall by drag-and-drop to the Trash, is a system modification.

Whenever you remove system modifications, they must be removed completely, and the only way to do that is to use the uninstallation tool, if any, provided by the developers, or to follow their instructions. If the software has been incompletely removed, you may have to re-download or even reinstall it in order to finish the job.

I never install system modifications myself, and (unless otherwise specified in this comment) I don't know how to uninstall them. You'll have to do your own research to find that information.

Here are some general guidelines to get you started. Suppose you want to remove something called “BrickMyMac” (a hypothetical example.) First, consult the product's Help menu, if there is one, for instructions. Finding none there, look on the developer's website, say www.brickmymac.com. (That may not be the actual name of the site; if necessary, search the Web for the product name.) If you don’t find anything on the website or in your search, contact the developer. While you're waiting for a response, download BrickMyMac.dmg and open it. There may be an application in there such as “Uninstall BrickMyMac.” If not, open “BrickMyMac.pkg” and look for an Uninstall button. The uninstaller might also be accessed by clicking the Customize button, if there is one.

Back up all data before making any changes.

You will generally have to restart the computer in order to complete an uninstallation. Until you do that, there may be no effect, or unpredictable effects.

If you can’t remove software in any other way, you’ll have to erase and install OS X. Never install any third-party software unless you're sure you know how to uninstall it; otherwise you may create problems that are very hard to solve.

WARNING: Trying to remove complex system modifications by hunting for files by name often will not work and may make the problem worse. The same goes for "utilities" such as "AppCleaner" and the like that purport to remove software.

B.

This procedure will unlock all your user files (not system files) and reset their ownership and access-control lists to the default. If you've set special values for those attributes on any of your files, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it.

Step 1

If you have more than one user, and the one in question is not an administrator, then go to Step 2.

Triple-click anywhere in the following line on this page to select it:

{ sudo chflags -R nouchg,nouappnd ~ $TMPDIR..; sudo chown -R $UID:staff ~ $_; sudo chmod -R u+rwX ~ $_; chmod -R -N ~ $_; } 2>&-


Copy the selected text to the Clipboard by pressing the key combination command-C.

Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Paste into the Terminal window by pressing command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.

You'll be prompted for your login password. Nothing will be displayed when you type it. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.

The command may take a few minutes to run, or perhaps longer if you have literally millions of files in your home folder. Wait for a new line ending in a dollar sign ($) to appear, then quit Terminal.

Step 2 (optional)

Take this step only if you have trouble with Step 1, if it frightens you, or if it doesn't solve the problem.

Start up in Recovery mode. When the OS X Utilities screen appears, select

Utilities Terminal

from the menu bar. A Terminal window will open.

In the Terminal window, type this:

res

Press the tab key. The partial command you typed will automatically be completed to this:

resetpassword

Press return. A Reset Password dialog will open. You’re not going to reset a password.

In the dialog, select the startup volume ("Macintosh HD," unless you gave it a different name) if it's not already selected.

Select your username from the menu labeled Select the user account if it's not already selected.

Under Reset Home Directory Permissions and ACLs, click the Reset button.

Select

Restart

from the menu bar.

May 11, 2014 7:19 AM in response to Linc Davis

I removed iDrive with its uninstall program and restarted.

I logged into my account and the Finder issue stopped


...then I reinstalled iDrive logged in and the problem started again


...then I uninstalled iDrive again and the Finder problem again stopped.


Will going thru your additional steps still be of value and perhaps allow me to again use iDrive without issue?


...or is this proof that iDrive is the sole culprit and I should close the account and stick with Time Machine + my local external drive?

Jun 30, 2014 3:35 AM in response to gzing2

I've been having this issue for a little while now. I've just been too lazy to try and identify it.


I got fed up tthis morning and tracked it down and found the same culprit, one of the iDrive daemons.


Unloading that plist from the luanchd ends the crashes.


I've reported it (and this thread) to iDrive and will now wait to see what they have to say.


If there's anything significant I'll post it here.

finder crashes and restarts 5 times on login

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.