Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How can I get rid of adware?

I ran ClamXav after getting many popups and sites telling me my files were bein encrypted. Two infected files were found under the file name FunmoodsSetup.exe and infection name Win.Adware.Installcore-366. How do I get rid of it? Do I just delete the files?

-M

Posted on Jun 20, 2014 2:18 PM

Reply
Question marked as Best reply

Posted on Jun 20, 2014 2:26 PM

The file type .exe will not run on the Mac.


Go to this link for instructions to remove.

The Safe Mac » Adware Removal Tool

10 replies

Jun 20, 2014 3:34 PM in response to mariacamilame3

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the behest of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

Here's a summary of what you need to do, if you choose to proceed:

  • Copy a line of text in this window to the Clipboard.
  • Paste into the window of another application.
  • Wait for the test to run. It usually takes a few minutes.
  • Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:


PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts 51 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports 'com.autodesk.AutoCad com.evenflow.dropbox com.google.GoogleDrive' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n\t(%s)\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */  /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1000) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/d;/(etc|Preferences)\//s/^\.\/[^/]+//p;' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| ","||kMDItem'${p[35]}'=");sub("^.."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[9]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]" "$1;b=b$1;} END { if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n  "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n  [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n  ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' ' /^ +B/{ s/.+= |(-[0-9]+)?\.s.+//g;p;} ' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' 's/0/Off/p' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil PlistBuddy whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '-c Print /L*/P*/loginw*' '-c Print L*/P*/*loginit*' '-c Print L*/Saf*/*/E*.plist' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' '-c Print\ :'${p[35]}' 2>&1' '-c Print\ :Label 2>&1' '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' -i4TCP:0-1023 com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' );N1=${#c2[@]};for j in {0..8};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A1 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D22 4 4 50 0;D13 14 3 49 5;D12 26 48 59 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

Copy the selected text to the Clipboard by pressing the key combination command-C.

7. Launch the built-in Terminal application in any of the following ways:

  • Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
  • In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
  • Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

8. If you see an error message in the Terminal window such as "syntax error," enter

exec bash

and press return. Then paste the script again.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

[Process completed]

to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start Time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

________________________________

Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.


Jan 7, 2015 10:26 PM in response to Linc Davis

I have the same problem and would like to get rid of adware. I followed your instructions and here are my results.

Start time: 22:46:22 01/07/15 I would really appreciate some help since I have tried several other things and none have worked.


Model Identifier: MacBookPro5,4

System Version: Mac OS X 10.6.8 (10K549)

Kernel Version: Darwin 10.8.0

Boot Mode: Normal

64-bit Kernel and Extensions: No


Root access: No


Battery


Cycle count: 1030

Condition: Replace Soon


System load


combined level = Bad

- battery level = Bad


Diagnostic reports


2015-01-06 update.PBUwVmCd crash

2015-01-06 update.hl6Jl1Ys crash

2015-01-06 update.satndYNW crash

2015-01-06 update.uKWnxrTc crash

2015-01-06 update.ybmeWjrv crash

2015-01-07 quicklookd crash

2015-01-07 quicklookd crash

2015-01-07 quicklookd crash

2015-01-07 update.89p8AB4e crash

2015-01-07 update.FEf3le6V crash

2015-01-07 update.INBE6fa1 crash

2015-01-07 update.LyOYljDc crash

2015-01-07 update.NlPVmMDz crash

2015-01-07 update.OdmHkg7Y crash

2015-01-07 update.RhO1mrNL crash

2015-01-07 update.Uh0obiGk crash

2015-01-07 update.WExJZ7jd crash

2015-01-07 update.aervWBe0 crash

2015-01-07 update.cF2trgdW crash

2015-01-07 update.cnaPo3uR crash

2015-01-07 update.e1KkT2bI crash

2015-01-07 update.oDoPiZdl crash

2015-01-07 update.uNc2QcXQ crash

2015-01-07 update.x23cDd7H crash

2015-01-07 update.y1m41Roe crash


Log


Mon Jan 5 14:51:32 Previous Shutdown Cause: -60

Tue Jan 6 14:50:22 IOAudioStream[0x8d54000]::clipIfNecessary() - Error: attempting to clip to a position more than one buffer ahead of last clip position (3,1a6d)->(9,4e8).

Tue Jan 6 18:06:05 Previous Shutdown Cause: -60

Wed Jan 7 09:37:07 Previous Shutdown Cause: -60

Wed Jan 7 14:22:00 (default pager): [KERNEL]: Switching ON Emergency paging segment

Wed Jan 7 14:22:15 (default pager): [KERNEL]: Recovered emergency paging segment


CPU per process: firefox (UID 501) is using 31 %


kexts


e.iokit.IOACPIFamily (1.3.0)

e.iokit.IOPCIFamily (2.6.5)

e.driver.AppleACPIPlatform (1.3.6)

e.driver.AppleIntelCPUPowerManagement (142.6.0)

e.iokit.IOStorageFamily (1.6.3)

e.driver.DiskImages (289.1)

e.nke.applicationfirewall (2.1.14)

e.kext.AppleMatch (1.0.0d1)

e.security.quarantine (0)

e.security.sandbox (1)

e.security.TMSafetyNet (6)

e.driver.AppleIntelCPUPowerManagementClient (142.6.0)

e.driver.AppleAPIC (1.4)

e.iokit.IOSMBusFamily (1.1)

e.driver.AppleACPIEC (1.3.6)

e.driver.AppleSMBIOS (1.7)

e.iokit.IOHIDFamily (1.6.6)

e.driver.AppleACPIButtons (1.3.6)

e.driver.AppleSmartBatteryManager (160.0.0)

e.driver.AppleHPET (1.5)

e.driver.AppleRTC (1.3.1)

e.driver.AppleEFIRuntime (1.4.0)

e.driver.AppleEFINVRAM (1.4.0)

e.iokit.IOUSBFamily (4.2.4)

e.driver.AppleUSBOHCI (4.2.0)

e.driver.AppleUSBEHCI (4.2.4)

e.iokit.IOUSBUserClient (4.2.4)

e.driver.AppleUSBHub (4.2.4)

e.iokit.IOAHCIFamily (2.0.6)

e.driver.AppleAHCIPort (2.1.7)

e.iokit.IOFireWireFamily (4.2.6)

e.driver.AppleFWOHCI (4.7.3)

e.AppleFSCompression.AppleFSCompressionTypeZlib (1.0.0d1)

e.BootCache (31.1)

e.iokit.IOAHCIBlockStorage (1.6.4)

e.driver.XsanFilter (402.1)

e.iokit.IOSCSIArchitectureModelFamily (2.6.8)

e.iokit.IOAHCISerialATAPI (1.2.6)

e.driver.AppleUSBComposite (3.9.0)

e.driver.AppleUSBMergeNub (4.2.4)

e.iokit.IOSCSIBlockCommandsDevice (2.6.8)

e.iokit.IOUSBMassStorageClass (2.6.7)

e.driver.AppleUSBCardReader (2.6.1)

e.iokit.IOCDStorageFamily (1.6.1)

e.iokit.IODVDStorageFamily (1.6)

e.iokit.IOBDStorageFamily (1.6)

e.iokit.IOSCSIMultimediaCommandsDevice (2.6.8)

e.iokit.SCSITaskUserClient (2.6.8)

e.iokit.IOUSBHIDDriver (4.2.0)

e.driver.AppleIRController (303.8)

e.driver.AppleUSBTCKeyboard (201.6)

e.driver.AppleUSBMultitouch (207.7)

e.iokit.IOBluetoothFamily (2.4.5f3)

e.driver.AppleUSBBluetoothHCIController (2.4.5f3)

e.driver.BroadcomUSBBluetoothHCIController (2.4.5f3)

e.driver.AppleUSBTCButtons (201.6)

e.iokit.IOGraphicsFamily (2.2.1)

e.iokit.IONDRVSupport (2.2.1)

e.NVDAResman (6.3.6)

e.nvidia.nv50hal (6.3.6)

e.driver.AppleSMC (3.1.0d5)

e.kext.AppleSMCLMU (1.5.2d10)

e.driver.AppleBacklightExpert (1.0.1)

e.driver.AppleBacklight (170.0.46)

e.driver.AppleLPC (1.5.1)

e.driver.AppleSMBusPCI (1.0.10d0)

e.driver.IOPlatformPluginFamily (4.7.0a1)

e.driver.ACPI_SMC_PlatformPlugin (4.7.0a1)

e.iokit.IONetworkingFamily (1.10)

e.iokit.IO80211Family (320.1)

e.driver.AirPortBrcm43224 (428.42.4)

e.GeForce (6.3.6)

e.driver.NVSMU (2.2.7)

e.iokit.AppleProfileFamily (41)

e.iokit.IOFireWireIP (2.0.3)

e.driver.SMCMotionSensor (3.0.1d2)

e.iokit.IOHDAFamily (2.0.5f14)

e.driver.AppleHDAController (2.0.5f14)

e.nvenet (2.0.17)

e.driver.AppleSMBusController (1.0.10d0)

e.driver.AppleMCCSControl (1.0.20)

e.kext.OSvKernDSPLib (1.3)

e.iokit.IOAudioFamily (1.8.3fc2)

e.driver.AudioIPCDriver (1.1.6)

e.driver.DspFuncLib (2.0.5f14)

e.driver.AppleHDA (2.0.5f14)

e.driver.AppleMikeyDriver (2.0.5f14)

e.driver.AppleUpstreamUserClient (3.5.7)

e.Dont_Steal_Mac_OS_X (7.0.0)

e.driver.AppleIntelPenrynProfile (17)

e.driver.AppleMikeyHIDDriver (1.2.0)

e.iokit.IOSerialFamily (10.0.3)

e.iokit.IOBluetoothSerialManager (2.4.5f3)

e.iokit.IOSurface (74.2)

e.driver.AppleProfileCallstackAction (20)

e.driver.AudioAUUC (1.57)

e.driver.AppleProfileKEventAction (10)

e.driver.AGPM (100.12.31)

e.driver.AppleProfileRegisterStateAction (10)

e.driver.AppleProfileThreadInfoAction (14)

e.driver.AppleProfileTimestampAction (10)

e.driver.AppleProfileReadCounterAction (17)

e.filesystems.autofs (2.1.0)

e.driver.AppleHWSensor (1.9.3d0)


Agents


com.lexmark.hostregister

com.lexmark.hostinfoupdater

com.lexmark.hbnlistener

com.webtools.update.agent

com.webhelper

com.adobe.ARM.UUID


launchd


/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist

(com.apple.AirPortBaseStationAgent)

/Library/LaunchAgents/com.lexmark.hbnlistener.plist

(com.lexmark.hbnlistener)

/Library/LaunchAgents/com.lexmark.hostinfoupdater.plist

(com.lexmark.hostinfoupdater)

/Library/LaunchAgents/com.lexmark.hostregister.plist

(com.lexmark.hostregister)

/Library/LaunchDaemons/com.adobe.fpsaud.plist

(com.adobe.fpsaud)

Library/LaunchAgents/com.adobe.ARM.UUID.plist

(com.adobe.ARM.UUID)

Library/LaunchAgents/com.apple.FolderActions.enabled.plist

(com.apple.FolderActions.enabled)

Library/LaunchAgents/com.apple.FolderActions.folders.plist

(com.apple.FolderActions.folders)

Library/LaunchAgents/com.webhelper.plist

(com.webhelper)

Library/LaunchAgents/com.webtools.update.agent.plist

(com.webtools.update.agent)


Startup items


/Library/StartupItems/WDBMService/StartupParameters.plist

/Library/StartupItems/WDBMService/WDBMService

/Library/StartupItems/WDBMService/WDButtonManager.app/Contents/Info.plist

/Library/StartupItems/WDBMService/WDButtonManager.app/Contents/MacOS/WDButtonMa nager

/Library/StartupItems/WDBMService/WDButtonManager.app/Contents/Resources/Info-M onacoBackground__Upgraded_.plist


Bundles


/System/Library/Extensions/BJUSBMP.kext

(jp.co.canon.bj.kext.BJUSBMP)

/System/Library/Extensions/IOFireWireWDHID.kext

(com.wdc.driver.IOFireWireWDHID)

/System/Library/Extensions/LfConnectDriver.kext

(com.leapfrog.driver.LfConnectDriver)

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

(com.adobe.acrobat.pdfviewer)

/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

(com.adobe.acrobat.pdfviewerNPAPI)

/Library/Internet Plug-Ins/CouponPrinter-FireFox.plugin

(com.coupons.application/couponsinc-printer-plugin|application/Couponsinc-moz-p rinter-plugin-v401)

/Library/Internet Plug-Ins/CouponPrinter-Safari.webplugin

(com.coupons.application/couponsinc-printer-plugin)

/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

(net.telestream.wmv.plugin)

/Library/Internet Plug-Ins/GarminGpsControl.plugin

(com.garmin.GarminGpsControl)

/Library/Internet Plug-Ins/iPhotoPhotocast.plugin

(com.apple.plugin.iPhotoPhotocast)

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

(com.apple.java.JavaAppletPlugin)

/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin

(com.microsoft.officelive.browserplugin)

/Library/Internet Plug-Ins/Silverlight.plugin

(com.microsoft.SilverlightPlugin)

/Library/Internet Plug-Ins (Disabled)/Flash Player.plugin

(N/A)

/Library/PreferencePanes/Flash Player.prefPane

(com.adobe.flashplayerpreferences)

/Library/PreferencePanes/Flip4Mac WMV.prefPane

(net.telestream.wmv.prefpane)

/Library/QuickTime/Flip4Mac WMV Advanced.component

(net.telestream.wmv.advanced)

/Library/QuickTime/Flip4Mac WMV Export.component

(net.telestream.wmv.export)

/Library/QuickTime/Flip4Mac WMV Import.component

(net.telestream.wmv.import)

Library/Address Book Plug-Ins/SkypeABDialer.bundle

(com.skype.skypeabdialer)

Library/Address Book Plug-Ins/SkypeABSMS.bundle

(com.skype.skypeabsms)

Library/Internet Plug-Ins/BrowserPlus_2.9.8.plugin

(com.yahoo.browserplus)

Library/Internet Plug-Ins/Move-Media-Player.plugin

(com.movenetworks.movemediaplayer.plugin)

Library/PreferencePanes/BrowserPlusPrefs.prefPane

(com.yahoo.browserplus.prefpane)


Font issues: 35


Bad plists


/Library/Preferences/DirectoryService/ContactsNodeConfig.plist

/Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist

/Library/Preferences/DirectoryService/DirectoryService.plist

/Library/Preferences/DirectoryService/DirectoryServiceDebug.plist

/Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist

/Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist

/Library/Preferences/DirectoryService/SearchNodeConfig.plist

/Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist


Restricted files: 167


High file counts


Desktop: 54


Elapsed time (s): 276

Jan 8, 2015 10:53 AM in response to Eric Root

Thanks, I have already taken a look at the AdMedic but unfortunately I have to do it manually since I have 10.6.8. I went through and checked for common adware based on instructions from one of Linc Davis posts and not one of the files were located on my MacBook. I'm afraid that I have something that isn't too common although others on these boards also seem to have the same problem.


I also hate to add any more applications to try to resolve the problem, and I got to tell you that all the back and forth between Thomas_r and Linc Davis to see who "the prettiest girl at the party" is does not provide me with a sense of well being. I do not doubt that they both are very knowledgeable, but their mutual backbiting is a real disservice to the rest of us who don't know our arse from a whole in the ground when it comes to these MACs. It would be great it they could work together instead of against each other and stop adding more confusion to an already confusing situation. I digress whith my whinning.


I also ran a test as Linc Davis suggested on a post to someone else and I post the results above. I went through the results myself again to see if maybe when I was looking for the adware files I had done something wrong, but I didn't see any of the adware names that I have searched for so... I am hoping others who are more knowledge can take a look and tell me if they see anything. I did see the Bad plist in my results but I am not sure exactly what is meant by 'bad'. Are they 'bad' b/c they are adware or are they 'bad' because when they were installed something went wrong and bits are missing from them or other reasons. Anyway, any help would be great.


Bad plists


/Library/Preferences/DirectoryService/ContactsNodeConfig.plist

/Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist

/Library/Preferences/DirectoryService/DirectoryService.plist

/Library/Preferences/DirectoryService/DirectoryServiceDebug.plist

/Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist

/Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist

/Library/Preferences/DirectoryService/SearchNodeConfig.plist

/Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist

Jan 8, 2015 12:28 PM in response to Kurt Lang

I tried the TSMART.zip file but the problem is still there. I didn't find anything and the only thing that was placed in the trash by the TSMART file was the TSMART itself once it was done. I imagine that it is design to do that. It seems I have PJS-4.2 installed. I went to Extensions under Safari Prefererences and there were 0 extensions. Has anyone else been blessed with this PJS-4.2? Please help, I can't get to any pages in Safari that I actually want to get to and the only way I can get here is using Firefox which does not have any issues as of now.

How can I get rid of adware?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.