This isn't the first time this has happened.
Noticed i was uploading at high speed (8MB/s) constantly. So i check activity monitor, and kernel_task is uploading huge amount of data, so far 20+gb this morning (my ISP is going to be p*ssed).
I'm not getting a massive CPU usage (10-15%).
Tried restarting, just starts up again after a couple of minutes.
1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the behest of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed:
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts 51 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports 'com.autodesk.AutoCad com.evenflow.dropbox com.google.GoogleDrive' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n\t\t(%s)\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1000) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/d;/(etc|Preferences)\//s/^\.\/[^/]+//p;' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| ","||kMDItem'${p[35]}'=");sub("^.."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[9]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]" "$1;b=b$1;} END { if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' ' /^ +B/{ s/.+= |(-[0-9]+)?\.s.+//g;p;} ' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' 's/0/Off/p' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil PlistBuddy whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '-c Print /L*/P*/loginw*' '-c Print L*/P*/*loginit*' '-c Print L*/Saf*/*/E*.plist' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' '-c Print\ :'${p[35]}' 2>&1' '-c Print\ :Label 2>&1' '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' -i4TCP:0-1023 com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' );N1=${#c2[@]};for j in {0..8};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A1 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D22 4 4 50 0;D13 14 3 49 5;D12 26 48 59 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-Copy the selected text to the Clipboard by pressing the key combination command-C.
7. Launch the built-in Terminal application in any of the following ways:
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "syntax error," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start Time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
________________________________
Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.
I have the same problem, so I thought I'd give it a shot:
Start time: 01:12:02 05/17/15
Model Identifier: MacBookAir7,1
System Version: OS X 10.10.4 (14E17e)
Kernel Version: Darwin 14.4.0
Boot Mode: Normal
Time since boot: 1 day23:06
USB
Portable USB 3.0 Drive (Verbatim)
USB RECEIVER (Logitech Inc.)
FileVault: On
Diagnostic reports
2015-05-06 Google Chrome crash
2015-05-06 UserKernel crash
2015-05-06 cloudd crash
2015-05-07 SystemUIServer crash
2015-05-07 UserKernel crash
2015-05-07 UserKernel crash
2015-05-08 LolClient crash
2015-05-08 LolClient crash
2015-05-08 UserKernel crash
2015-05-13 QuickLookSatellite crash
2015-05-14 Airmail 2 crash
2015-05-14 Skype crash
2015-05-14 UserKernel crash
2015-05-16 LolClient crash
2015-05-16 UserKernel crash
2015-05-16 UserKernel crash
2015-05-16 UserKernel crash
2015-05-16 UserKernel crash
2015-05-16 mdworker crash
2015-05-16 mdworker crash
Log
May 16 23:13:11 CODE SIGNING: cs_invalid_page(0x10f2b3000): p=14594[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:18:16 CODE SIGNING: cs_invalid_page(0x107557000): p=14638[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:22:35 CODE SIGNING: cs_invalid_page(0x103ddd000): p=14722[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:22:43 CODE SIGNING: cs_invalid_page(0x10291c000): p=14730[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:27:48 CODE SIGNING: cs_invalid_page(0x10766b000): p=14750[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:33:35 CODE SIGNING: cs_invalid_page(0x10ccb8000): p=14812[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:38:47 CODE SIGNING: cs_invalid_page(0x10a6eb000): p=14863[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:43:53 CODE SIGNING: cs_invalid_page(0x108861000): p=14889[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:48:59 CODE SIGNING: cs_invalid_page(0x1003bf000): p=14902[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:54:07 CODE SIGNING: cs_invalid_page(0x107ff3000): p=14930[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 16 23:59:12 CODE SIGNING: cs_invalid_page(0x10cbab000): p=14946[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:04:18 CODE SIGNING: cs_invalid_page(0x10e0e7000): p=14979[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:09:24 CODE SIGNING: cs_invalid_page(0x10fce2000): p=14989[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:14:29 CODE SIGNING: cs_invalid_page(0x10b895000): p=14999[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:19:34 CODE SIGNING: cs_invalid_page(0x10a7eb000): p=15041[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:24:41 CODE SIGNING: cs_invalid_page(0x10cc96000): p=15060[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:29:46 CODE SIGNING: cs_invalid_page(0x104363000): p=15079[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:34:54 CODE SIGNING: cs_invalid_page(0x1058b7000): p=15096[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:40:01 CODE SIGNING: cs_invalid_page(0x1055de000): p=15132[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:45:11 CODE SIGNING: cs_invalid_page(0x1084fc000): p=15190[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:50:17 CODE SIGNING: cs_invalid_page(0x10b22b000): p=15213[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 00:55:25 CODE SIGNING: cs_invalid_page(0x1069de000): p=15225[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 01:00:29 CODE SIGNING: cs_invalid_page(0x108bdd000): p=15241[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 01:05:37 CODE SIGNING: cs_invalid_page(0x105e4b000): p=15310[hazelworker] final status 0x2000000, allowing (remove VALID) page
May 17 01:10:43 CODE SIGNING: cs_invalid_page(0x10206a000): p=15417[hazelworker] final status 0x2000000, allowing (remove VALID) page
Swap (MiB): 138173
Activity
CPU: user 12%, system 13%
Net: 214 in, 643 out (KiB/s)
Memory: kernel_task (UID 0) is using 1103 MB
Mach ports: CleanMyMac 3 Men (UID 501) is using 53860 ports
kexts
com.protech.NoSleep (1.4.0)
net.telestream.driver.TelestreamAudio (1.1.0)
org.pqrs.driver.Seil (11.1.0)
org.pqrs.driver.Karabiner (10.6.0)
com.regularrateandrhythm.driver.RowmoteIREmu (1.2)
com.Logitech.Control Center.HID Driver (3.7.0)
com.freecom.driver.BoulderScsi (1.0.0d1)
Daemons
com.macpaw.CleanMyMac3.Agent
com.oracle.java.JavaUpdateHelper
com.regularrateandrhythm.rowmotehelperaide
com.stclairsoft.Jettison.DriverHelper
im.kernelpanic.GrandHelper
com.microsoft.office.licensing.helper
com.rogueamoeba.instanton-agent
com.google.keystone.daemon
net.interacto.flavours.helper
com.adobe.SwitchBoard
com.adobe.fpsaud
com.macpaw.CleanMyMac2.Agent
org.macosforge.xquartz.privileged_startx
com.bjango.istatmenusdaemon
Agents
com.nateparrott.Flashlight.FlashlightSIMBLAgent
com.bjango.istatmenusagent
com.apple.macbuddy.icloudsetup.user
com.google.inputmethod.Japanese.Converter
com.google.keystone.system.agent
com.facebook.videochat.updater
com.valvesoftware.steamclean
org.macosforge.xquartz.startx
com.google.inputmethod.Japanese.Renderer
com.macpaw.CleanMyMac2Helper.trashWatcher
com.bjango.istatmenusnotifications
com.macpaw.CleanMyMac2Helper.scheduledScan
com.hp.help.tocgenerator
com.macpaw.CleanMyMac3.Scheduler
com.apple.FolderActions.folders
com.adobe.PDApp.AAMUpdatesNotifier.82392.UUID
com.Logitech.Control
net.culater.SIMBL.Agent
com.apple.AirPortBaseStationAgent
com.apple.FolderActions.enabled
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.bjango.istatmenusagent.plist
(com.bjango.istatmenusagent)
/Library/LaunchAgents/com.bjango.istatmenusnotifications.plist
(com.bjango.istatmenusnotifications)
/Library/LaunchAgents/com.google.inputmethod.Japanese.Converter.plist
(com.google.inputmethod.Japanese.Converter)
/Library/LaunchAgents/com.google.inputmethod.Japanese.Renderer.plist
(com.google.inputmethod.Japanese.Renderer)
/Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.system.agent)
/Library/LaunchAgents/com.hp.help.tocgenerator.plist
(com.hp.help.tocgenerator)
/Library/LaunchAgents/com.Logitech.Control Center.Daemon.plist
(N/A)
/Library/LaunchAgents/net.culater.SIMBL.Agent.plist
(net.culater.SIMBL.Agent)
/Library/LaunchAgents/org.freedesktop.dbus-session.plist
(org.freedesktop.dbus-session)
/Library/LaunchAgents/org.macosforge.xquartz.startx.plist
(org.macosforge.xquartz.startx)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.adobe.SwitchBoard.plist
(com.adobe.SwitchBoard)
/Library/LaunchDaemons/com.bjango.istatmenusdaemon.plist
(com.bjango.istatmenusdaemon)
/Library/LaunchDaemons/com.google.keystone.daemon.plist
(com.google.keystone.daemon)
/Library/LaunchDaemons/com.macpaw.CleanMyMac2.Agent.plist
(com.macpaw.CleanMyMac2.Agent)
/Library/LaunchDaemons/com.macpaw.CleanMyMac3.Agent.plist
(com.macpaw.CleanMyMac3.Agent)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist
(com.oracle.java.JavaUpdateHelper)
/Library/LaunchDaemons/com.regularrateandrhythm.rowmotehelperaide.plist
(com.regularrateandrhythm.rowmotehelperaide)
/Library/LaunchDaemons/com.rogueamoeba.instanton-agent.plist
(com.rogueamoeba.instanton-agent)
/Library/LaunchDaemons/com.stclairsoft.Jettison.DriverHelper.plist
(com.stclairsoft.Jettison.DriverHelper)
/Library/LaunchDaemons/im.kernelpanic.GrandHelper.plist
(im.kernelpanic.GrandHelper)
/Library/LaunchDaemons/net.interacto.flavours.helper.plist
(net.interacto.flavours.helper)
/Library/LaunchDaemons/org.freedesktop.dbus-system.plist
(org.freedesktop.dbus-system)
/Library/LaunchDaemons/org.macosforge.xquartz.privileged_startx.plist
(org.macosforge.xquartz.privileged_startx)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.apple.FolderActions.enabled.plist
(com.apple.FolderActions.enabled)
Library/LaunchAgents/com.apple.FolderActions.folders.plist
(com.apple.FolderActions.folders)
Library/LaunchAgents/com.facebook.videochat.plist
(com.facebook.videochat.updater)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.scheduledScan.plist
(com.macpaw.CleanMyMac2Helper.scheduledScan)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.trashWatcher.plist
(com.macpaw.CleanMyMac2Helper.trashWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac3.Scheduler.plist
(com.macpaw.CleanMyMac3.Scheduler)
Library/LaunchAgents/com.valvesoftware.steamclean.plist
(com.valvesoftware.steamclean)
Startup items
/Library/StartupItems/Jaksta/Jaksta
/Library/StartupItems/Jaksta/StartupParameters.plist
Bundles
/System/Library/Extensions/BoulderScsi.kext
(com.freecom.driver.BoulderScsi)
/System/Library/Extensions/JMicronATA.kext
(com.jmicron.JMicronATA)
/System/Library/Extensions/LogitechHIDDevices.kext
(N/A)
/System/Library/Extensions/LogitechUnifying.kext
(N/A)
/System/Library/Extensions/NoSleep.kext
(com.protech.NoSleep)
/System/Library/Extensions/TelestreamAudio.kext
(net.telestream.driver.TelestreamAudio)
/Library/Audio/Plug-Ins/Components/A52Codec.component
(com.shepmater.A52Codec)
/Library/Audio/Plug-Ins/HAL/InstantOn.driver
(com.rogueamoeba.InstantOn.driver)
/Library/Input Methods/GoogleJapaneseInput.app
(com.google.inputmethod.Japanese)
/Library/Internet Plug-Ins/AdobeExManDetect.plugin
(com.AdobeExManDetectLib.AdobeExManDetect)
/Library/Internet Plug-Ins/Flash Player.plugin
(N/A)
/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
(com.google.googletalkbrowserplugin)
/Library/Internet Plug-Ins/iPhotoPhotocast.plugin
(com.apple.plugin.iPhotoPhotocast)
/Library/Internet Plug-Ins/LogMeIn.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeIn.plugin/LogMeInPluginHost.app
(com.logmein.logmeinpluginhost)
/Library/Internet Plug-Ins/LogMeInSafari32.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeInSafari64.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/o1dbrowserplugin.plugin
(com.google.o1dbrowserplugin)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/PreferencePanes/AirServer.prefPane
(com.pratikkumar.airserver-prefs)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Logitech Control Center.prefPane
(N/A)
/Library/PreferencePanes/NoSleep.prefPane
(com.protech.NoSleepPref)
/Library/PreferencePanes/OSXFUSE.prefPane
(com.github.osxfuse.OSXFUSEPrefPane)
/Library/PreferencePanes/Perian.prefPane
(org.perian.PerianPane)
/Library/QuickTime/AC3MovieImport.component
(com.cod3r.ac3movieimport)
/Library/QuickTime/Perian.component
(org.perian.Perian)
/Library/ScriptingAdditions/Adobe Unit Types.osax
(N/A)
/Library/ScriptingAdditions/flavours-osax.osax
(net.interacto.flavours-osax)
/Library/ScriptingAdditions/SIMBL.osax
(net.culater.SIMBL.osax)
/Library/Widgets/CI Filter Browser.wdgt
(com.apple.CIFilterBrowser)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Caches/com.apple.Safari/Extensions/AdBlock-2.safariextension
(com.betafish.adblockforsafari)
Library/Caches/com.apple.Safari/Extensions/BackTrack-2.safariextension
(com.sidetree.BackTrack)
Library/Caches/com.apple.Safari/Extensions/Bit.ly Shortener.safariextension
(com.miguelcanijo.bitly)
Library/Caches/com.apple.Safari/Extensions/HoverSee.safariextension
(com.sidetree.HoverZoom)
Library/Caches/com.apple.Safari/Extensions/Picture To Tumblr.safariextension
(com.yourcompany.picturetotumblr)
Library/Caches/com.apple.Safari/Extensions/Save to Pocket-2.safariextension
(com.ideashower.pocket.safari)
Library/Internet Plug-Ins/FacebookVideoCalling.bundle
(com.skype.FacebookVideoCalling)
Library/PreferencePanes/Hazel.prefPane
(com.noodlesoft.Hazel)
Library/PreferencePanes/PastebotSync.prefPane
(com.tapbots.PastebotSync.prefPane)
Library/ScriptingAdditions/Flashlight.osax
(com.github.norio-nomura.Flashlight.osax)
Library/Services/'_' → ' '.workflow
(N/A)
Library/Services/blue label.workflow
(N/A)
Library/Services/Chrome で検索.workflow
(N/A)
Library/Services/copy.workflow
(N/A)
Library/Services/Folder → PDF.workflow
(N/A)
Library/Services/green label.workflow
(N/A)
Library/Services/iClipboardService.bundle
(N/A)
Library/Services/move to 0
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(N/A)
(com.hp.widget.inkwidget)
dylibs
/usr/lib/libdvdcss.2.dylib
Font issues: 18
DNS: 8.8.4.4 (static)
Restricted files: 1347
Safari extensions
AdBlock
HoverZoom
Bit.ly Shortener
Save to Pocket
BackTrack
Picture To Tumblr
Elapsed time (s): 410
You do not need to use cleaning programs. They can destroy your computer operation as they may already have done.
After un-installing, use this program to make sure you got all the pieces.
EasyFind – Spotlight Replacement
SIMBL is a sytem hack. Try removing it.
SIMBL Uninstall (2) See solution posted by Linc Davis .
Thanks for your help in advance.
I have the same problem, here is the output.
Start time: 15:31:34 03/03/16
Model Identifier: MacBookPro6,2
System Version: OS X 10.10.5 (14F27)
Kernel Version: Darwin 14.5.0
Boot Mode: Normal
Time since boot: 8:04
boot args: kext-dev-mode=1
Diagnostic reports
2016-02-20 uTorrent hang
2016-02-27 VLC crash
2016-03-01 MacKeeper Helper crash
2016-03-03 50onPaletteServer crash
Log
Mar 2 23:05:26 ZBFirewall.notifyClientsWithMessage: Error notifying client with uid 501: 55
Mar 2 23:05:55 process ss_conn_service[78] caught causing excessive wakeups. Observed wakeups rate (per sec): 317; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45072
Mar 2 23:09:07 process firefox[674] caught causing excessive wakeups. Observed wakeups rate (per sec): 197; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45014
Mar 3 07:27:48 OSUnserializeXML: syntax error near line 1
Mar 3 07:27:51 OSUnserializeXML: syntax error near line 1
Mar 3 07:27:57 OSUnserializeXML: syntax error near line 1
Mar 3 07:29:35 process ss_conn_service[81] caught causing excessive wakeups. Observed wakeups rate (per sec): 357; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45052
Mar 3 08:28:23 wl0: Beacon Loss Event
Mar 3 08:28:27 wl0: Roamed or switched channel, reason #2, bssid bc
Mar 3 08:28:52 process WindowServer[198] caught causing excessive wakeups. Observed wakeups rate (per sec): 195; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 68107
Mar 3 08:37:50 process firefox[4663] caught causing excessive wakeups. Observed wakeups rate (per sec): 170; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45055
Mar 3 09:33:29 jnl: disk3s5: replay_journal: from: 5193216 to: 7103488 (joffset 0x265000)
Mar 3 09:33:30 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x20, ASCQ = 0x00
Mar 3 09:33:30 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x20, ASCQ = 0x00
Mar 3 09:33:30 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x20, ASCQ = 0x00
Mar 3 09:33:30 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x20, ASCQ = 0x00
Mar 3 09:33:30 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x20, ASCQ = 0x00
Mar 3 09:33:32 jnl: disk3s5: journal replay done.
Mar 3 09:33:33 jnl: disk3s3: replay_journal: from: 5497344 to: 6456832 (joffset 0x3f64240000)
Mar 3 09:33:41 jnl: disk3s3: journal replay done.
Mar 3 09:40:46 process firefox[4663] caught causing excessive wakeups. Observed wakeups rate (per sec): 150; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 449567
Mar 3 10:36:03 process firefox[4663] thread 22355 caught burning CPU!; EXC_RESOURCE supressed due to audio playback
Mar 3 13:51:19 process firefox[4663] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
Mar 3 14:00:33 process trainchinese Des[19212] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
Mar 3 14:36:31 process firefox[4663] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
kexts
com.hzsystems.terminus.driver (4)
com.avast.PacketForwarder (2.0)
com.avast.AvastFileShield (3.0.0)
net.kromtech.kext.Firewall (2.3.8)
Daemons
com.pref.net-preferences
com.avast.uninstall
com.BlueStacks.AppPlayer.bstservice_helper
com.avast.daemon
com.devguru.ssconnservice
com.adobe.ARMDC.Communicator
com.avast.update
com.avast.proxy
com.zeobit.MacKeeper.plugin.AntiTheft.daemon
com.oracle.java.Helper-Tool
com.avast.service
com.avast.fileshield
com.avast.account
com.mackeeper.AntiVirus
com.5e275556e95e3ba9.config
cn.com.zte.PPPMonitor.plist
com.adobe.fpsaud
com.adobe.ARMDC.SMJobBlessHelper
com.avast.crashreport
com.Immiscibly.helper
com.avast.init
Agents
com.avast.home.userinit
com.avast.userinit
com.avast.helper
com.adobe.ARM.UUID
com.microsoft.OneDriveLauncher
com.Immiscibly.agent
com.adobe.ARMDCHelper.UUID
com.oracle.java.Java-Updater
com.avast.update-agent
com.paragon.updater
com.spotify.webhelper
com.zeobit.MacKeeper.Helper
com.google.keystone.user.agent
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist
(com.adobe.ARMDCHelper.UUID)
/Library/LaunchAgents/com.avast.update-agent.plist
(com.avast.update-agent)
/Library/LaunchAgents/com.avast.userinit.plist
(com.avast.userinit)
/Library/LaunchAgents/com.immiscibly.agent.plist
(com.Immiscibly.agent)
/Library/LaunchAgents/com.oracle.java.Java-Updater.plist
(com.oracle.java.Java-Updater)
/Library/LaunchAgents/com.paragon.updater.plist
(com.paragon.updater)
/Library/LaunchDaemons/cn.com.zte.PPPMonitor.plist
(cn.com.zte.PPPMonitor.plist)
/Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist
(com.adobe.ARMDC.Communicator)
/Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist
(com.adobe.ARMDC.SMJobBlessHelper)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.avast.init.plist
(com.avast.init)
/Library/LaunchDaemons/com.avast.uninstall.plist
(com.avast.uninstall)
/Library/LaunchDaemons/com.avast.update.plist
(com.avast.update)
/Library/LaunchDaemons/com.BlueStacks.AppPlayer.bstservice_helper.plist
(com.BlueStacks.AppPlayer.bstservice_helper)
/Library/LaunchDaemons/com.devguru.ssconnservice.plist
(com.devguru.ssconnservice)
/Library/LaunchDaemons/com.immiscibly.daemon.plist
(com.Immiscibly.daemon)
/Library/LaunchDaemons/com.immiscibly.helper.plist
(com.Immiscibly.helper)
/Library/LaunchDaemons/com.khutuktuUpd.plist
(com.5e275556e95e3ba9.config)
/Library/LaunchDaemons/com.mackeeper.AntiVirus.plist
(com.mackeeper.AntiVirus)
/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
(com.oracle.java.Helper-Tool)
/Library/LaunchDaemons/com.pantaloon.net-preferences.plist
(com.pref.net-preferences)
/Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist
(com.zeobit.MacKeeper.plugin.AntiTheft.daemon)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.avast.home.userinit.plist
(com.avast.home.userinit)
Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.user.agent)
Library/LaunchAgents/com.spotify.webhelper.plist
(com.spotify.webhelper)
Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist
(com.zeobit.MacKeeper.Helper)
Bundles
/System/Library/Extensions/RoxioBluRaySupport.kext
(com.roxio.BluRaySupport)
/System/Library/Extensions/ssuddrv.kext
(com.devguru.driver.SamsungComposite)
/System/Library/Extensions/Terminus.kext
(com.hzsystems.terminus.driver)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
(com.adobe.acrobat.pdfviewerNPAPI)
/Library/Internet Plug-Ins/Flash Player.plugin
(N/A)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.oracle.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/JavaControlPanel.prefPane
(com.oracle.java.JavaControlPanel)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Internet Plug-Ins/Picasa.plugin
(com.google.PicasaPlugin)
Library/ScriptingAdditions/EasySIMBL.osax
(net.culater.SIMBL)
dylibs
/usr/lib/LibSideSyncOSX9.dylib
/usr/lib/ss_conn_lib.dylib
Contents of /etc/sysctl.conf
net.inet.tcp.sendspace=131072
net.inet.tcp.recvspace=131072
Listeners
launchd: afpovertcp
launchd: afpovertcp
launchd: microsoft-ds
launchd: microsoft-ds
kdc: kerberos
Restricted files: 11
Elapsed time (s): 183
Thanks for your hints. This solved my problems.
I must say, I am going to miss MacKeeper. It was kind of fun, but maybe this is the reason why it shouldn't have been installed.
Any idea for a good anti-virus software?
Tom
Any idea for a good anti-virus software?
None. OS X protects itself. This is not Windows.
How does Mac OS X protect me?
Hello
I Have the same problem
Can you help me?
Start time: 14:48:05 04/19/16
Model Identifier: MacBookPro9,1
System Version: OS X 10.11.4 (15E65)
Kernel Version: Darwin 15.4.0
Boot Mode: Normal
System Integrity Protection: Enabled
Memory
BANK 0/DIMM0:
Size: 8 GB
Speed: 1600 MHz
Status: OK
Manufacturer: 0x830B
BANK 1/DIMM0:
Size: 8 GB
Speed: 1600 MHz
Status: OK
Manufacturer: 0x830B
USB
Hub (Texas Instruments)
Vendor-Specific Device (Samsung Electronics Co., Ltd.)
Hub (Texas Instruments)
My Book 111A (Western Digital Technologies, Inc.)
USB Audio DAC (Texas Instruments Japan)
UDisk (Integrated Technology Express, Inc.)
Android (USB Developer)
FileVault: On
Diagnostic reports
2016-03-29 AdobeReader hang
2016-04-05 SymDaemon crash
2016-04-08 mds_stores crash
2016-04-12 mds_stores crash
2016-04-18 mds_stores crash
Log
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 SAM Multimedia: READ or WRITE failed, SENSE_KEY = 0x05, ASC = 0x21, ASCQ = 0x00
Apr 19 13:27:11 disk3: I/O error.
Apr 19 13:58:41 WARNING: hibernate_page_list_setall skipped 68711 xpmapped pages
Apr 19 13:58:41 WARNING: hibernate_page_list_setall skipped 95904 xpmapped pages
Apr 19 13:58:41 453105.043345 AppleUSB20HubPort@14220000: AppleUSB20HubPort::resetAndCreateDevice: asserting Reset
Apr 19 14:10:37 WARNING: hibernate_page_list_setall skipped 95904 xpmapped pages
Apr 19 14:10:37 WARNING: hibernate_page_list_setall skipped 96410 xpmapped pages
Swap (MiB): 1505
Activity
I/O: 208 ops/s, 26477 blocks/s
Net: 137 in, 7363 out (KiB/s)
CPU per process: backupd (UID 0) is using 41 %
Memory: NFMWps (UID 70) is using 1645 MB
Mach ports: HP Device Monito (UID 501) is using 197640 ports
kexts
com.symantec.internetSecurity.kext (7.0.2f26) UUID
com.symantec.ips.kext (7.0.2f26) no UUID
com.symantec.nfm.kext (7.0.2f26) UUID
com.parallels.virtualsound (1.0.36 36) UUID
com.parallels.virtualhid (1.0.3 3) UUID
com.parallels.kext.usbconnect (10.4.0 29337) UUID
com.parallels.kext.hypervisor (10.4.0 29337) UUID
com.parallels.kext.netbridge (10.4.0 29337) UUID
com.parallels.kext.vnic (10.4.0 29337) UUID
Daemons
com.symantec.symdaemon.NFM
com.parallels.mobile.kextloader.launchdaemon
com.adobe.ARMDC.Communicator
com.parallels.mobile.dispatcher.launchdaemon
com.symantec.sharedsettings.NFM
com.microsoft.autoupdate.helpertool
com.symantec.UninstallerToolHelper
com.teamviewer.service
com.symantec.nfm.wps
com.symantec.liveupdate.daemon.NFM
com.microsoft.office.licensingV2.helper
com.adobe.fpsaud
com.adobe.ARMDC.SMJobBlessHelper
com.symantec.SymLUHelper.NFM
com.symantec.deepsight-extractor
com.teamviewer.Helper
com.symantec.errorreporting.NFM.periodic
Agents
com.adobe.PDApp.AAMUpdatesNotifier.171872.UUID
com.adobe.ARMDCHelper.UUID
com.parallels.mobile.startgui.launchagent
com.teamviewer.desktop
com.hp.devicemonitor
com.parallels.desktop.console.80032.UUID
com.parallels.mobile.prl_deskctl_agent.launchagent
com.teamviewer.teamviewer
com.google.keystone.user.agent
com.symantec.errorreporting.NFM.periodic-agent
com.symantec.uiagent.application.NFM
com.pcv.hlpramc
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist
(com.adobe.ARMDCHelper.UUID)
/Library/LaunchAgents/com.parallels.mobile.prl_deskctl_agent.launchagent.plist
(com.parallels.mobile.prl_deskctl_agent.launchagent)
/Library/LaunchAgents/com.symantec.errorreporter-periodicagent.NFM.plist
(com.symantec.errorreporting.NFM.periodic-agent)
/Library/LaunchAgents/com.symantec.uiagent.application.NFM.plist
(com.symantec.uiagent.application.NFM)
/Library/LaunchAgents/com.teamviewer.teamviewer.plist
(com.teamviewer.teamviewer)
/Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist
(com.teamviewer.desktop)
/Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist
(com.adobe.ARMDC.Communicator)
/Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist
(com.adobe.ARMDC.SMJobBlessHelper)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.microsoft.autoupdate.helpertool.plist
(com.microsoft.autoupdate.helpertool)
/Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist
(com.microsoft.office.licensingV2.helper)
/Library/LaunchDaemons/com.parallels.mobile.dispatcher.launchdaemon.plist
(com.parallels.mobile.dispatcher.launchdaemon)
/Library/LaunchDaemons/com.parallels.mobile.kextloader.launchdaemon.plist
(com.parallels.mobile.kextloader.launchdaemon)
/Library/LaunchDaemons/com.symantec.deepsight-extractor.NFM.plist
(com.symantec.deepsight-extractor)
/Library/LaunchDaemons/com.symantec.errorreporter-periodic.NFM.plist
(com.symantec.errorreporting.NFM.periodic)
/Library/LaunchDaemons/com.symantec.liveupdate.daemon.NFM.plist
(com.symantec.liveupdate.daemon.NFM)
/Library/LaunchDaemons/com.symantec.nfm.wps.plist
(com.symantec.nfm.wps)
/Library/LaunchDaemons/com.symantec.sharedsettings.NFM.plist
(com.symantec.sharedsettings.NFM)
/Library/LaunchDaemons/com.symantec.symdaemon.NFM.plist
(com.symantec.symdaemon.NFM)
/Library/LaunchDaemons/com.symantec.SymLUHelper.NFM.plist
(com.symantec.SymLUHelper.NFM)
/Library/LaunchDaemons/com.symantec.UninstallerToolHelper.NFM.plist
(com.symantec.UninstallerToolHelper)
/Library/LaunchDaemons/com.teamviewer.Helper.plist
(com.teamviewer.Helper)
/Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist
(com.teamviewer.service)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.user.agent)
Library/LaunchAgents/com.parallels.mobile.startgui.launchagent.plist
(com.parallels.mobile.startgui.launchagent)
Library/LaunchAgents/com.pcv.hlpramc.plist
(com.pcv.hlpramc)
Bundles
/System/Library/Extensions/hp_fax_io.kext
(com.hp.kext.hp-fax-io)
/System/Library/Extensions/NortonForMac.kext
(com.symantec.nfm.kext)
/System/Library/Extensions/SymInternetSecurity.kext
(com.symantec.internetSecurity.kext)
/System/Library/Extensions/SymIPS.kext
(com.symantec.ips.kext)
/Library/Extensions/hp_fax_io.kext
(com.hp.kext.hp-fax-io)
/Library/Extensions/NortonForMac.kext
(com.symantec.nfm.kext)
/Library/Extensions/SymInternetSecurity.kext
(com.symantec.internetSecurity.kext)
/Library/Extensions/SymIPS.kext
(com.symantec.ips.kext)
/Library/Input Methods/ParallelsIM.app
(com.parallels.inputmethod.ParallelsIM)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
(com.adobe.acrobat.pdfviewerNPAPI)
/Library/Internet Plug-Ins/Flash Player.plugin
(N/A)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.apple.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle
(com.teamviewer.AuthorizationPlugin)
/Library/Services/Norton for Mac.service
(com.symantec.nfm.service)
Library/Caches/com.apple.Safari/Extensions/Norton Security-2.safariextension
(com.symantec.nfm.nortonsecurity)
Library/Caches/com.apple.Safari/Extensions/Norton Security-3.safariextension
(com.symantec.nfm.nortonsecurity)
Library/Caches/com.apple.Safari/Extensions/Norton Security-4.safariextension
(com.symantec.nfm.nortonsecurity)
Library/Caches/com.apple.Safari/Extensions/Norton Security.safariextension
(com.symantec.nfm.nortonsecurity)
Restricted files: 1130
Safari extensions
Norton Security
Elapsed time (s): 395
By any chance do you have TimeMachine Backups enabled ? This would be the kernel_task to backup over the network to the time capsule.
-Vik
I'm experiencing the same, here are my details (I have since removed Clean My Mac):
Start time: 09:45:44 06/07/16
Model Identifier: MacPro6,1
System Version: OS X 10.11.4 (15E65)
Kernel Version: Darwin 15.4.0
Boot Mode: Normal
System Integrity Protection: Enabled
Thunderbolt
T3 Thunderbolt 2 (CalDigit, Inc.)
USB
Jabra PRO 9470 (GN Netcom)
USB2.0 Hub (Genesys Logic, Inc.)
Diagnostic reports
2016-05-26 CalDigit Drive Utility crash
2016-05-27 Adobe Flash Player Install Manager crash
2016-05-30 Mail crash
2016-05-31 VShieldScanManager crash
2016-06-06 accountsd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
2016-06-07 fmpd crash
Log
Jun 6 18:26:43 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:26:44 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:26:44 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:26:45 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:26:45 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:26:46 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:26:46 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:26:47 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:26:47 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:26:48 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:26:48 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:26:49 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:26:49 AFP_VFS afpfs_DoReconnect: connect on /Volumes/Data failed 51.
Jun 6 18:27:02 ASP_TCP asp_SetTCPQoS: sock_settclassopt got error 57
Jun 6 18:27:41 smb2_smb_parse_change_notify: smb_rq_reply failed 60
Jun 7 07:31:38 process prl_vm_app[23814] caught causing excessive wakeups. Observed wakeups rate (per sec): 17687; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 190673
Jun 7 07:32:26 process prl_vm_app[23814] caught causing excessive wakeups. Observed wakeups rate (per sec): 1065; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 237589
Jun 7 07:34:23 process prl_vm_app[24062] caught causing excessive wakeups. Observed wakeups rate (per sec): 30902; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 126108
Jun 7 07:35:40 process prl_vm_app[24062] caught causing excessive wakeups. Observed wakeups rate (per sec): 979; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 746417
Jun 7 07:48:54 process prl_vm_app[25282] caught causing excessive wakeups. Observed wakeups rate (per sec): 19976; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 100276
Jun 7 07:49:55 process prl_vm_app[25282] caught causing excessive wakeups. Observed wakeups rate (per sec): 982; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 162390
Jun 7 08:28:59 process prl_vm_app[28626] caught causing excessive wakeups. Observed wakeups rate (per sec): 29722; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 239843
Jun 7 08:29:48 process prl_vm_app[28605] caught causing excessive wakeups. Observed wakeups rate (per sec): 778; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 61796
Jun 7 08:30:44 process prl_vm_app[28626] caught causing excessive wakeups. Observed wakeups rate (per sec): 901; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 316905
Jun 7 09:01:18 process firefox[12297] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
Swap (MiB): 1830
Memory: SystemUIServer (UID 501) is using 6351 MB
kexts
com.techsmith.TACC (1.0.2) UUID
com.intelsecurity.FileCore (1) UUID
com.McAfee.AVKext (1) UUID
Daemons
com.mcafee.ssm.Eupdate
com.cisco.anyconnect.vpnagentd
com.mcafee.agent.macmn
com.macpaw.CleanMyMac3.Agent
com.mcafee.virusscan.ssm.ScanFactory
com.adobe.adobeupdatedaemon
com.mcafee.agent.macompat
com.apple.installer.osmessagetracing
com.microsoft.office.licensing.helper
com.google.keystone.daemon
Adobe_Genuine_Software_Integrity_Service
com.oracle.java.Helper-Tool
com.mcafee.virusscan.fmpd
com.microsoft.office.licensingV2.helper
com.mcafee.agent.ma
com.equinux.VPNTracker8.agent
com.adobe.fpsaud
com.mcafee.ssm.ScanManager
com.purevpn.macapp.HelperTool
Agents
com.jabra.skype
2BUA8C4S2C.com.agilebits.onepassword4-helper
com.adobe.AdobeCreativeCloud
com.omnigroup.OmniCrashCatcher.i1
com.jabra.sametime
com.citrix.ServiceRecords
com.adobe.ARM.UUID
com.google.keystone.system.agent
com.jdibackup.JustCloud.autostart
com.omnigroup.OmniCrashCatcher.i2
com.pgi.imeet
com.jdibackup.JustCloud.notify
com.cisco.anyconnect.gui
com.citrix.ReceiverHelper
com.omnigroup.OmniCrashCatcher.i3
com.jabra.avaya
com.citrix.AuthManager_Mac
com.jabra.bria
com.mcafee.reporter
com.sierrawireless.SwitchTool
com.oracle.java.Java-Updater
com.mcafee.menulet
com.macpaw.CleanMyMac3.Scheduler
com.jabra.appservice
com.citrixonline.GoToMeeting.G2MUpdate
com.apple.AirPortBaseStationAgent
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/System/Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist
(com.apple.installer.osmessagetracing)
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist
(com.adobe.AdobeCreativeCloud)
/Library/LaunchAgents/com.cisco.anyconnect.gui.plist
(com.cisco.anyconnect.gui)
/Library/LaunchAgents/com.citrix.AuthManager_Mac.plist
(com.citrix.AuthManager_Mac)
/Library/LaunchAgents/com.citrix.ReceiverHelper.plist
(com.citrix.ReceiverHelper)
/Library/LaunchAgents/com.citrix.ServiceRecords.plist
(com.citrix.ServiceRecords)
/Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.system.agent)
/Library/LaunchAgents/com.jabra.appservice.plist
(com.jabra.appservice)
/Library/LaunchAgents/com.jabra.avaya.plist
(com.jabra.avaya)
/Library/LaunchAgents/com.jabra.bria.plist
(com.jabra.bria)
/Library/LaunchAgents/com.jabra.sametime.plist
(com.jabra.sametime)
/Library/LaunchAgents/com.jabra.skype.plist
(com.jabra.skype)
/Library/LaunchAgents/com.mcafee.menulet.plist
(com.mcafee.menulet)
/Library/LaunchAgents/com.mcafee.reporter.plist
(com.mcafee.reporter)
/Library/LaunchAgents/com.oracle.java.Java-Updater.plist
(com.oracle.java.Java-Updater)
/Library/LaunchAgents/com.sierrawireless.SwitchTool.plist
(com.sierrawireless.SwitchTool)
/Library/LaunchDaemons/com.adobe.adobeupdatedaemon.plist
(com.adobe.adobeupdatedaemon)
/Library/LaunchDaemons/com.adobe.agsservice.plist
(Adobe_Genuine_Software_Integrity_Service)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist
(com.cisco.anyconnect.vpnagentd)
/Library/LaunchDaemons/com.equinux.VPNTracker8.agent.plist
(com.equinux.VPNTracker8.agent)
/Library/LaunchDaemons/com.google.keystone.daemon.plist
(com.google.keystone.daemon)
/Library/LaunchDaemons/com.macpaw.CleanMyMac3.Agent.plist
(com.macpaw.CleanMyMac3.Agent)
/Library/LaunchDaemons/com.mcafee.agent.ma.plist
(N/A)
/Library/LaunchDaemons/com.mcafee.agent.macmn.plist
(N/A)
/Library/LaunchDaemons/com.mcafee.agent.macompat.plist
(N/A)
/Library/LaunchDaemons/com.mcafee.ssm.Eupdate.plist
(com.mcafee.ssm.Eupdate)
/Library/LaunchDaemons/com.mcafee.ssm.ScanFactory.plist
(com.mcafee.virusscan.ssm.ScanFactory)
/Library/LaunchDaemons/com.mcafee.ssm.ScanManager.plist
(com.mcafee.ssm.ScanManager)
/Library/LaunchDaemons/com.mcafee.virusscan.fmpd.plist
(com.mcafee.virusscan.fmpd)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist
(com.microsoft.office.licensingV2.helper)
/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
(com.oracle.java.Helper-Tool)
/Library/LaunchDaemons/com.purevpn.macapp.HelperTool.plist
(com.purevpn.macapp.HelperTool)
/Library/LaunchDaemons/org.virtualbox.startup.plist
(org.virtualbox.startup)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.citrixonline.GoToMeeting.G2MUpdate.plist
(com.citrixonline.GoToMeeting.G2MUpdate)
Library/LaunchAgents/com.jdibackup.JustCloud.autostart.plist
(com.jdibackup.JustCloud.autostart)
Library/LaunchAgents/com.jdibackup.JustCloud.notify.plist
(com.jdibackup.JustCloud.notify)
Library/LaunchAgents/com.macpaw.CleanMyMac3.Scheduler.plist
(com.macpaw.CleanMyMac3.Scheduler)
Library/LaunchAgents/com.pgi.imeet.plist
(com.pgi.imeet)
Library/LaunchAgents/org.virtualbox.vboxwebsrv.plist
(org.virtualbox.vboxwebsvc)
Startup items
/Library/StartupItems/cma/cma.sh
Bundles
/System/Library/Extensions/ExtMediaBSDClient.kext
(net.sf.driver.ExtMediaBSDClient)
/System/Library/Extensions/hp_fax_io.kext
(com.hp.kext.hp-fax-io)
/System/Library/Extensions/hp_Inkjet1_io_enabler.kext
(com.hp.print.hpio.Inkjet1.kext)
/System/Library/Extensions/JabraUSB.kext
(com.jabra.usbdevice)
/System/Library/Extensions/JMicronATA.kext
(com.jmicron.JMicronATA)
/System/Library/Extensions/SierraDIPSupport.kext
(com.sierrawireless.driver.SierraDIPSupport)
/System/Library/Extensions/SierraFSRSupport.kext
(com.sierrawireless.driver.SierraFSRSupport)
/System/Library/Extensions/SierraHSRSupport.kext
(com.sierrawireless.driver.SierraHSRSupport)
/System/Library/Extensions/SierraIPDirect.kext
(com.sierrawireless.driver.SierraIPDirect)
/Library/Extensions/CalDigitRAID.kext
(CalDigit.CalDigitRAID)
/Library/Extensions/com.equinux.VPNTracker8.kext
(com.equinux.VPNTracker8)
/Library/Extensions/hp_fax_io.kext
(com.hp.kext.hp-fax-io)
/Library/Extensions/hp_Inkjet1_io_enabler.kext
(com.hp.print.hpio.Inkjet1.kext)
/Library/Extensions/hp_io_enabler_compound.kext
(com.hp.kext.io.enabler.compound)
/Library/Extensions/JabraUSB.kext
(com.jabra.usbdevice)
/Library/Extensions/TACC.kext
(com.techsmith.TACC)
/Library/Internet Plug-Ins/AdobeAAMDetect.plugin
(com.AdobeAAMDetectLib.AdobeAAMDetect)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
(com.adobe.acrobat.pdfviewerNPAPI)
/Library/Internet Plug-Ins/CitrixICAClientPlugIn.plugin
(com.citrix.citrixicaclientplugIn)
/Library/Internet Plug-Ins/Flash Player.plugin
(N/A)
/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
(com.google.googletalkbrowserplugin)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.oracle.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/o1dbrowserplugin.plugin
(com.google.o1dbrowserplugin)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/Internet Plug-Ins/Web Control.plugin
(com.mcafee.webprotectionplugin)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Jabra Suite for Mac.prefPane
(com.gnnet.Jabra)
/Library/PreferencePanes/JavaControlPanel.prefPane
(com.oracle.java.JavaControlPanel)
/Library/ScriptingAdditions/Adobe Unit Types.osax
(N/A)
Library/Address Book Plug-Ins/SkypeABCaller.bundle
(com.skype.SkypeABCaller)
Library/Address Book Plug-Ins/SkypeABChatter.bundle
(com.skype.SkypeABChatter)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Caches/com.apple.Safari/Extensions/1Password-2.safariextension
(com.agilebits.onepassword4-safari)
Library/Caches/com.apple.Safari/Extensions/OpenIE.safariextension
(com.parallels.openinie)
Library/Caches/com.apple.Safari/Extensions/Web Control.safariextension
(com.mcafee.webprotection)
Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin
(com.citrixonline.mac.WebDeploymentPlugin)
Library/Internet Plug-Ins/ScreenShare Helper.plugin
(N/A)
Library/Internet Plug-Ins/SkypeForBusinessPlugin-15.8.bundle
(com.microsoft.skypeforbusiness.plugin)
Library/Internet Plug-Ins/SkypeForBusinessPlugin-16.0.bundle
(com.microsoft.skypeforbusiness.plugin-16.0)
Library/Internet Plug-Ins/WebEx64.plugin
(com.cisco_webex.plugin.gpc64)
Contents of /etc/hosts
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
Contents of /etc/pf.conf
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
Contents of /etc/syslog.conf
install.* @127.0.0.1:32376
local7.* /var/log/McAfeeSecurity.log
Contents of /etc/periodic/daily/110.clean-tmps
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_clean_tmps_enable" in
[Yy][Ee][Ss])
if [ -z "$daily_clean_tmps_days" ]
then
echo '$daily_clean_tmps_enable is set but' \
'$daily_clean_tmps_days is not'
rc=2
else
echo ""
echo "Removing old temporary files:"
set -f noglob
args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"
args="${args} -ctime +$daily_clean_tmps_days"
dargs="-empty -mtime +$daily_clean_tmps_days"
dargs="${dargs} ! -name .vfs_rsrc_streams_*"
[ -n "$daily_clean_tmps_ignore" ] && {
args="$args "`echo " ${daily_clean_tmps_ignore% }" |
sed 's/[ ][ ]*/ ! -name /g'`
dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |
sed 's/[ ][ ]*/ ! -name /g'`
...and 21 more line(s)
Contents of /etc/periodic/daily/130.clean-msgs
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_clean_msgs_enable" in
[Yy][Ee][Ss])
if [ ! -d /var/msgs ]
then
echo '$daily_clean_msgs_enable is set but /var/msgs' \
"doesn't exist"
rc=2
else
echo ""
echo "Cleaning out old system announcements:"
[ -n "$daily_clean_msgs_days" ] &&
arg=-${daily_clean_msgs_days#-} || arg=
msgs -c $arg && rc=0 || rc=3
fi;;
*) rc=0;;
esac
exit $rc
Contents of /etc/periodic/daily/140.clean-rwho
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_clean_rwho_enable" in
[Yy][Ee][Ss])
if [ -z "$daily_clean_rwho_days" ]
then
echo '$daily_clean_rwho_enable is enabled but' \
'$daily_clean_rwho_days is not set'
rc=2
elif [ ! -d /var/rwho ]
then
echo '$daily_clean_rwho_enable is enabled but /var/rwho' \
"doesn't exist"
rc=2
else
echo ""
echo "Removing stale files from /var/rwho:"
case "$daily_clean_rwho_verbose" in
[Yy][Ee][Ss])
print=-print;;
*)
print=;;
...and 14 more line(s)
Contents of /etc/periodic/daily/199.clean-fax
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
if [ -d /var/spool/fax ]; then
echo ""
echo "Removing scratch fax files"
cd /var/spool/fax && \
find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;
fi
Contents of /etc/periodic/daily/310.accounting
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_accounting_enable" in
[Yy][Ee][Ss])
if [ ! -f /var/account/acct ]
then
echo '$daily_accounting_enable is set but /var/account/acct' \
"doesn't exist"
rc=2
elif [ -z "$daily_accounting_save" ]
then
echo '$daily_accounting_enable is set but ' \
'$daily_accounting_save is not'
rc=2
else
echo ""
echo "Rotating accounting logs and gathering statistics:"
cd /var/account
rc=0
n=$daily_accounting_save
rm -f acct.$n.gz acct.$n || rc=3
m=$n
...and 18 more line(s)
Contents of /etc/periodic/daily/400.status-disks
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_status_disks_enable" in
[Yy][Ee][Ss])
echo ""
echo "Disk status:"
df $daily_status_disks_df_flags && rc=1 || rc=3
;;
*) rc=0;;
esac
exit $rc
Contents of /etc/periodic/daily/420.status-network
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_status_network_enable" in
[Yy][Ee][Ss])
echo ""
echo "Network interface status:"
case "$daily_status_network_usedns" in
[Yy][Ee][Ss])
netstat -i && rc=0 || rc=3;;
*)
netstat -in && rc=0 || rc=3;;
esac;;
*) rc=0;;
esac
exit $rc
Contents of /etc/periodic/daily/430.status-rwho
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_status_rwho_enable" in
[Yy][Ee][Ss])
rwho=$(echo /var/rwho/*)
if [ -f "${rwho%% *}" ]
then
echo ""
echo "Local network system status:"
prog=ruptime
else
echo ""
echo "Local system status:"
prog=uptime
fi
rc=$($prog | tee /dev/stderr | wc -l)
if [ $? -eq 0 ]
then
[ $rc -gt 1 ] && rc=1
else
rc=3
fi;;
...and 3 more line(s)
Contents of /etc/periodic/daily/999.local
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
rc=0
for script in $daily_local
do
echo ''
case "$script" in
/*)
if [ -f "$script" ]
then
echo "Running $script:"
sh $script || rc=3
else
echo "$script: No such file"
[ $rc -lt 2 ] && rc=2
fi;;
*)
echo "$script: Not an absolute path"
[ $rc -lt 2 ] && rc=2;;
esac
done
exit $rc
Contents of /etc/periodic/monthly/199.rotate-fax
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
echo ""
printf %s "Rotating fax log files:"
cd /var/log/fax
for i in *.log; do
if [ -f "${i}" ]; then
echo -n " $i"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
echo ""
Contents of /etc/periodic/monthly/200.accounting
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
oldmask=$(umask)
umask 066
case "$monthly_accounting_enable" in
[Yy][Ee][Ss])
W=/var/log/wtmp
rc=0
remove=NO
if [ $rc -eq 0 ]
then
echo ""
echo "Doing login accounting:"
rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)
[ $rc -gt 0 ] && rc=1
fi
[ $remove = YES ] && rm -f $W.0;;
*) rc=0;;
esac
umask $oldmask
exit $rc
Contents of /etc/periodic/monthly/999.local
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
rc=0
for script in $monthly_local
do
echo ''
case "$script" in
/*)
if [ -f "$script" ]
then
echo "Running $script:"
sh $script || rc=3
else
echo "$script: No such file"
[ $rc -lt 2 ] && rc=2
fi;;
*)
echo "$script: Not an absolute path"
[ $rc -lt 2 ] && rc=2;;
esac
done
exit $rc
Contents of /etc/periodic/weekly/320.whatis
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$weekly_whatis_enable" in
[Yy][Ee][Ss])
echo ""
echo "Rebuilding whatis database:"
MANPATH=`/usr/bin/manpath -q`
if [ $? = 0 ]
then
if [ -z "${MANPATH}" ]
then
echo "manpath failed to find any manpage directories"
rc=3
else
rc=0
/usr/libexec/makewhatis.local "${MANPATH}" || rc=3
if [ X"${man_locales}" != X ]
then
for i in ${man_locales}
do
LC_ALL=$i /usr/libexec/makewhatis.local -a \
-L "${MANPATH}" || rc=3
...and 9 more line(s)
Contents of /etc/periodic/weekly/999.local
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
rc=0
for script in $weekly_local
do
echo ''
case "$script" in
/*)
if [ -f "$script" ]
then
echo "Running $script:"
sh $script || rc=3
else
echo "$script: No such file"
[ $rc -lt 2 ] && rc=2
fi;;
*)
echo "$script: Not an absolute path"
[ $rc -lt 2 ] && rc=2;;
esac
done
exit $rc
Contents of /Library/Preferences/com.apple.security.appsandbox.plist (XML document text)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>UnrestrictSpotlightContainerScope</key>
<true/>
</dict>
</plist>
Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (XML document text)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Kernel Flags</key>
<string></string>
</dict>
</plist>
Root crontab
45 16 * * * /usr/local/McAfee/AntiMalware/VShieldTaskManager 4 >> /dev/null 2>&1
2 12 30 3 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 13 >> /dev/null 2>&1
1 12 6 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 22 >> /dev/null 2>&1
1 12 7 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 24 >> /dev/null 2>&1
1 12 12 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 32 >> /dev/null 2>&1
1 12 13 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 33 >> /dev/null 2>&1
1 12 14 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 36 >> /dev/null 2>&1
1 12 18 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 38 >> /dev/null 2>&1
Listeners
launchd: afpovertcp
launchd: afpovertcp
launchd: microsoft-ds
launchd: microsoft-ds
kdc: kerberos
User crontab
# iBackup start
# min hour mday month wday command
0 0 * * 0 '/Applications/iBackup.app/Contents/MacOS/iBackup' > /dev/null 2>&1
0 0 * * 0 echo 2 >> '~/Library/Application Support/iBackup/actionlist'
# iBackup end
Restricted files: 2125
Safari extensions
OpenIE
Elapsed time (s): 308
Thanks,
James.
Remove McAfee. Find the McAfee uninstall instructions and use them.
com.mcafee.agent.macmn
com.mcafee.virusscan.ssm.ScanFactory
com.mcafee.agent.macompat
com.mcafee.virusscan.fmpd
com.mcafee.agent.ma
com.mcafee.ssm.ScanManager
com.mcafee.reporter
com.mcafee.menulet
/Library/LaunchAgents/com.mcafee.menulet.plist
(com.mcafee.menulet)
/Library/LaunchAgents/com.mcafee.reporter.plist
(com.mcafee.reporter)
/Library/LaunchDaemons/com.mcafee.agent.ma.plist
(N/A)
/Library/LaunchDaemons/com.mcafee.agent.macmn.plist
(N/A)
/Library/LaunchDaemons/com.mcafee.agent.macompat.plist
(N/A)
/Library/LaunchDaemons/com.mcafee.ssm.Eupdate.plist
(com.mcafee.ssm.Eupdate)
/Library/LaunchDaemons/com.mcafee.ssm.ScanFactory.plist
(com.mcafee.virusscan.ssm.ScanFactory)
/Library/LaunchDaemons/com.mcafee.ssm.ScanManager.plist
(com.mcafee.ssm.ScanManager)
/Library/LaunchDaemons/com.mcafee.virusscan.fmpd.plist
(com.mcafee.virusscan.fmpd)
Library/Caches/com.apple.Safari/Extensions/Web Control.safariextension
(com.mcafee.webprotection)
45 16 * * * /usr/local/McAfee/AntiMalware/VShieldTaskManager 4 >> /dev/null 2>&1
2 12 30 3 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 13 >> /dev/null 2>&1
1 12 6 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 22 >> /dev/null 2>&1
1 12 7 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 24 >> /dev/null 2>&1
1 12 12 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 32 >> /dev/null 2>&1
1 12 13 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 33 >> /dev/null 2>&1
1 12 14 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 36 >> /dev/null 2>&1
1 12 18 4 * /usr/local/McAfee/AntiMalware/VShieldTaskManager 38 >> /dev/null 2>&1
You still have CleanMyMac stuff installed. Find the proper uninstall instructions and use them
Library/LaunchAgents/com.macpaw.CleanMyMac3.Scheduler.plist
(com.macpaw.CleanMyMac3.Scheduler)
com.macpaw.CleanMyMac3.Agent
com.macpaw.CleanMyMac3.Scheduler
/Library/LaunchDaemons/com.macpaw.CleanMyMac3.Agent.plist
(com.macpaw.CleanMyMac3.Agent)
There may be other issues, but that is a good start.
McAfee Uninstall Resources is near bottom of the page
After un-installing, use this program to make sure you got all the pieces.
Hi, I'm seeing unusual upload network traffic from kernel_task as well. can you help me identify the offending apps?
thanks,
Vidya
Start time: 14:49:13 08/12/16
Model Identifier: iMac17,1
System Version: OS X 10.11.6 (15G31)
Kernel Version: Darwin 15.6.0
Boot Mode: Normal
System Integrity Protection: Enabled
Diagnostic reports
2016-07-22 Google Drive crash
2016-08-04 Finder crash
Log
Aug 11 08:44:26 disk1s3: alignment error.
Aug 11 08:44:26 disk1s3: alignment error.
Aug 11 08:44:27 [IGPU] Scheduler Throttle Cap = 100ms.
Aug 11 08:44:47 utun_start: ifnet_disable_output returned error 12
Aug 12 04:10:19 WARNING: hibernate_page_list_setall skipped 46709 xpmapped pages
Aug 12 09:17:04 WARNING: hibernate_page_list_setall skipped 46709 xpmapped pages
Aug 12 09:17:04 thr <ptr> data_mover_thread: failed to move data, err=4
Aug 12 09:17:04 WARNING: hibernate_page_list_setall skipped 3990 xpmapped pages
Aug 12 11:14:39 ALF: ifnet_get_address_list_family error 12
Aug 12 11:17:17 Can't load kext org.virtualbox.kext.VBoxUSB - failed to resolve library dependencies.
Aug 12 11:17:17 Kext org.virtualbox.kext.VBoxUSB failed to load (0xdc00800e).
Aug 12 11:17:17 Failed to load kext org.virtualbox.kext.VBoxUSB (error 0xdc00800e).
Aug 12 11:17:17 AssertMacros: tmpData (value: 0x0), file: /BuildRoot/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager/AppleCre dentialManager-83.40.3/AppleCredentialManager/AppleCredentialManager.cpp, line: 785
Aug 12 11:17:17 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x2ae49edad1e42d27, provider is 0x2ae49eda12ac2d27
Aug 12 11:17:17 init: error getting PHY_MODE; using MODE_UNKNOWN
Aug 12 11:17:18 disk2: alignment error.
Aug 12 11:17:18 disk2: alignment error.
Aug 12 11:17:18 disk1s1: alignment error.
Aug 12 11:17:18 disk1s1: alignment error.
Aug 12 11:17:18 ** GPU Hardware VM is enabled (multispace: enabled, page table updates with DMA: enabled, non-contiguous VRAM: enabled)
Aug 12 11:17:18 disk1s3: alignment error.
Aug 12 11:17:18 disk1s3: alignment error.
Aug 12 11:17:18 [IGPU] Will fallback to host-side scheduling if graphics firmware fails to load
Aug 12 11:17:19 [IGPU] Scheduler Throttle Cap = 100ms.
Aug 12 11:17:39 utun_start: ifnet_disable_output returned error 12
CPU per process: Google Chrome He (UID 503) is using 45.3 %
Current downstream data: Activity Monitor (UID 502) is using 89.0743 KiB/s
kexts
foo.tun (1.0) UUID
foo.tap (1.0) UUID
Daemons
com.intego.task.manager.daemon
com.microsoft.autoupdate.helpertool
com.intego.commonservices.icalserver
com.contentwatch.NetNanny.daemon
com.microsoft.office.licensing.helper
net.openvpn.client
com.teamviewer.service
com.google.keystone.daemon
com.bombich.ccc.scheduledtask.UUID
com.oracle.java.Helper-Tool
com.microsoft.office.licensingV2.helper
com.intego.netupdate.daemon
com.intego.VirusBarrierX6.daemon
com.intego.VirusBarrierX6.scanner.daemon
com.adobe.fpsaud
org.macosforge.xquartz.privileged_startx
com.bombich.ccc.scheduledtask.UUID
com.intego.commonservices.daemon
com.bombich.ccc
Agents
com.intego.VirusBarrierX6.alert
ws.agile.1PasswordAgent
com.intego.netupdate.agent
2BUA8C4S2C.com.agilebits.onepassword4-helper
com.google.keystone.system.agent
org.macosforge.xquartz.startx
com.intego.VirusBarrierX6.statusitem
com.teamviewer.desktop
com.oracle.java.Java-Updater
com.hp.help.tocgenerator
com.shirtpocket.backupbytime
com.intego.task.manager.notifier
com.teamviewer.teamviewer
com.divx.update.agent
jp.co.canon.CUPSCAPT.BackGrounder
com.contentwatch.NetNanny.agent
com.seagate.SeagateStorageGauge.plist
com.divx.dms.agent
com.google.Chrome.framework.service_process~/Library/Application_Support/Google /Chrome
launchd
/System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
(com.apple.AirPortBaseStationAgent)
/Library/LaunchAgents/com.contentwatch.NetNanny.agent.plist
(com.contentwatch.NetNanny.agent)
/Library/LaunchAgents/com.divx.dms.agent.plist
(com.divx.dms.agent)
/Library/LaunchAgents/com.divx.update.agent.plist
(com.divx.update.agent)
/Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.system.agent)
/Library/LaunchAgents/com.hp.help.tocgenerator.plist
(com.hp.help.tocgenerator)
/Library/LaunchAgents/com.intego.netupdate.agent.plist
(com.intego.netupdate.agent)
/Library/LaunchAgents/com.intego.task.manager.notifier.plist
(com.intego.task.manager.notifier)
/Library/LaunchAgents/com.intego.VirusBarrierX6.alert.plist
(com.intego.VirusBarrierX6.alert)
/Library/LaunchAgents/com.intego.VirusBarrierX6.statusitem.plist
(com.intego.VirusBarrierX6.statusitem)
/Library/LaunchAgents/com.oracle.java.Java-Updater.plist
(com.oracle.java.Java-Updater)
/Library/LaunchAgents/com.seagate.SeagateStorageGauge.plist
(com.seagate.SeagateStorageGauge.plist)
/Library/LaunchAgents/com.teamviewer.teamviewer.plist
(com.teamviewer.teamviewer)
/Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist
(com.teamviewer.desktop)
/Library/LaunchAgents/jp.co.canon.CUPSCAPT.BG.plist
(jp.co.canon.CUPSCAPT.BackGrounder)
/Library/LaunchAgents/org.macosforge.xquartz.startx.plist
(org.macosforge.xquartz.startx)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.bombich.ccc.plist
(com.bombich.ccc)
/Library/LaunchDaemons/com.bombich.ccc.scheduledtask.UUID.plist
(com.bombich.ccc.scheduledtask.UUID)
/Library/LaunchDaemons/com.bombich.ccc.scheduledtask.UUID.plist
(com.bombich.ccc.scheduledtask.UUID)
/Library/LaunchDaemons/com.contentwatch.NetNanny.daemon.plist
(com.contentwatch.NetNanny.daemon)
/Library/LaunchDaemons/com.google.keystone.daemon.plist
(com.google.keystone.daemon)
/Library/LaunchDaemons/com.intego.commonservices.daemon.plist
(com.intego.commonservices.daemon)
/Library/LaunchDaemons/com.intego.commonservices.icalserver.plist
(com.intego.commonservices.icalserver)
/Library/LaunchDaemons/com.intego.netupdate.daemon.plist
(com.intego.netupdate.daemon)
/Library/LaunchDaemons/com.intego.task.manager.daemon.plist
(com.intego.task.manager.daemon)
/Library/LaunchDaemons/com.intego.VirusBarrierX6.daemon.plist
(com.intego.VirusBarrierX6.daemon)
/Library/LaunchDaemons/com.intego.VirusBarrierX6.scanner.daemon.plist
(com.intego.VirusBarrierX6.scanner.daemon)
/Library/LaunchDaemons/com.microsoft.autoupdate.helpertool.plist
(com.microsoft.autoupdate.helpertool)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist
(com.microsoft.office.licensingV2.helper)
/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
(com.oracle.java.Helper-Tool)
/Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist
(com.teamviewer.service)
/Library/LaunchDaemons/net.openvpn.client.plist
(net.openvpn.client)
/Library/LaunchDaemons/org.macosforge.xquartz.privileged_startx.plist
(org.macosforge.xquartz.privileged_startx)
Library/LaunchAgents/com.apple.FolderActions.enabled.plist
(com.apple.FolderActions.enabled)
Library/LaunchAgents/com.apple.FolderActions.folders.plist
(com.apple.FolderActions.folders)
Library/LaunchAgents/com.google.Chrome.framework.plist
(com.google.Chrome.framework.service_process~/Library/Application_Support/Googl e/Chrome)
Library/LaunchAgents/com.shirtpocket.backupbytime.plist
(com.shirtpocket.backupbytime)
Library/LaunchAgents/ws.agile.1PasswordAgent.plist
(ws.agile.1PasswordAgent)
Startup items
/Library/StartupItems/HP Trap Monitor/HP Trap Monitor
/Library/StartupItems/HP Trap Monitor/StartupParameters.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Info.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/MacOS/Net Nanny Daemon
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Resources/CBX5SafeSearch.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Resources/GamesFilters.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Resources/No access.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Resources/No restriction.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Resources/Restricted access.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/Resources/uninstall.sh
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/SharedSupport/Net Nanny Agent.app/Contents/Info.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/SharedSupport/Net Nanny Agent.app/Contents/MacOS/Net Nanny Agent
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/SharedSupport/NetNanny Installer.app/Contents/Info.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/SharedSupport/NetNanny Installer.app/Contents/MacOS/NetNanny Installer
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/SharedSupport/NetNanny Updater.app/Contents/Info.plist
/Library/StartupItems/NetNanny/Net Nanny Daemon.app/Contents/SharedSupport/NetNanny Updater.app/Contents/MacOS/NetNanny Updater
/Library/StartupItems/VirtualBox/StartupParameters.plist
/Library/StartupItems/VirtualBox/VirtualBox
Bundles
/System/Library/Extensions/CiscoVPN.kext
(com.cisco.nke.ipsec)
/System/Library/Extensions/JMicronATA.kext
(com.jmicron.JMicronATA)
/System/Library/Extensions/NetNannyBootTime.kext
(com.contentwatch.netnanny.BootTime)
/System/Library/Extensions/Seagate Storage Driver.kext
(com.seagate.driver.PowSecDriverCore)
/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
(info.emagic.driver.unitor)
/Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component
(net.telestream.wmv.import)
/Library/Audio/Plug-Ins/Components/voxReducer.component
(com.loudsoftware.audiounit.voxReducer)
/Library/Extensions/VBoxDrv.kext
(org.virtualbox.kext.VBoxDrv)
/Library/Extensions/VBoxNetAdp.kext
(org.virtualbox.kext.VBoxNetAdp)
/Library/Extensions/VBoxNetFlt.kext
(org.virtualbox.kext.VBoxNetFlt)
/Library/Extensions/VBoxUSB.kext
(org.virtualbox.kext.VBoxUSB)
/Library/Intego/IntegoStatusItem.bundle
(com.intego.statusitem)
/Library/Intego/netupdated.bundle
(com.intego.NetUpdateDaemon)
/Library/Intego/TaskManager/TM_Notifier.app
(com.intego.TM_Notifier)
/Library/Internet Plug-Ins/DivX Web Player.plugin
(com.divx.DivXWebPlayer)
/Library/Internet Plug-Ins/Flash Player.plugin
(N/A)
/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
(net.telestream.wmv.plugin)
/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
(com.Google.GoogleEarthPlugin.plugin)
/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
(com.google.googletalkbrowserplugin)
/Library/Internet Plug-Ins/iPhotoPhotocast.plugin
(com.apple.plugin.iPhotoPhotocast)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.oracle.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/net.juniper.DSSafariExtensions.plugin
(net.juniper.DSSafariExtensions.plugin)
/Library/Internet Plug-Ins/o1dbrowserplugin.plugin
(com.google.o1dbrowserplugin)
/Library/Internet Plug-Ins/OVSHelper.plugin
(com.divx.OVSHelper)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/Internet Plug-Ins/VLC Plugin.plugin
(com.netscape.vlc)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Flip4Mac WMV.prefPane
(net.telestream.wmv.prefpane)
/Library/PreferencePanes/JavaControlPanel.prefPane
(com.oracle.java.JavaControlPanel)
/Library/PreferencePanes/MacFUSE.prefPane
(com.google.MacFUSE)
/Library/PreferencePanes/NetUpdate.prefPane
(com.intego.preference.netupdate)
/Library/QuickTime/Flip4Mac WMV Advanced.component
(net.telestream.wmv.advanced)
/Library/QuickTime/Flip4Mac WMV Export.component
(net.telestream.wmv.export)
/Library/QuickTime/Flip4Mac WMV Import.component
(net.telestream.wmv.import)
/Library/QuickTime/XviD_Codec 1.0 alpha.component
(com.yourcompany.XviD_Codec)
/Library/Services/VirusBarrier X6 Service.service
(com.intego.VirusBarrier_X6_Service)
/Library/Spotlight/GBSpotlightImporter.mdimporter
(com.apple.garageband.spotlightimporter)
/Library/Spotlight/iWeb.mdimporter
(com.apple.MDImporter.iWeb)
/Library/Widgets/CI Filter Browser.wdgt
(com.apple.CIFilterBrowser)
/Library/Widgets/Intego Status.wdgt
(com.intego.widget)
/Library/Widgets/NetUpdate.wdgt
(com.intego.widget.netupdate)
/Library/Widgets/Network Connect.wdgt
(net.juniper.widget.NetworkConnect)
/Library/Widgets/VirusBarrier Monitor.wdgt
(com.intego.widget.virusbarrier.monitor)
Library/Caches/com.apple.Safari/Extensions/1Password.safariextension
(com.agilebits.onepassword4-safari)
Library/PreferencePanes/SizzlingKeys.prefPane
(com.yellowmug.SizzlingKeys4iTunes)
Library/Widgets/Humor of the Day.wdgt
(N/A)
Library/Widgets/iStat Pro.wdgt
(com.iSlayer.iStatpro4.widget)
Library/Widgets/Say Cheese 2.wdgt
(N/A)
Bad plists
Library/Preferences/com.apple.iphotomosaic.plist
Listeners
launchd: afpovertcp
launchd: afpovertcp
launchd: microsoft-ds
launchd: microsoft-ds
launchd: printer
launchd: ssh
launchd: printer
launchd: ssh
openvpn-s: 946
openvpn-s: 946
kdc: kerberos
cupsd: ipp
User crontab
30 20 * * 4 ~/Library/Application\ Support/SuperDuper\!/Scheduled\ Copies/SDUtil -i || open file://~/Library/Application\%20Support/SuperDuper\%21/Scheduled\%20Copies/Eras e\%20Mother\%20Boot\%20Bkup\%2C\%20then\%20copy\%20files\%20from\%20Mac\%20Drive .sdsp/Copy\%20Job.app
00 05 * * 1 ~/Library/Application\ Support/SuperDuper\!/Scheduled\ Copies/SDUtil -i || open file://~/Library/Application\%20Support/SuperDuper\%21/Scheduled\%20Copies/Smar t\%20Update\%20Media-backup\%20from\%20Mother\%20Media\%20Bkup.sdsp/Copy\%20Job. app
Restricted files: 9201
Safari extensions
1Password
Widgets
Say Cheese 2
High file counts
Desktop: 84
Elapsed time (s): 156
kernel_task massive upload (no high cpu usage)
