R_GAU

Q: Is it a virus?

Hi all,

I was just browsing my folio site from my macbook pro, and this window pop up with the message like this:

 

Hi my name is Lara Grace and we have selected you to participate in a 30 second survey about **** Please tell me about you ***** usage and in exchange we will give you a nice gift =)

Want to know what your gift is? Complete the survey to find out.


overlaid message:

Congratulations **** visitor,

Congratulations! You have been selected to participate in an anonymous survey for ****

At the end of the short survey, you will be offered an exclusive gift for your participation.

                                                                                                     

                                                                                                  Accept

 

This seems like I picked up some sort of malware but i am not sure what should I do with situation like this, can anybody help, please?

 

 

<Edited by Host>

Posted on Jun 29, 2014 8:43 PM

Close

Q: Is it a virus?

  • All replies
  • Helpful answers

  • by dominic23,

    dominic23 dominic23 Jun 24, 2014 3:54 AM in response to R_GAU
    Level 8 (41,832 points)
    Mac OS X
    Jun 24, 2014 3:54 AM in response to R_GAU

    Force Quit .

     

    Press command + option + esc keys together at the same time. Wait.

    When Force Quit window appears, select the Safari if not already.

    Press Force Quit button at the bottom of the window.   Wait.

    Safari will quit.

     

    Relaunch Safari holding the shift key down.

     

     

    Identify and remove adware/malware

     

    http://www.thesafemac.com/arg/

    http://www.thesafemac.com/mmg/

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Jun 24, 2014 7:28 AM in response to R_GAU
    Level 10 (208,000 points)
    Applications
    Jun 24, 2014 7:28 AM in response to R_GAU

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

     

    Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

     

    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

     

    There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

     

    3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the behest of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

     

    Here's a summary of what you need to do, if you choose to proceed:

     

    • Copy a line of text in this window to the Clipboard.
    • Paste into the window of another application.
    • Wait for the test to run. It usually takes a few minutes.
    • Paste the results, which will have been copied automatically, back into a reply on this page.

     

    The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

     

    4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

     

    5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

     

    6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

     

    Triple-click anywhere in the line of text below on this page to select it:

     

    PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts 51 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports 'com.autodesk.AutoCad com.evenflow.dropbox com.google.GoogleDrive' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */  /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1000) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/d;/(etc|Preferences)\//s/^\.\/[^/]+//p;' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| ","||kMDItem'${p[35]}'=");sub("^.."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[9]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]" "$1;b=b$1;} END { if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n  "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n  [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n  ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' ' /^ +B/{ s/.+= |(-[0-9]+)?\.s.+//g;p;} ' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' 's/0/Off/p' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil PlistBuddy whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '-c Print /L*/P*/loginw*' '-c Print L*/P*/*loginit*' '-c Print L*/Saf*/*/E*.plist' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' '-c Print\ :'${p[35]}' 2>&1' '-c Print\ :Label 2>&1' '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' -i4TCP:0-1023 com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' );N1=${#c2[@]};for j in {0..8};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A1 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D22 4 4 50 0;D13 14 3 49 5;D12 26 48 59 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-
    

     

    Copy the selected text to the Clipboard by pressing the key combination command-C.

     

    7. Launch the built-in Terminal application in any of the following ways:

     

    • Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
    • In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
    • Open LaunchPad. Click Utilities, then Terminal in the icon grid.

     

    Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

    8. If you see an error message in the Terminal window such as "syntax error," enter

    exec bash

     

    and press return. Then paste the script again.

     

    9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

     

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

     

    10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

    [Process completed]

     

    to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

     

    11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

     

    At the top of the results, there will be a line that begins with the words "Start Time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

     

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

     

    12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

     

    Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

    ________________________________

     

    Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

     

  • by Rach_Gau,

    Rach_Gau Rach_Gau Jun 24, 2014 5:57 PM in response to Linc Davis
    Level 1 (0 points)
    Jun 24, 2014 5:57 PM in response to Linc Davis

    Thanks for the explanation, I ran the procedure and got the result now.

    http://pastebin.com/wwFCASRS

  • by Linc Davis,

    Linc Davis Linc Davis Jun 24, 2014 6:39 PM in response to Rach_Gau
    Level 10 (208,000 points)
    Applications
    Jun 24, 2014 6:39 PM in response to Rach_Gau

    If you are the original poster in this discussion, please sign in with the same Apple ID you used in your first message.

  • by R_GAU,

    R_GAU R_GAU Jun 29, 2014 8:39 PM in response to Linc Davis
    Level 1 (0 points)
    Jun 29, 2014 8:39 PM in response to Linc Davis

    Sorry, I had a bit problem with my Apple ID, but now it is fixed.

    Again, thanks for the detailed explanation. I've pasted the result here on Pastebin.

    Here is the link:

    http://pastebin.com/9FmXYhvK

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Jun 29, 2014 10:37 PM in response to R_GAU
    Level 10 (208,000 points)
    Applications
    Jun 29, 2014 10:37 PM in response to R_GAU

    A.

     

    From the Safari menu bar, select

            

              Safari Preferences... Extensions

         

    Delete all extensions.

     

    B.

     

    You're on a wide-open Wi-Fi network. If it's your network, that's very dangerous. The network should be protected by WPA 2 security.

     

    C.

     

    If you get the popups only on your website, and you continue to get them after removing the Safari extensions, then the site has been hacked.

  • by thomas_r.,Solvedanswer

    thomas_r. thomas_r. Jun 30, 2014 5:38 AM in response to R_GAU
    Level 7 (30,924 points)
    Mac OS X
    Jun 30, 2014 5:38 AM in response to R_GAU

    You have at least some parts of the Genieo and Vidx adware installed. See my Adware Removal Guide for help removing all components.

     

    In addition, you have modifications to your hosts file that I believe are made to prevent pirated versions of Adobe apps from phoning home. If you have installed any pirated software, you need to remove it immediately, and never download any such thing again, as that's likely what led to the adware infection in the first place. You could be infected with some kind of malware as well, for all we know.

     

    (Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

  • by dougfromseeley lake,

    dougfromseeley lake dougfromseeley lake Jun 7, 2015 5:51 PM in response to Linc Davis
    Level 1 (0 points)
    Jun 7, 2015 5:51 PM in response to Linc Davis

    Start time: 18:31:10 06/07/15

     

    Model Identifier: MacBookPro6,2

    System Version: Mac OS X 10.6.8 (10K549)

    Kernel Version: Darwin 10.8.0

    Boot Mode: Normal

    64-bit Kernel and Extensions: No

     

    kexts

     

      e.iokit.IOACPIFamily (1.3.0)

      e.iokit.IOPCIFamily (2.6.5)

      e.driver.AppleACPIPlatform (1.3.6)

      e.driver.AppleIntelCPUPowerManagement (142.6.0)

      e.iokit.IOStorageFamily (1.6.3)

      e.driver.DiskImages (289)

      e.nke.applicationfirewall (2.1.14)

      e.kext.AppleMatch (1.0.0d1)

      e.security.quarantine (0)

      e.security.sandbox (1)

      e.security.TMSafetyNet (6)

      e.driver.AppleIntelCPUPowerManagementClient (142.6.0)

      e.driver.AppleAPIC (1.4)

      e.iokit.IOSMBusFamily (1.1)

      e.driver.AppleACPIEC (1.3.6)

      e.driver.AppleSMBIOS (1.7)

      e.driver.AppleHPET (1.5)

      e.driver.AppleRTC (1.3.1)

      e.iokit.IOHIDFamily (1.6.6)

      e.driver.AppleACPIButtons (1.3.6)

      e.driver.AppleEFIRuntime (1.4.0)

      e.iokit.IOUSBFamily (4.2.4)

      e.driver.AppleUSBEHCI (4.2.4)

      e.driver.AppleSmartBatteryManager (160.0.0)

      e.driver.AppleEFINVRAM (1.4.0)

      e.iokit.IOAHCIFamily (2.0.6)

      e.driver.AppleAHCIPort (2.1.7)

      e.iokit.IOUSBUserClient (4.2.4)

      e.iokit.IOFireWireFamily (4.2.6)

      e.driver.AppleFWOHCI (4.7.3)

      e.driver.AppleUSBHub (4.2.4)

      e.AppleFSCompression.AppleFSCompressionTypeZlib (1.0.0d1)

      e.BootCache (31.1)

      e.iokit.IOAHCIBlockStorage (1.6.4)

      e.iokit.IOSCSIArchitectureModelFamily (2.6.8)

      e.iokit.IOAHCISerialATAPI (1.2.6)

      e.driver.XsanFilter (402.1)

      e.iokit.IOCDStorageFamily (1.6.1)

      e.iokit.IODVDStorageFamily (1.6)

      e.iokit.IOBDStorageFamily (1.6)

      e.iokit.IOSCSIMultimediaCommandsDevice (2.6.8)

      e.iokit.SCSITaskUserClient (2.6.8)

      e.driver.AppleUSBComposite (3.9.0)

      e.driver.AppleUSBMergeNub (4.2.4)

      e.iokit.IOUSBHIDDriver (4.2.0)

      e.driver.AppleUSBTCKeyboard (201.6)

      e.driver.AppleUSBMultitouch (207.7)

      e.driver.AppleIRController (303.8)

      e.iokit.IOSCSIBlockCommandsDevice (2.6.8)

      e.iokit.IOUSBMassStorageClass (2.6.7)

      e.driver.AppleUSBCardReader (2.6.1)

      e.iokit.IOBluetoothFamily (2.4.5f3)

      e.driver.AppleUSBBluetoothHCIController (2.4.5f3)

      e.driver.BroadcomUSBBluetoothHCIController (2.4.5f3)

      e.driver.AppleUSBTCButtons (201.6)

      e.iokit.IOGraphicsFamily (2.2.1)

      e.iokit.IONDRVSupport (2.2.1)

      e.NVDAResman (6.4.0)

      e.nvidia.nv50hal (6.4.0)

      e.driver.AppleSMC (3.1.0d5)

      e.kext.AppleSMCLMU (1.5.2d10)

      e.driver.AppleBacklightExpert (1.0.1)

      e.driver.AppleLPC (1.5.1)

      e.driver.AppleSMBusPCI (1.0.10d0)

      e.driver.IOPlatformPluginFamily (4.7.0a1)

      e.driver.ACPI_SMC_PlatformPlugin (4.7.0a1)

      e.iokit.IONetworkingFamily (1.10)

      e.iokit.IO80211Family (320.1)

      e.driver.AirPortBrcm43224 (428.42.4)

      e.GeForce (6.4.0)

      e.driver.AppleGraphicsControl (2.10.6)

      e.iokit.IOHDAFamily (2.0.5f14)

      e.driver.AppleHDAController (2.0.5f14)

      e.iokit.AppleProfileFamily (41)

      e.iokit.IOFireWireIP (2.0.3)

      e.iokit.AppleBCM5701Ethernet (3.0.5b8)

      e.driver.SMCMotionSensor (3.0.1d2)

      e.driver.AppleIntelHDGraphicsFB (6.4.0)

      e.kext.OSvKernDSPLib (1.3)

      e.iokit.IOAudioFamily (1.8.3fc2)

      e.driver.IOBluetoothA2DPAudioDriver (2.4.5f3)

      e.driver.AppleSMBusController (1.0.10d0)

      e.driver.AppleMCCSControl (1.0.20)

      e.driver.DspFuncLib (2.0.5f14)

      e.driver.AppleHDA (2.0.5f14)

      e.driver.AudioIPCDriver (1.1.6)

      e.driver.AppleIntelHDGraphics (6.4.0)

      e.driver.AudioAUUC (1.57)

      e.driver.AppleMikeyDriver (2.0.5f14)

      e.driver.AppleUpstreamUserClient (3.5.7)

      e.Dont_Steal_Mac_OS_X (7.0.0)

      e.driver.AppleMikeyHIDDriver (1.2.0)

      ols.iantivirus.kfs (1.0.1)

      e.iokit.IOSerialFamily (10.0.3)

      e.iokit.IOBluetoothSerialManager (2.4.5f3)

      e.iokit.IOSurface (74.2)

      ing74.driver.Soundflower (1.5.2)

      e.driver.AppleProfileCallstackAction (20)

      e.driver.AppleProfileKEventAction (10)

      e.driver.AGPM (100.12.31)

      e.driver.AppleProfileRegisterStateAction (10)

      e.driver.AppleProfileThreadInfoAction (14)

      e.driver.AppleProfileTimestampAction (10)

      e.driver.AppleProfileReadCounterAction (17)

      e.filesystems.autofs (2.1.0)

      e.driver.AppleHWSensor (1.9.3d0)

     

    Daemons

     

      com.google.keystone.daemon

      com.adobe.fpsaud

     

    Agents

     

      org.x.startx

      com.google.keystone.system.agent

      com.amazon.music

      com.amazon.cloud-player

     

    launchd

     

      /System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist

      -    com.apple.AirPortBaseStationAgent

      /System/Library/LaunchAgents/com.apple.java.InstallOnDemand.plist

      -    com.apple.java.InstallOnDemandAgent

      /System/Library/LaunchAgents/com.apple.java.updateSharing.plist

      -    com.apple.java.updateSharing

      /System/Library/LaunchAgents/com.apple.mrt.uiagent.plist

      -    com.apple.mrt.uiagent

      /System/Library/LaunchAgents/com.apple.noticeboard.plist

      -    com.apple.noticeboard

      /System/Library/LaunchAgents/com.apple.servernotifyd.plist

      -    com.apple.servernotifyd

      /System/Library/LaunchAgents/com.apple.ServiceManagement.LoginItems.plist

      -    com.apple.ServiceManagement.LoginItems

      /System/Library/LaunchAgents/com.apple.store_helper.plist

      -    com.apple.store_helper

      /System/Library/LaunchAgents/com.apple.storeagent.plist

      -    com.apple.storeagent

      /System/Library/LaunchAgents/org.x.startx.plist

      -    org.x.startx

      /System/Library/LaunchDaemons/com.apple.applepushserviced.plist

      -    com.apple.applepushserviced

      /System/Library/LaunchDaemons/com.apple.awacsd.plist

      -    com.apple.awacsd

      /System/Library/LaunchDaemons/com.apple.crsud.plist

      -    com.apple.crsud

      /System/Library/LaunchDaemons/com.apple.DiagnosticReportCleanUp.plist

      -    com.apple.DiagnosticReportCleanUp

      /System/Library/LaunchDaemons/com.apple.mrt.plist

      -    com.apple.mrt

      /System/Library/LaunchDaemons/com.apple.storereceiptinstaller.plist

      -    com.apple.storereceiptinstaller

      /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist

      -    com.apple.xprotectupdater

      /System/Library/LaunchDaemons/com.apple.xprotectupdaterinit.plist

      -    com.apple.xprotectupdater-init

      /Library/LaunchAgents/com.google.keystone.agent.plist

      -    com.google.keystone.system.agent

      /Library/LaunchDaemons/com.adobe.fpsaud.plist

      -    com.adobe.fpsaud

      /Library/LaunchDaemons/com.apple.third_party_32b_kext_logger.plist

      -    com.apple.third_party_32b_kext_logger

      /Library/LaunchDaemons/com.google.keystone.daemon.plist

      -    com.google.keystone.daemon

      Library/LaunchAgents/com.amazon.cloud-player.plist

      -    com.amazon.cloud-player

      Library/LaunchAgents/com.amazon.music.plist

      -    com.amazon.music

     

    Startup items

     

      /Library/StartupItems/WDBMService/StartupParameters.plist

      /Library/StartupItems/WDBMService/WDBMService

      /Library/StartupItems/WDBMService/WDButtonManager.app/Contents/Info.plist

      /Library/StartupItems/WDBMService/WDButtonManager.app/Contents/MacOS/WDButtonMa nager

      /Library/StartupItems/WDBMService/WDButtonManager.app/Contents/Resources/Info-M onacoBackground__Upgraded_.plist

     

    Bundles

     

      /System/Library/Extensions/AmbrosiaAudioSupport.kext

      -    com.AmbrosiaSW.AudioSupport

      /System/Library/Extensions/AppleBacklightExpert.kext

      -    com.apple.driver.AppleBacklightExpert

      /System/Library/Extensions/AppleIntelSNBGraphicsFB.kext

      -    com.apple.driver.AppleIntelSNBGraphicsFB

      /System/Library/Extensions/AppleIntelSNBVA.bundle

      -    com.apple.AppleIntelSNBFBVA

      /System/Library/Extensions/AppleMCCSControl.kext

      -    com.apple.driver.AppleMCCSControl

      /System/Library/Extensions/AppleMCP89RootPortPM.kext

      -    com.apple.driver.AppleMCP89RootPortPM

      /System/Library/Extensions/AppleSDXC.kext

      -    com.apple.driver.AppleSDXC

      /System/Library/Extensions/AppleThunderboltDPAdapters.kext

      -    com.apple.driver.AppleThunderboltDPAdapters

      /System/Library/Extensions/AppleThunderboltEDMService.kext

      -    com.apple.driver.AppleThunderboltEDMService

      /System/Library/Extensions/AppleThunderboltNHI.kext

      -    com.apple.driver.AppleThunderboltNHI

      /System/Library/Extensions/AppleThunderboltPCIAdapters.kext

      -    com.apple.driver.AppleThunderboltPCIAdapters

      /System/Library/Extensions/AppleThunderboltUTDM.kext

      -    com.apple.iokit.AppleThunderboltUTDM

      /System/Library/Extensions/ATI5000Controller.kext

      -    com.apple.kext.ATI5000Controller

      /System/Library/Extensions/ATI6000Controller.kext

      -    com.apple.kext.ATI6000Controller

      /System/Library/Extensions/ATIRadeonX3000.kext

      -    com.apple.ATIRadeonX3000

      /System/Library/Extensions/ATIRadeonX3000GA.plugin

      -    com.apple.ATIRadeonX3000GA

      /System/Library/Extensions/ATIRadeonX3000GLDriver.bundle

      -    com.apple.ATIRadeonX3000GLDriver

      /System/Library/Extensions/ATIRadeonX3000VADriver.bundle

      -    com.apple.ATIRadeonX3000VADriver

      /System/Library/Extensions/exfat.kext

      -    com.apple.filesystems.exfat

      /System/Library/Extensions/iavkfs.kext

      -    com.pctools.iantivirus.kfs

      /System/Library/Extensions/IOFireWireWDHID.kext

      -    com.wdc.driver.IOFireWireWDHID

      /System/Library/Extensions/IOThunderboltFamily.kext

      -    com.apple.iokit.IOThunderboltFamily

      /System/Library/Extensions/LexmarkUSBMerge.kext

      -    com.lexmark.print.usbmerge

      /System/Library/Extensions/LogitechUSBHIDevices.kext

      -    com.Logitech.driver.HIDDevices

      /System/Library/Extensions/PromiseSTEX.kext

      -    com.promise.driver.stex

      /System/Library/Extensions/Soundflower.kext

      -    com.Cycling74.driver.Soundflower

      /System/Library/Extensions/virtualhid.kext

      -    com.veltrop.taylor.driver.virtualhid

      /Library/Components/FileInputUnit.component

      -    com.WorldBook.FileInputUnit.component

      /Library/Components/TimeAdapterUnit.component

      -    N/A

      /Library/Internet Plug-Ins/AmazonMP3DownloaderPlugin.plugin

      -    N/A

      /Library/Internet Plug-Ins/AmazonMP3DownloaderPlugin101750.plugin

      -    N/A

      /Library/Internet Plug-Ins/DirectorShockwave.plugin

      -    com.adobe.director_12_0.shockwave.pluginshim

      /Library/Internet Plug-Ins/DRM Plugin.bundle

      -    com.microsoft.DRMPlugin

      /Library/Internet Plug-Ins/Easy-WebPrint EX.plugin

      -    jp.co.canon.ij.easy-webprint-ex-plugin

      /Library/Internet Plug-Ins/EPPEX Plugin.plugin

      -    N/A

      /Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin

      -    com.Google.GoogleEarthPlugin.plugin

      /Library/Internet Plug-Ins/iPhotoPhotocast.plugin

      -    com.apple.plugin.iPhotoPhotocast

      /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

      -    com.apple.java.JavaAppletPlugin

      /Library/Internet Plug-Ins/RealPlayer Plugin.plugin

      -    com.RealNetworks.RealPlayerPlugin

      /Library/Internet Plug-Ins/Silverlight.plugin

      -    com.microsoft.SilverlightPlugin

      /Library/Internet Plug-Ins/Windows Media Plugin

      -    com.microsoft.WMP.defaultplugin

      /Library/Internet Plug-Ins/Windows Media Plugin/Contents/Resources/English.lproj

      -    N/A

      /Library/PreferencePanes/Flash Player.prefPane

      -    com.adobe.flashplayerpreferences

      /Library/PreferencePanes/Logitech Control Center.prefPane

      -    com.logitech.lcc

      /Library/QuickTime/3ivxMediaExporter.component

      -    com.3ivx.qtexporter

      /Library/QuickTime/3ivxVideoCodec.component

      -    com.3ivx.videocodec

      /Library/QuickTime/AppleMPEG2Codec.component

      -    com.apple.AppleMPEG2Codec

      /Library/Spotlight/iWeb.mdimporter

      -    com.apple.MDImporter.iWeb

      Library/Caches/com.apple.Safari/Extensions/Ebay Shopping Assistant.safariextension

      -    com.spigot.safari.ebayshopassist

      Library/Caches/com.apple.Safari/Extensions/Searchme.safariextension

      -    com.spigot.safari.searchme

      Library/Caches/com.apple.Safari/Extensions/SlickSavings.safariextension

      -    com.spigot.safari.slicksavings

      Library/Caches/com.apple.Safari/Extensions/The Camelizer.safariextension

      -    com.camelcamelcamel.ext

      Library/Internet Plug-Ins/Move-Media-Player.plugin

      -    com.movenetworks.movemediaplayer.plugin

      Library/Widgets/glaciercams.wdgt

      -    com.glacier.widget.webcams

      Library/Widgets/Screenshot Plus.wdgt

      -    com.stevenchaitoff.screeenshotplus

      Library/Widgets/Starry Night Widget.wdgt

      -    com.starrynight.widget

     

    dylibs

     

      /usr/lib/libgimpprint.1.1.0.dylib

      /usr/lib/libgimpprint.1.dylib

      /usr/lib/libgimpprint.dylib

      /usr/lib/libneon.27.dylib

      /usr/lib/libstdc++.6.0.3.dylib

      /usr/lib/libxml2.2.6.16.dylib

      /usr/lib/libXplugin.1.dylib

     

    Contents of /etc/crontab

     

      SHELL=/bin/sh

      PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin

      HOME=/var/log

      15    3    *    *    *    root    periodic daily

      30    4    *    *    6    root    periodic weekly

      30    5    1    *    *    root    periodic monthly

     

    Contents of /etc/fstab

     

      [N/A]

     

    Contents of /etc/ssh_config

     

      [N/A]

     

    Contents of /etc/sshd_config

     

      SyslogFacility AUTHPRIV

      VerifyReverseMapping yes

      Subsystem    sftp    /usr/libexec/sftp-server

     

    Contents of /etc/periodic/daily/500.daily.user_modified

     

      PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin

      host=`hostname -s`

      bak=/var/backups

      echo ""

      echo "Removing scratch and junk files:"

      if [ -d /var/rwho ] ; then

          cd /var/rwho && {

          find . ! -name . -mtime +7 -exec rm -f -- {} \; ; }

      fi

      if [ -d /tmp ]; then

          cd /tmp && {

          find -x . -fstype local -type f -atime +3 -ctime +3 -exec rm -f -- {} \;

          find -x -d . -fstype local ! -name . -type d -mtime +1 -exec rmdir -- {} \; \

          >/dev/null 2>&1; }

      fi

      msgs -c

      if [ -f /var/account/acct ] ; then

          if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi

          echo ""

          echo "Gathering accounting statistics:"

          cd /var/account

          if [ -f "acct.2${gzext}" ] ; then mv -f "acct.2${gzext}" "acct.3${gzext}" ; fi

          if [ -f "acct.1${gzext}" ] ; then mv -f "acct.1${gzext}" "acct.2${gzext}" ; fi

          if [ -f "acct.0${gzext}" ] ; then mv -f "acct.0${gzext}" "acct.1${gzext}" ; fi

          cp -pf acct acct.0

     

      ...and 68 more line(s)

     

    Font issues: 36

     

    Bad plists

     

      /Library/Preferences/com.apple.dev.isl.plist

      /Library/Preferences/DirectoryService/ActiveDirectory.plist

      /Library/Preferences/DirectoryService/ActiveDirectoryDomainPolicies.plist

      /Library/Preferences/DirectoryService/ActiveDirectoryDynamicData.plist

      /Library/Preferences/DirectoryService/ContactsNodeConfig.plist

      /Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist

      /Library/Preferences/DirectoryService/DirectoryService.plist

      /Library/Preferences/DirectoryService/DirectoryServiceDebug.plist

      /Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist

      /Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist

      /Library/Preferences/DirectoryService/SearchNodeConfig.plist

      /Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist

     

    Listeners

     

      launchd: printer

      launchd: microsoft-ds

      launchd: netbios-ssn

      cupsd: ipp

      krb5kdc: kerberos

      nfsd: 1023

      rpc.statd: exp2

      rpc.lockd: exp1

      portmap: sunrpc

      smbd: netbios-ssn

      smbd: microsoft-ds

     

    Wi-Fi

     

      link auth: none

     

    User login items

     

      LCCDaemon

      SpeechSynthesisServer

      WeatherBug Alert

      Dropbox.app

     

    Restricted files: 907

     

    Safari extensions

     

      The Camelizer

      Searchme

      Ebay Shopping Assistant

      SlickSavings

     

    Widgets

     

      Starry Night Widget

      Screenshot Plus

     

    Elapsed time (s): 185

  • by anniegraceireland,

    anniegraceireland anniegraceireland Nov 23, 2015 8:47 PM in response to Linc Davis
    Level 1 (0 points)
    Nov 23, 2015 8:47 PM in response to Linc Davis

    Start time: 22:25:12 11/23/15

     

     

    Model Identifier: MacBookPro7,1

    System Version: OS X 10.11 (15A284)

    Kernel Version: Darwin 15.0.0

    Boot Mode: Normal

    Time since boot: 9 days 2:39

     

     

    Diagnostic reports

     

     

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-09 galileod crash

      2015-11-11 galileod crash

      2015-11-12 galileod crash

      2015-11-13 galileod crash

      2015-11-13 galileod crash

      2015-11-14 galileod crash

      2015-11-14 galileod crash

      2015-11-15 Mail crash

      2015-11-15 galileod crash

      2015-11-15 galileod crash

      2015-11-16 galileod crash

      2015-11-17 galileod crash

      2015-11-19 galileod crash

      2015-11-20 galileod crash

      2015-11-21 galileod crash

      2015-11-21 galileod crash

      2015-11-22 galileod crash

      2015-11-22 galileod crash

      2015-11-23 galileod crash

      2015-11-23 suggestd crash

     

     

    Log

     

     

      Nov 23 04:15:55 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:17:18 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:17:51 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:19:14 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:19:47 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:21:10 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:21:43 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:23:06 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:23:39 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:25:02 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:25:35 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:26:58 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:27:34 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:28:53 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:29:27 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:30:50 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:31:23 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 19:32:23 jnl: disk2s2: do_jnl_io: strategy err 0x6

      Nov 23 19:32:23 jnl: disk2s2: write_journal_header: error writing the journal header!

      Nov 23 19:32:23 jnl: disk2s2: close: journal is invalid.  aborting outstanding transactions

      Nov 23 19:32:37 jnl: disk2s2: replay_journal: from: 19372544 to: 20888576 (joffset 0xe8e000)

      Nov 23 19:32:37 jnl: disk2s2: journal replay done.

      Nov 23 21:36:38 wl0: Roamed or switched channel, reason #8, bssid 74

      Nov 23 21:56:11 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 21:56:38 WARNING: hibernate_page_list_setall skipped 29612 xpmapped pages

     

     

    Swap (MiB): 2238

     

     

    Daemons

     

     

      com.adobe.ARMDC.Communicator

      com.oracle.java.JavaUpdateHelper

      com.microsoft.office.licensing.helper

      com.adobe.fpsaud

      com.adobe.ARMDC.SMJobBlessHelper

      com.fitbit.galileod

      com.seagate.TBDecorator.plist

     

     

    Agents

     

     

      com.adobe.ARM.UUID

      com.adobe.ARMDCHelper.UUID

     

     

    launchd

     

     

      /System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist

      - com.apple.AirPortBaseStationAgent

      /System/Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist

      - com.apple.installer.osmessagetracing

      /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist

      - com.adobe.ARMDCHelper.UUID

      /Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist

      - com.adobe.ARMDC.Communicator

      /Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist

      - com.adobe.ARMDC.SMJobBlessHelper

      /Library/LaunchDaemons/com.adobe.fpsaud.plist

      - com.adobe.fpsaud

      /Library/LaunchDaemons/com.fitbit.galileod.plist

      - com.fitbit.galileod

      /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

      - com.microsoft.office.licensing.helper

      /Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist

      - com.oracle.java.JavaUpdateHelper

      /Library/LaunchDaemons/com.seagate.TBDecorator.plist

      - com.seagate.TBDecorator.plist

      Library/LaunchAgents/com.adobe.ARM.UUID.plist

      - com.adobe.ARM.UUID

     

     

    Bundles

     

     

      /System/Library/Extensions/BJUSBLoad.kext

      - jp.co.canon.bj.print.BJUSBLoad

      /System/Library/Extensions/EPSONUSBPrintClass.kext

      - com.epson.print.kext.USBPrintClass

      /System/Library/Extensions/HotSync Classic Seize.kext

      - com.palm.ClassicNotSeizeDriver

      /System/Library/Extensions/hp_designjet_series.kext

      - com.hp.print.hpio.Designjet.kext

      /System/Library/Extensions/hp_Deskjet_io_enabler.kext

      - com.hp.print.hpio.Deskjet.kext

      /System/Library/Extensions/hp_Inkjet1_io_enabler.kext

      - com.hp.print.hpio.Inkjet1.kext

      /System/Library/Extensions/hp_Inkjet2_io_enabler.kext

      - com.hp.print.hpio.Inkjet2.kext

      /System/Library/Extensions/hp_Inkjet3_io_enabler.kext

      - com.hp.print.hpio.Inkjet3.kext

      /System/Library/Extensions/hp_Inkjet4_io_enabler.kext

      - com.hp.print.hpio.Inkjet4.kext

      /System/Library/Extensions/hp_Inkjet5_io_enabler.kext

      - com.hp.print.hpio.Inkjet5.kext

      /System/Library/Extensions/hp_Inkjet7_io_enabler.kext

      - com.hp.print.hpio.inkjet7.kext

      /System/Library/Extensions/hp_Inkjet8_io_enabler.kext

      - com.hp.print.hpio.inkjet8.kext

      /System/Library/Extensions/hp_Inkjet_io_enabler.kext

      - com.hp.print.hpio.Inkjet.kext

      /System/Library/Extensions/hp_Laserjet_io_enabler.kext

      - com.hp.print.hpio.Laserjet.kext

      /System/Library/Extensions/hp_Officejet_io_enabler.kext

      - com.hp.print.hpio.Officejet.kext

      /System/Library/Extensions/hp_Photosmart_io_enabler.kext

      - com.hp.print.hpio.Photosmart.kext

      /System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext

      - com.hp.print.hpio.PhotosmartPro.kext

      /System/Library/Extensions/hp_psa640_io_enabler.kext

      - com.hp.hpio.hp_psa640_io_enabler

      /System/Library/Extensions/hp_qc_io_enabler.kext

      - com.hp.hpio.hp_psa530_630_io_enabler

      /System/Library/Extensions/JMicronATA.kext

      - com.jmicron.JMicronATA

      /System/Library/Extensions/LexmarkUSBMerge.kext

      - com.lexmark.print.usbmerge

      /Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component

      - net.telestream.wmv.import

      /Library/Extensions/Seagate Storage Driver.kext

      - com.seagate.driver.PowSecDriverCore

      /Library/Internet Plug-Ins/Flash Player.plugin

      - N/A

      /Library/Internet Plug-Ins/Silverlight.plugin

      - com.microsoft.SilverlightPlugin

      /Library/PreferencePanes/DashboardPreferences.prefPane

      - com.seagate.dashboard.preferences

      /Library/PreferencePanes/Flash Player.prefPane

      - com.adobe.flashplayerpreferences

      /Library/PreferencePanes/Flip4Mac WMV.prefPane

      - net.telestream.wmv.prefpane

      /Library/QuickTime/Flip4Mac WMV Advanced.component

      - net.telestream.wmv.advanced

      /Library/QuickTime/Flip4Mac WMV Export.component

      - net.telestream.wmv.export

      /Library/QuickTime/Flip4Mac WMV Import.component

      - net.telestream.wmv.import

      Library/Address Book Plug-Ins/SkypeABDialer.bundle

      - com.skype.skypeabdialer

      Library/Address Book Plug-Ins/SkypeABSMS.bundle

      - com.skype.skypeabsms

      Library/Caches/com.apple.Safari/Extensions/ClickToPlugin.safariextension

      - com.hoyois.safari.clicktoplugin

      Library/Widgets/Moon Phase.wdgt

      - com.daylightmap.moon.mac

     

     

    dylibs

     

     

      /usr/lib/libgutenprint.2.0.3.dylib

     

     

    Contents of /etc/hosts

     

     

      127.0.0.1 localhost

      255.255.255.255 broadcasthost

      ::1             localhost

     

     

    Contents of /etc/pf.conf

     

     

      scrub-anchor "com.apple/*"

      nat-anchor "com.apple/*"

      rdr-anchor "com.apple/*"

      dummynet-anchor "com.apple/*"

      anchor "com.apple/*"

      load anchor "com.apple" from "/etc/pf.anchors/com.apple"

     

     

    Contents of /etc/syslog.conf

     

     

      install.* @127.0.0.1:32376

     

     

    Contents of /etc/periodic/daily/110.clean-tmps

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_clean_tmps_enable" in

          [Yy][Ee][Ss])

      if [ -z "$daily_clean_tmps_days" ]

      then

         echo '$daily_clean_tmps_enable is set but' \

      '$daily_clean_tmps_days is not'

         rc=2

      else

         echo ""

         echo "Removing old temporary files:"

         set -f noglob

         args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"

         args="${args} -ctime +$daily_clean_tmps_days"

         dargs="-empty -mtime +$daily_clean_tmps_days"

         dargs="${dargs} ! -name .vfs_rsrc_streams_*"

         [ -n "$daily_clean_tmps_ignore" ] && {

      args="$args "`echo " ${daily_clean_tmps_ignore% }" |

         sed 's/[ ][ ]*/ ! -name /g'`

      dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |

         sed 's/[ ][ ]*/ ! -name /g'`

     

     

      ...and 21 more line(s)

     

     

    Contents of /etc/periodic/daily/130.clean-msgs

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_clean_msgs_enable" in

          [Yy][Ee][Ss])

      if [ ! -d /var/msgs ]

      then

         echo '$daily_clean_msgs_enable is set but /var/msgs' \

      "doesn't exist"

         rc=2

      else

         echo ""

         echo "Cleaning out old system announcements:"

         [ -n "$daily_clean_msgs_days" ] &&

      arg=-${daily_clean_msgs_days#-} || arg=

         msgs -c $arg && rc=0 || rc=3

      fi;;

          *)  rc=0;;

      esac

      exit $rc

     

     

    Contents of /etc/periodic/daily/140.clean-rwho

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_clean_rwho_enable" in

          [Yy][Ee][Ss])

      if [ -z "$daily_clean_rwho_days" ]

      then

         echo '$daily_clean_rwho_enable is enabled but' \

      '$daily_clean_rwho_days is not set'

         rc=2

      elif [ ! -d /var/rwho ]

      then

         echo '$daily_clean_rwho_enable is enabled but /var/rwho' \

      "doesn't exist"

         rc=2

      else

         echo ""

         echo "Removing stale files from /var/rwho:"

         case "$daily_clean_rwho_verbose" in

      [Yy][Ee][Ss])

         print=-print;;

      *)

         print=;;

     

     

      ...and 14 more line(s)

     

     

    Contents of /etc/periodic/daily/199.clean-fax

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      if [ -d /var/spool/fax ]; then

          echo ""

          echo "Removing scratch fax files"

          cd /var/spool/fax && \

          find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;

      fi

     

     

    Contents of /etc/periodic/daily/310.accounting

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_accounting_enable" in

          [Yy][Ee][Ss])

      if [ ! -f /var/account/acct ]

      then

         echo '$daily_accounting_enable is set but /var/account/acct' \

      "doesn't exist"

         rc=2

      elif [ -z "$daily_accounting_save" ]

      then

         echo '$daily_accounting_enable is set but ' \

      '$daily_accounting_save is not'

         rc=2

      else

         echo ""

         echo "Rotating accounting logs and gathering statistics:"

         cd /var/account

         rc=0

         n=$daily_accounting_save

         rm -f acct.$n.gz acct.$n || rc=3

         m=$n

     

     

      ...and 18 more line(s)

     

     

    Contents of /etc/periodic/daily/400.status-disks

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_status_disks_enable" in

          [Yy][Ee][Ss])

      echo ""

      echo "Disk status:"

      df $daily_status_disks_df_flags && rc=1 || rc=3

      ;;

          *)  rc=0;;

      esac

      exit $rc

     

     

    Contents of /etc/periodic/daily/420.status-network

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_status_network_enable" in

          [Yy][Ee][Ss])

      echo ""

      echo "Network interface status:"

      case "$daily_status_network_usedns" in

         [Yy][Ee][Ss])

      netstat -i && rc=0 || rc=3;;

         *)

      netstat -in && rc=0 || rc=3;;

      esac;;

          *)  rc=0;;

      esac

      exit $rc

     

     

    Contents of /etc/periodic/daily/430.status-rwho

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_status_rwho_enable" in

          [Yy][Ee][Ss])

      rwho=$(echo /var/rwho/*)

              if [ -f "${rwho%% *}" ]

              then

         echo ""

         echo "Local network system status:"

         prog=ruptime

      else

         echo ""

         echo "Local system status:"

         prog=uptime

      fi

      rc=$($prog | tee /dev/stderr | wc -l)

      if [ $? -eq 0 ]

      then

         [ $rc -gt 1 ] && rc=1

      else

         rc=3

      fi;;

     

     

      ...and 3 more line(s)

     

     

    Contents of /etc/periodic/daily/999.local

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      rc=0

      for script in $daily_local

      do

          echo ''

          case "$script" in

      /*)

         if [ -f "$script" ]

         then

      echo "Running $script:"

      sh $script || rc=3

         else

      echo "$script: No such file"

      [ $rc -lt 2 ] && rc=2

         fi;;

      *)

         echo "$script: Not an absolute path"

         [ $rc -lt 2 ] && rc=2;;

          esac

      done

      exit $rc

     

     

    Contents of /etc/periodic/monthly/199.rotate-fax

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      echo ""

      printf %s "Rotating fax log files:"

      cd /var/log/fax

      for i in *.log; do

          if [ -f "${i}" ]; then

          echo -n " $i"

          if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi

          if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi

          if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi

          if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi

          if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi

          if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi

          touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"

          fi

      done

      echo ""

     

     

    Contents of /etc/periodic/monthly/200.accounting

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      oldmask=$(umask)

      umask 066

      case "$monthly_accounting_enable" in

          [Yy][Ee][Ss])

      W=/var/log/wtmp

      rc=0

      remove=NO

      if [ $rc -eq 0 ]

      then

         echo ""

         echo "Doing login accounting:"

         rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)

         [ $rc -gt 0 ] && rc=1

      fi

      [ $remove = YES ] && rm -f $W.0;;

    Start time: 22:25:12 11/23/15

     

     

    Model Identifier: MacBookPro7,1

    System Version: OS X 10.11 (15A284)

    Kernel Version: Darwin 15.0.0

    Boot Mode: Normal

    Time since boot: 9 days 2:39

     

     

    Diagnostic reports

     

     

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-08 galileod crash

      2015-11-09 galileod crash

      2015-11-11 galileod crash

      2015-11-12 galileod crash

      2015-11-13 galileod crash

      2015-11-13 galileod crash

      2015-11-14 galileod crash

      2015-11-14 galileod crash

      2015-11-15 Mail crash

      2015-11-15 galileod crash

      2015-11-15 galileod crash

      2015-11-16 galileod crash

      2015-11-17 galileod crash

      2015-11-19 galileod crash

      2015-11-20 galileod crash

      2015-11-21 galileod crash

      2015-11-21 galileod crash

      2015-11-22 galileod crash

      2015-11-22 galileod crash

      2015-11-23 galileod crash

      2015-11-23 suggestd crash

     

     

    Log

     

     

      Nov 23 04:15:55 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:17:18 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:17:51 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:19:14 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:19:47 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:21:10 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:21:43 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:23:06 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:23:39 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:25:02 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:25:35 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:26:58 WARNING: hibernate_page_list_setall skipped 3992 xpmapped pages

      Nov 23 04:27:34 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:28:53 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:29:27 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:30:50 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 04:31:23 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 19:32:23 jnl: disk2s2: do_jnl_io: strategy err 0x6

      Nov 23 19:32:23 jnl: disk2s2: write_journal_header: error writing the journal header!

      Nov 23 19:32:23 jnl: disk2s2: close: journal is invalid.  aborting outstanding transactions

      Nov 23 19:32:37 jnl: disk2s2: replay_journal: from: 19372544 to: 20888576 (joffset 0xe8e000)

      Nov 23 19:32:37 jnl: disk2s2: journal replay done.

      Nov 23 21:36:38 wl0: Roamed or switched channel, reason #8, bssid 74

      Nov 23 21:56:11 WARNING: hibernate_page_list_setall skipped 3967 xpmapped pages

      Nov 23 21:56:38 WARNING: hibernate_page_list_setall skipped 29612 xpmapped pages

     

     

    Swap (MiB): 2238

     

     

    Daemons

     

     

      com.adobe.ARMDC.Communicator

      com.oracle.java.JavaUpdateHelper

      com.microsoft.office.licensing.helper

      com.adobe.fpsaud

      com.adobe.ARMDC.SMJobBlessHelper

      com.fitbit.galileod

      com.seagate.TBDecorator.plist

     

     

    Agents

     

     

      com.adobe.ARM.UUID

      com.adobe.ARMDCHelper.UUID

     

     

    launchd

     

     

      /System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist

      - com.apple.AirPortBaseStationAgent

      /System/Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist

      - com.apple.installer.osmessagetracing

      /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist

      - com.adobe.ARMDCHelper.UUID

      /Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist

      - com.adobe.ARMDC.Communicator

      /Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist

      - com.adobe.ARMDC.SMJobBlessHelper

      /Library/LaunchDaemons/com.adobe.fpsaud.plist

      - com.adobe.fpsaud

      /Library/LaunchDaemons/com.fitbit.galileod.plist

      - com.fitbit.galileod

      /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

      - com.microsoft.office.licensing.helper

      /Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist

      - com.oracle.java.JavaUpdateHelper

      /Library/LaunchDaemons/com.seagate.TBDecorator.plist

      - com.seagate.TBDecorator.plist

      Library/LaunchAgents/com.adobe.ARM.UUID.plist

      - com.adobe.ARM.UUID

     

     

    Bundles

     

     

      /System/Library/Extensions/BJUSBLoad.kext

      - jp.co.canon.bj.print.BJUSBLoad

      /System/Library/Extensions/EPSONUSBPrintClass.kext

      - com.epson.print.kext.USBPrintClass

      /System/Library/Extensions/HotSync Classic Seize.kext

      - com.palm.ClassicNotSeizeDriver

      /System/Library/Extensions/hp_designjet_series.kext

      - com.hp.print.hpio.Designjet.kext

      /System/Library/Extensions/hp_Deskjet_io_enabler.kext

      - com.hp.print.hpio.Deskjet.kext

      /System/Library/Extensions/hp_Inkjet1_io_enabler.kext

      - com.hp.print.hpio.Inkjet1.kext

      /System/Library/Extensions/hp_Inkjet2_io_enabler.kext

      - com.hp.print.hpio.Inkjet2.kext

      /System/Library/Extensions/hp_Inkjet3_io_enabler.kext

      - com.hp.print.hpio.Inkjet3.kext

      /System/Library/Extensions/hp_Inkjet4_io_enabler.kext

      - com.hp.print.hpio.Inkjet4.kext

      /System/Library/Extensions/hp_Inkjet5_io_enabler.kext

      - com.hp.print.hpio.Inkjet5.kext

      /System/Library/Extensions/hp_Inkjet7_io_enabler.kext

      - com.hp.print.hpio.inkjet7.kext

      /System/Library/Extensions/hp_Inkjet8_io_enabler.kext

      - com.hp.print.hpio.inkjet8.kext

      /System/Library/Extensions/hp_Inkjet_io_enabler.kext

      - com.hp.print.hpio.Inkjet.kext

      /System/Library/Extensions/hp_Laserjet_io_enabler.kext

      - com.hp.print.hpio.Laserjet.kext

      /System/Library/Extensions/hp_Officejet_io_enabler.kext

      - com.hp.print.hpio.Officejet.kext

      /System/Library/Extensions/hp_Photosmart_io_enabler.kext

      - com.hp.print.hpio.Photosmart.kext

      /System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext

      - com.hp.print.hpio.PhotosmartPro.kext

      /System/Library/Extensions/hp_psa640_io_enabler.kext

      - com.hp.hpio.hp_psa640_io_enabler

      /System/Library/Extensions/hp_qc_io_enabler.kext

      - com.hp.hpio.hp_psa530_630_io_enabler

      /System/Library/Extensions/JMicronATA.kext

      - com.jmicron.JMicronATA

      /System/Library/Extensions/LexmarkUSBMerge.kext

      - com.lexmark.print.usbmerge

      /Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component

      - net.telestream.wmv.import

      /Library/Extensions/Seagate Storage Driver.kext

      - com.seagate.driver.PowSecDriverCore

      /Library/Internet Plug-Ins/Flash Player.plugin

      - N/A

      /Library/Internet Plug-Ins/Silverlight.plugin

      - com.microsoft.SilverlightPlugin

      /Library/PreferencePanes/DashboardPreferences.prefPane

      - com.seagate.dashboard.preferences

      /Library/PreferencePanes/Flash Player.prefPane

      - com.adobe.flashplayerpreferences

      /Library/PreferencePanes/Flip4Mac WMV.prefPane

      - net.telestream.wmv.prefpane

      /Library/QuickTime/Flip4Mac WMV Advanced.component

      - net.telestream.wmv.advanced

      /Library/QuickTime/Flip4Mac WMV Export.component

      - net.telestream.wmv.export

      /Library/QuickTime/Flip4Mac WMV Import.component

      - net.telestream.wmv.import

      Library/Address Book Plug-Ins/SkypeABDialer.bundle

      - com.skype.skypeabdialer

      Library/Address Book Plug-Ins/SkypeABSMS.bundle

      - com.skype.skypeabsms

      Library/Caches/com.apple.Safari/Extensions/ClickToPlugin.safariextension

      - com.hoyois.safari.clicktoplugin

      Library/Widgets/Moon Phase.wdgt

      - com.daylightmap.moon.mac

     

     

    dylibs

     

     

      /usr/lib/libgutenprint.2.0.3.dylib

     

     

    Contents of /etc/hosts

     

     

      127.0.0.1 localhost

      255.255.255.255 broadcasthost

      ::1             localhost

     

     

    Contents of /etc/pf.conf

     

     

      scrub-anchor "com.apple/*"

      nat-anchor "com.apple/*"

      rdr-anchor "com.apple/*"

      dummynet-anchor "com.apple/*"

      anchor "com.apple/*"

      load anchor "com.apple" from "/etc/pf.anchors/com.apple"

     

     

    Contents of /etc/syslog.conf

     

     

      install.* @127.0.0.1:32376

     

     

    Contents of /etc/periodic/daily/110.clean-tmps

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_clean_tmps_enable" in

          [Yy][Ee][Ss])

      if [ -z "$daily_clean_tmps_days" ]

      then

         echo '$daily_clean_tmps_enable is set but' \

      '$daily_clean_tmps_days is not'

         rc=2

      else

         echo ""

         echo "Removing old temporary files:"

         set -f noglob

         args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"

         args="${args} -ctime +$daily_clean_tmps_days"

         dargs="-empty -mtime +$daily_clean_tmps_days"

         dargs="${dargs} ! -name .vfs_rsrc_streams_*"

         [ -n "$daily_clean_tmps_ignore" ] && {

      args="$args "`echo " ${daily_clean_tmps_ignore% }" |

         sed 's/[ ][ ]*/ ! -name /g'`

      dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |

         sed 's/[ ][ ]*/ ! -name /g'`

     

     

      ...and 21 more line(s)

     

     

    Contents of /etc/periodic/daily/130.clean-msgs

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_clean_msgs_enable" in

          [Yy][Ee][Ss])

      if [ ! -d /var/msgs ]

      then

         echo '$daily_clean_msgs_enable is set but /var/msgs' \

      "doesn't exist"

         rc=2

      else

         echo ""

         echo "Cleaning out old system announcements:"

         [ -n "$daily_clean_msgs_days" ] &&

      arg=-${daily_clean_msgs_days#-} || arg=

         msgs -c $arg && rc=0 || rc=3

      fi;;

          *)  rc=0;;

      esac

      exit $rc

     

     

    Contents of /etc/periodic/daily/140.clean-rwho

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_clean_rwho_enable" in

          [Yy][Ee][Ss])

      if [ -z "$daily_clean_rwho_days" ]

      then

         echo '$daily_clean_rwho_enable is enabled but' \

      '$daily_clean_rwho_days is not set'

         rc=2

      elif [ ! -d /var/rwho ]

      then

         echo '$daily_clean_rwho_enable is enabled but /var/rwho' \

      "doesn't exist"

         rc=2

      else

         echo ""

         echo "Removing stale files from /var/rwho:"

         case "$daily_clean_rwho_verbose" in

      [Yy][Ee][Ss])

         print=-print;;

      *)

         print=;;

     

     

      ...and 14 more line(s)

     

     

    Contents of /etc/periodic/daily/199.clean-fax

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      if [ -d /var/spool/fax ]; then

          echo ""

          echo "Removing scratch fax files"

          cd /var/spool/fax && \

          find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;

      fi

     

     

    Contents of /etc/periodic/daily/310.accounting

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_accounting_enable" in

          [Yy][Ee][Ss])

      if [ ! -f /var/account/acct ]

      then

         echo '$daily_accounting_enable is set but /var/account/acct' \

      "doesn't exist"

         rc=2

      elif [ -z "$daily_accounting_save" ]

      then

         echo '$daily_accounting_enable is set but ' \

      '$daily_accounting_save is not'

         rc=2

      else

         echo ""

         echo "Rotating accounting logs and gathering statistics:"

         cd /var/account

         rc=0

         n=$daily_accounting_save

         rm -f acct.$n.gz acct.$n || rc=3

         m=$n

     

     

      ...and 18 more line(s)

     

     

    Contents of /etc/periodic/daily/400.status-disks

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_status_disks_enable" in

          [Yy][Ee][Ss])

      echo ""

      echo "Disk status:"

      df $daily_status_disks_df_flags && rc=1 || rc=3

      ;;

          *)  rc=0;;

      esac

      exit $rc

     

     

    Contents of /etc/periodic/daily/420.status-network

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_status_network_enable" in

          [Yy][Ee][Ss])

      echo ""

      echo "Network interface status:"

      case "$daily_status_network_usedns" in

         [Yy][Ee][Ss])

      netstat -i && rc=0 || rc=3;;

         *)

      netstat -in && rc=0 || rc=3;;

      esac;;

          *)  rc=0;;

      esac

      exit $rc

     

     

    Contents of /etc/periodic/daily/430.status-rwho

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$daily_status_rwho_enable" in

          [Yy][Ee][Ss])

      rwho=$(echo /var/rwho/*)

              if [ -f "${rwho%% *}" ]

              then

         echo ""

         echo "Local network system status:"

         prog=ruptime

      else

         echo ""

         echo "Local system status:"

         prog=uptime

      fi

      rc=$($prog | tee /dev/stderr | wc -l)

      if [ $? -eq 0 ]

      then

         [ $rc -gt 1 ] && rc=1

      else

         rc=3

      fi;;

     

     

      ...and 3 more line(s)

     

     

    Contents of /etc/periodic/daily/999.local

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      rc=0

      for script in $daily_local

      do

          echo ''

          case "$script" in

      /*)

         if [ -f "$script" ]

         then

      echo "Running $script:"

      sh $script || rc=3

         else

      echo "$script: No such file"

      [ $rc -lt 2 ] && rc=2

         fi;;

      *)

         echo "$script: Not an absolute path"

         [ $rc -lt 2 ] && rc=2;;

          esac

      done

      exit $rc

     

     

    Contents of /etc/periodic/monthly/199.rotate-fax

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      echo ""

      printf %s "Rotating fax log files:"

      cd /var/log/fax

      for i in *.log; do

          if [ -f "${i}" ]; then

          echo -n " $i"

          if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi

          if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi

          if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi

          if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi

          if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi

          if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi

          touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"

          fi

      done

      echo ""

     

     

    Contents of /etc/periodic/monthly/200.accounting

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      oldmask=$(umask)

      umask 066

      case "$monthly_accounting_enable" in

          [Yy][Ee][Ss])

      W=/var/log/wtmp

      rc=0

      remove=NO

      if [ $rc -eq 0 ]

      then

         echo ""

         echo "Doing login accounting:"

         rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)

         [ $rc -gt 0 ] && rc=1

      fi

      [ $remove = YES ] && rm -f $W.0;;

          *)  rc=0;;

      esac

      umask $oldmask

      exit $rc

     

     

    Contents of /etc/periodic/monthly/999.local

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      rc=0

      for script in $monthly_local

      do

          echo ''

          case "$script" in

      /*)

         if [ -f "$script" ]

         then

      echo "Running $script:"

      sh $script || rc=3

         else

      echo "$script: No such file"

      [ $rc -lt 2 ] && rc=2

         fi;;

      *)

         echo "$script: Not an absolute path"

         [ $rc -lt 2 ] && rc=2;;

          esac

      done

      exit $rc

     

     

    Contents of /etc/periodic/weekly/320.whatis

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      case "$weekly_whatis_enable" in

          [Yy][Ee][Ss])

      echo ""

      echo "Rebuilding whatis database:"

      MANPATH=`/usr/bin/manpath -q`

      if [ $? = 0 ]

      then

         if [ -z "${MANPATH}" ]

         then

      echo "manpath failed to find any manpage directories"

      rc=3

         else

      rc=0

      /usr/libexec/makewhatis.local "${MANPATH}" || rc=3

      if [ X"${man_locales}" != X ]

      then

         for i in ${man_locales}

         do

      LC_ALL=$i /usr/libexec/makewhatis.local -a \

         -L "${MANPATH}" || rc=3

     

     

      ...and 9 more line(s)

     

     

    Contents of /etc/periodic/weekly/999.local

     

     

      if [ -r /etc/defaults/periodic.conf ]

      then

          . /etc/defaults/periodic.conf

          source_periodic_confs

      fi

      rc=0

      for script in $weekly_local

      do

          echo ''

          case "$script" in

      /*)

         if [ -f "$script" ]

         then

      echo "Running $script:"

      sh $script || rc=3

         else

      echo "$script: No such file"

      [ $rc -lt 2 ] && rc=2

         fi;;

      *)

         echo "$script: Not an absolute path"

         [ $rc -lt 2 ] && rc=2;;

          esac

      done

      exit $rc

     

     

    Contents of /Library/Preferences/com.apple.security.appsandbox.plist (XML  document text)

     

     

      <?xml version="1.0" encoding="UTF-8"?>

      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

      <plist version="1.0">

      <dict>

          <key>UnrestrictSpotlightContainerScope</key>

          <true/>

      </dict>

      </plist>

     

     

    Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (XML  document text)

     

     

      <?xml version="1.0" encoding="UTF-8"?>

      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

      <plist version="1.0">

      <dict>

      <key>Kernel Flags</key>

      <string></string>

      </dict>

      </plist>

     

     

    Bad plists

     

     

      /Library/Preferences/com.gen.framework.plist

     

     

    Firewall: On

     

     

    Restricted files: 7

     

     

    Safari extensions

     

     

      ClickToPlugin

     

     

    Elapsed time (s): 488

     

     

      ClickToPlugin

     

     

    Elapsed time (s): 488

  • by adtse,

    adtse adtse Oct 2, 2016 2:02 PM in response to R_GAU
    Level 1 (8 points)
    iCloud
    Oct 2, 2016 2:02 PM in response to R_GAU

    I got the same popup. I did the survey to see where it leads me to, since it did not ask for personal info. Then the available gifts were inappropriate stuff (I really don't want to share it out because it sounds really inappropriate. But it said the shipping was $5. I knew it was already a scam, it was for advertising. None of the stuff was free, it was just ads to online shopping websites.