httpd constantly respawning each time Ikill it

Question

Level 1

9 points

httpd constantly respawning each time Ikill it

Hi,

I'm running OSX Mavericks on Processor 3.4 GHz Intel Core i7 iMac and recently noticed something on my system is starting httpd & trying to access 4 ip addresses which I have blocked.

outgoing connections to port 6667 of 154.35.175.201

outgoing connections to port 6667 of 94.125.182.255

outgoing connections to port 6667 of 91.236.182.1

outgoing connections to port 6667 of 198.148.91.146

I do not have a server running and noticed httpd running so I kill the process

0 13785 1 0 1:37pm ?? 0:00.01 /usr/sbin/httpd

each time I kill it though after a few seconds it restarted.

Apparently it's being ran from /var/tmp//.psf-root/httpd which does not exist.

Can anyone tell me how to stop this?

Thanks.

Posted on Jul 8, 2014 9:17 AM

Reply

Answer 1

Drew Reece

Level 6

10,660 points

Jul 8, 2014 9:54 AM in response to ptrbee

httpd is the Apache web server.

Do you host local websites for testing etc?

The web server used to be enabled in System Preferences > Sharing - 'Web Sharing' but now that has checkbox been removed so you could have the background job still active (assuming you upgraded or migrated to 10.9).

If you kill httpd it will try to respawn because the job is set to run at a system level - you need to unload it otherwise you will simply lose the fight.

Backup before you begin - these commands used sudo to gain full system access a typo can ruin the OS…

apachectl is the command to control the server.

http://www.manpagez.com/man/8/apachectl/

sudo apachectl stop

Will stop apache, but a reboot will reload the background job.

This will mark the background job as 'unloaded' which should stop it running after a reboot.

sudo launchctl  unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist

You can try listing the active jobs to see if it is still listed

sudo launchctl list

That outputs a massive list 🙂, just reboot & see if it comes back or use grep to filter the list

sudo launchctl list | grep 'httpd'

Here are the manuals if you want more info …

http://www.manpagez.com/man/8/apachectl/

http://www.manpagez.com/man/1/launchctl

Reply

Answer 2

ptrbee Author

Level 1

9 points

Jul 8, 2014 10:34 AM in response to Drew Reece

Hi Drew,

thanks for helping, no I'm not running any local websites etc, I noticed this started around the 27th of June I tried those commands earlier to stop the server with no joy... Only place I can see it so far is

sh-3.2# sudo launchctl list | grep 'httpd'

sh-3.2# ps -ef | grep 'httpd'

0 13808 1 0 1:38pm ?? 0:05.96 /usr/sbin/httpd -d /var/root/lib/lib

0 18736 18691 0 6:32pm ttys001 0:00.00 grep httpd

Below is what I get when I run the commands, also tried as sudo su

sh-3.2# sudo apachectl stop

launchctl: Error unloading: org.apache.httpd

sh-3.2# sudo launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist

launchctl: Error unloading: org.apache.httpd

sh-3.2# sudo launchctl list | grep 'httpd'

Reply

Answer 3

Linc Davis

Level 10

209,541 points

Jul 8, 2014 10:40 AM in response to ptrbee

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the behest of a stranger. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' \*AutoCad \*dropbox \*GoogleDr\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 ` route -n get default|awk '/e:/{print $2}' ` 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^$[0-9]+$ /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;5p;6p;8p;12p;' ' {sub(/^ +/,"")};NR==6;NR==13&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/root/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1000) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/ { next;} /(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/ { next;} /%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]" "$1;b=b$1;} END { if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|POSIX sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/$L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /APPLE [HS]/d;s/.+: //;H;};/s: /{ /V/d;s/^ */- /;H;};${ g;p;};' ' /^find: /d;p;' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' '" L*/P*/*loginit*' 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA$|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true $ -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' -i4TCP:0-1023 com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;A2 0 $((N1+1)) 2;C0;A1 0 $N1 1;C0;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D13 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D22 4 4 50 0;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

Copy the selected text to the Clipboard by pressing the key combination command-C.

7. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

8. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

[Process completed]

to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start Time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

________________________________

Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 4

Drew Reece

Level 6

10,660 points

Jul 8, 2014 12:16 PM in response to ptrbee

You didn't need to login as root, that is what sudo is for.

See what Linc's test outputs.

Reply

Answer 5

ptrbee Author

Level 1

9 points

Jul 8, 2014 7:50 PM in response to Linc Davis

Start time: 03:07:03 07/09/14

Model Identifier: iMac12,2

System Version: OS X 10.9.4 (13E28)

Kernel Version: Darwin 13.3.0

Boot Mode: Normal

Time since boot: 1 day4:42

SATA

ST31000528AS

HL-DT-STDVDRW GA32N

USB

PTZ-431W (WACOM Co., Ltd.)

FileVault: FileVault master keychain appears to be installed

Diagnostic reports

2014-07-07 WacomTabletDriver crash

2014-07-08 Safari crash *

2014-07-08 opendirectoryd crash

2014-07-08 storeagent crash

2014-07-09 RimAlbumArtDaemon crash

* Code injection

Log

Jul 7 22:22:11 USBF: 15664.681 AppleUSBEHCI::Found a transaction which hasn't moved in 5000 milliseconds on bus 0xfa, timing out! (Addr: 6, EP: 0)

Jul 7 22:28:28 Process Setup Assistant [267] disabling system-wide I/O Throttling

Jul 7 22:28:28 Process Setup Assistant [267] disabling system-wide CPU Throttling

Jul 7 22:34:38 process Finder[737] caught causing excessive wakeups. Observed wakeups rate (per sec): 1046; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45016

Jul 7 22:36:54 CODE SIGNING: cs_invalid_page(0x100000000): p=950[AdobeCrashDaemon] final status 0x0, allowing (remove VALID) page

Jul 7 22:38:54 process steam[866] caught causing excessive wakeups. Observed wakeups rate (per sec): 198; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45053

Jul 7 22:38:54 CODE SIGNING: cs_invalid_page(0x10950c000): p=1026[spindump] final status 0x0, allowing (remove VALID) page

Jul 7 22:44:14 process Creative Cloud[818] caught causing excessive wakeups. Observed wakeups rate (per sec): 174; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 80019

Jul 7 22:44:14 CODE SIGNING: cs_invalid_page(0x11244c000): p=1145[spindump] final status 0x0, allowing (remove VALID) page

Jul 7 22:55:51 process Safari[942] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback

Jul 8 00:15:43 CODE SIGNING: cs_invalid_page(0x10ddda000): p=2756[spindump] final status 0x0, allowing (remove VALID) page

Jul 8 00:16:09 CODE SIGNING: cs_invalid_page(0x10b83d000): p=2767[spindump] final status 0x0, allowing (remove VALID) page

Jul 8 01:57:30 process WindowServer[112] caught causing excessive wakeups. Observed wakeups rate (per sec): 154; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 658479

Jul 8 01:57:33 CODE SIGNING: cs_invalid_page(0x1097ee000): p=4304[spindump] final status 0x0, allowing (remove VALID) page

Jul 8 03:25:51 process Adobe Photoshop [3014] caught causing excessive wakeups. Observed wakeups rate (per sec): 199; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 481391

Jul 8 03:25:55 CODE SIGNING: cs_invalid_page(0x1084bc000): p=5560[spindump] final status 0x0, allowing (remove VALID) page

Jul 8 13:34:59 process Safari[13225] caught causing excessive wakeups. Observed wakeups rate (per sec): 185; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 144535

Jul 8 13:35:07 CODE SIGNING: cs_invalid_page(0x100bc9000): p=13741[spindump] final status 0x0, allowing (remove VALID) page

Jul 8 17:28:08 process Safari[17516] caught causing excessive wakeups. Observed wakeups rate (per sec): 182; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45222

Jul 8 17:28:18 CODE SIGNING: cs_invalid_page(0x1091d9000): p=17602[spindump] final status 0x0, allowing (remove VALID) page

Jul 8 17:52:02 IOAudioStream[0xffffff803fc16200]::clipIfNecessary() - Error: attempting to clip to a position more than one buffer ahead of last clip position (257,10f0)->(258,13c0).

Jul 8 18:06:47 disk0s2: I/O error.

Jul 8 18:06:48 vm_swapfile_io: vnode_pagein failed with 2.

Jul 8 18:22:37 process Adobe Bridge CC[16891] thread 2031536 caught burning CPU!; EXC_RESOURCE supressed due to audio playback

Jul 9 00:16:10 CODE SIGNING: cs_invalid_page(0x10af80000): p=23262[spindump] final status 0x0, allowing (remove VALID) page

Swap (MiB): 3641

I/O per process: RimAlbumArtDaem (UID 501) is using 2 MB/s

Memory: kernel_task (UID 0) is using 1220 MB

kexts

com.rim.driver.BlackBerryUSBDriverInt (0.0.97)

at.obdev.nke.LittleSnitch (4092)

com.nvidia.CUDA (1.1.0)

Daemons

vyprvpnservice

com.trusteer.rooks.rooksd

gs-server

com.rim.BBDaemon

com.oracle.java.JavaUpdateHelper

com.oracle.java.Helper-Tool

com.microsoft.office.licensing.helper

com.adobe.SwitchBoard

com.adobe.fpsaud

at.obdev.littlesnitchd

Agents

com.adobe.PDApp.AAMUpdatesNotifier.62864.UUID

com.valvesoftware.steamclean

com.paragon.ntfs.upd

com.paragon.ntfs.trial

com.wacom.wacomtablet

com.trusteer.rapport.rapportd

com.rim.BBLaunchAgent

com.rim.RimAlbumArtDaemon

com.paragon.updater

com.oracle.java.Java-Updater

com.nvidia.CUDASoftwareUpdate

com.adobe.AdobeCreativeCloud

at.obdev.LittleSnitchUIAgent

com.facebook.videochat.updater

com.adobe.ARM.UUID

com.valvesoftware.steam.ipctool

launchd

/System/Library/LaunchAgents/com.paragon.NTFS.notify.plist

- com.paragon.ntfs.trial

/System/Library/LaunchAgents/com.paragon.NTFS.trial.plist

- com.paragon.ntfs.trial

/System/Library/LaunchAgents/com.paragon.NTFS.upd.plist

- com.paragon.ntfs.upd

/Library/LaunchAgents/at.obdev.LittleSnitchUIAgent.plist

- at.obdev.LittleSnitchUIAgent

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

- com.adobe.AAM.Startup-1.0

/Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist

- com.adobe.AdobeCreativeCloud

/Library/LaunchAgents/com.nvidia.CUDASoftwareUpdate.plist

- com.nvidia.CUDASoftwareUpdate

/Library/LaunchAgents/com.oracle.java.Java-Updater.plist

- com.oracle.java.Java-Updater

/Library/LaunchAgents/com.paragon.updater.plist

- com.paragon.updater

/Library/LaunchAgents/com.rim.BBAlbumArtCacher.plist

- com.rim.RimAlbumArtDaemon

/Library/LaunchAgents/com.rim.BBLaunchAgent.plist

- com.rim.BBLaunchAgent

/Library/LaunchAgents/com.trusteer.rapport.rapportd.plist

- com.trusteer.rapport.rapportd

/Library/LaunchAgents/com.wacom.wacomtablet.plist

- com.wacom.wacomtablet

/Library/LaunchDaemons/at.obdev.littlesnitchd.plist

- at.obdev.littlesnitchd

/Library/LaunchDaemons/com.adobe.fpsaud.plist

- com.adobe.fpsaud

/Library/LaunchDaemons/com.adobe.SwitchBoard.plist

- com.adobe.SwitchBoard

/Library/LaunchDaemons/com.apple.aelwriter.plist

- com.apple.aelwriter

/Library/LaunchDaemons/com.edb.launchd.postgresql-8.4.plist

- com.edb.launchd.postgresql-8.4

/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

- com.microsoft.office.licensing.helper

/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

- com.oracle.java.Helper-Tool

/Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist

- com.oracle.java.JavaUpdateHelper

/Library/LaunchDaemons/com.rim.BBDaemon.plist

- com.rim.BBDaemon

/Library/LaunchDaemons/com.siber.gs-server.plist

- gs-server

/Library/LaunchDaemons/com.trusteer.rooks.rooksd.plist

- com.trusteer.rooks.rooksd

/Library/LaunchDaemons/vyprvpnservice.plist

- vyprvpnservice

Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

- com.adobe.AAM.Scheduler-1.0

Library/LaunchAgents/com.adobe.ARM.UUID.plist

- com.adobe.ARM.UUID

Library/LaunchAgents/com.apple.FolderActions.enabled.plist

- com.apple.FolderActions.enabled

Library/LaunchAgents/com.apple.FolderActions.folders.plist

- com.apple.FolderActions.folders

Library/LaunchAgents/com.facebook.videochat.plist

- com.facebook.videochat.updater

Library/LaunchAgents/com.valvesoftware.steamclean.plist

- com.valvesoftware.steamclean

Library/LaunchAgents/jp.co.canon.Inkjet_Extended_Survey_Agent.plist

- jp.co.canon.Inkjet_Extended_Survey_Agent

Startup items

/System/Library/StartupItems/CUDA/CUDA

/System/Library/StartupItems/CUDA/StartupParameters.plist

/Library/StartupItems/ProTec6b/DemoOver

/Library/StartupItems/ProTec6b/Nalpeirond6b

/Library/StartupItems/ProTec6b/ProTec6b

/Library/StartupItems/ProTec6b/StartupParameters.plist

/Library/StartupItems/VyprVPN/tap/StartupParameters.plist

/Library/StartupItems/VyprVPN/tap/tap

/Library/StartupItems/VyprVPN/tun/StartupParameters.plist

/Library/StartupItems/VyprVPN/tun/tun

Bundles

/System/Library/Extensions/CUDA.kext

- com.nvidia.CUDA

/System/Library/Extensions/RIMBBUSB.kext

- com.rim.driver.BlackBerryUSBDriverInt

/System/Library/Extensions/RIMBBVSP.kext

- com.rim.driver.BlackBerryUSBDriverVSP

/System/Library/Extensions/RoxioBluRaySupport.kext

- com.roxio.BluRaySupport

/System/Library/Extensions/SiLabsUSBDriver.kext

- com.silabs.driver.CP210xVCPDriver

/System/Library/Extensions/SiLabsUSBDriver64.kext

- com.silabs.driver.CP210xVCPDriver64

/System/Library/Extensions/TabletDriverCFPlugin.bundle

- N/A

/System/Library/Extensions/Wacom Tablet.kext

- com.wacom.kext.wacomtablet

/Library/Audio/Plug-Ins/Components/A52Codec.component

- com.shepmater.A52Codec

/Library/Extensions/LittleSnitch.kext

- at.obdev.nke.LittleSnitch

/Library/Extensions/VyprVPN/tap.kext

- foo.tap

/Library/Extensions/VyprVPN/tun.kext

- foo.tun

/Library/Internet Plug-Ins/AdobeAAMDetect.plugin

- com.AdobeAAMDetectLib.AdobeAAMDetect

/Library/Internet Plug-Ins/AdobeExManDetect.plugin

- com.AdobeExManDetectLib.AdobeExManDetect

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

- com.adobe.acrobat.pdfviewer

/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

- com.adobe.acrobat.pdfviewerNPAPI

/Library/Internet Plug-Ins/EPPEX Plugin.plugin

- N/A

/Library/Internet Plug-Ins/Flash Player.plugin

- N/A

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

- com.oracle.java.JavaAppletPlugin

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

- com.microsoft.sharepoint.browserplugin

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

- com.microsoft.sharepoint.webkitplugin

/Library/Internet Plug-Ins/Silverlight.plugin

- com.microsoft.SilverlightPlugin

/Library/Internet Plug-Ins/WacomNetscape.plugin

- com.wacom.tabletplugin

/Library/Internet Plug-Ins/WacomTabletPlugin.plugin

- com.WacomTabletPluginLib.WacomTabletPlugin

/Library/PreferencePanes/CUDA Preferences.prefPane

- com.nvidia.CUDAPref

/Library/PreferencePanes/Flash Player.prefPane

- com.adobe.flashplayerpreferences

/Library/PreferencePanes/JavaControlPanel.prefPane

- com.oracle.java.JavaControlPanel

/Library/PreferencePanes/NTFSforMacOSX.prefPane

- com.paragon-software.filesystems.ntfs.prefpanel

/Library/PreferencePanes/Perian.prefPane

- org.perian.PerianPane

/Library/PreferencePanes/RapportPreferences.prefPane

- com.trusteer.RapportPreferences

/Library/PreferencePanes/WacomTablet.prefPane

- com.wacom.settingsPrefPane

/Library/QuickTime/AC3MovieImport.component

- com.cod3r.ac3movieimport

/Library/QuickTime/CanonMJPEGAVI.component

- jp.co.canon.MJPEGAVIExporter

/Library/QuickTime/CanonMJPEGAVIDec.component

- jp.co.canon.CanonMJPEGAVIDec

/Library/QuickTime/CanonText.component

- jp.co.canon.Text

/Library/QuickTime/Perian.component

- org.perian.Perian

/Library/ScriptingAdditions/Adobe Unit Types.osax

- N/A

/Library/ScriptingAdditions/SyncSIMBL.osax

- com.egg-software.SyncSIMBL

Library/Address Book Plug-Ins/SkypeABDialer.bundle

- com.skype.skypeabdialer

Library/Address Book Plug-Ins/SkypeABSMS.bundle

- com.skype.skypeabsms

Library/Caches/com.apple.Safari/Extensions/AdBlock-2.safariextension

- com.betafish.adblockforsafari

Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin

- com.citrixonline.mac.WebDeploymentPlugin

Library/Internet Plug-Ins/FacebookVideoCalling.bundle

- com.skype.FacebookVideoCalling

Library/Services/ToastIt.service

- com.roxio.ToastItService

dylibs

/usr/lib/ColorEfexPro4FC.dylib

/usr/lib/libUFSDNTFS.dylib

/usr/lib/SilverEfexPro2FC.dylib

Contents of /etc/hosts

127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

fe80::1%lo0 localhost

Contents of /etc/sysctl.conf

kern.sysv.shmmax=33554432

kern.sysv.shmmni=256

kern.sysv.shmseg=64

kern.sysv.shmall=8192

Contents of /System/Library/LaunchAgents/com.paragon.NTFS.notify.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.paragon.ntfs.trial</string>

<key>ProgramArguments</key>

<array>

<string>/Library/PreferencePanes/NTFSforMacOSX.prefPane/Contents/MacOS/notifica tor</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>LimitLoadToSessionType</key>

</dict>

</plist>

Contents of /System/Library/LaunchAgents/com.paragon.NTFS.trial.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.paragon.ntfs.trial</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Paragon NTFS for Mac OS X/NTFS for Mac OS X.app/Contents/MacOS/NTFS for Mac OS X</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>LimitLoadToSessionType</key>

</dict>

</plist>

Contents of /System/Library/LaunchAgents/com.paragon.NTFS.upd.plist (XML document text)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.paragon.ntfs.upd</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Paragon NTFS for Mac OS X/ParagonUpdateChecker.app/Contents/MacOS/ParagonUpdateChecker</string>

<string>service</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>LimitLoadToSessionType</key>

</dict>

</plist>

Contents of /System/Library/LaunchDaemons/com.apple.rpmuxd.plist (Apple binary property list)

bplist00” \MachServices_ ProgramArgumentsULabel— _ com.apple.rpmuxd ° _ /usr/libexec/rpmuxd /58KLN

Root crontab

* * * * * /var/root/lib/lib/y >/dev/null 2>&1

Font issues: 37

Bad plists

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content1-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content10-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content11-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content12-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content13-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content14-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content15-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content16-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content17-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content18-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content19-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content2-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content20-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content21-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content22-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content23-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content24-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content25-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content26-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content27-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content28-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content29-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content3-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content30-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content31-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content32-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content33-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content34-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content35-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content36-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content37-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content38-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content39-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content4-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content40-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content41-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content42-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content5-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content6-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content7-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content8-landscape.plist

Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/5045287 80.ibooks/OPS/assets/hints/content9-landscape.plist

DNS: 194.168.4.100 (static)

Listeners

launchd: afpovertcp

launchd: microsoft-ds

kdc: kerberos

Restricted files: 29840

Safari extensions

AdBlock

High file counts

Desktop: 65

Elapsed time (s): 710

Reply

Answer 6

Linc Davis

Level 10

209,541 points

Jul 8, 2014 8:19 PM in response to ptrbee

A.

You have a lot of configuration issues. The most urgent one is that the startup drive is failing, or there is some other internal hardware fault.

Back up all data on the drive immediately if you don't already have a current backup. There are ways to back up a computer that isn't fully functional—ask if you need guidance.

Make a "Genius" appointment at an Apple Store, or go to another authorized service provider.

If privacy is a concern, erase the data partition(s) with the option to write zeros* (do this only if you have at least two complete, independent backups, and you know how to restore to an empty drive from any of them.) Don’t erase the recovery partition, if present.

Keeping your confidential data secure during hardware repair

Apple also recommends that you deauthorize a device in the iTunes Store before having it serviced.

*An SSD doesn't need to be zeroed.

B.

The web server process is started by a third-party system modification called "GoodSync." Either remove it according to the developer's instructions, or refer to the developer for support. Do that after the hardware problem has been fixed, not before.

Reply

Answer 7

ptrbee Author

Level 1

9 points

Jul 9, 2014 6:24 AM in response to Linc Davis

Hi Linc,

thanks for your help with this. I saw this

Jul 8 18:06:47 disk0s2: I/O error.

Jul 8 18:06:48 vm_swapfile_io: vnode_pagein failed with 2.

and was thinking to boot from a setup disk or my macbook and attempt a disk repair. Had good sync for ages haven't used a long time as I found it was writing loads of small files to my NAS.

Reply

Answer 8

andyBall_uk

Level 7

20,516 points

Jul 9, 2014 9:03 AM in response to ptrbee

Given the IP addresses & /var/root/lib items involved, I'd wonder if the computer has been hacked to serve files for some purpose.

Reply

Answer 9

ptrbee Author

Level 1

9 points

Jul 9, 2014 8:34 PM in response to andyBall_uk

I was wondering if I was hacked too as this only recently started but is going to 4 IP's but 1 year away from the tech side of anything seems to have knocked me back to basic thought as I try to track this down some is coming back.

Reply

Answer 10

Drew Reece

Level 6

10,660 points

Jul 10, 2014 5:18 AM in response to ptrbee

ptrbee wrote:

I was wondering if I was hacked too as this only recently started but is going to 4 IP's but 1 year away from the tech side of anything seems to have knocked me back to basic thought as I try to track this down some is coming back.

Linc seems convinced it is GoodSync. Did you remove it? Did the process stop? Did uninstalling remove the files in var/root/lib?

It looks like a hack, but it could just be software that has been made by someone who thinks it's OK to install into /var/root.

Personally I'd be looking to remove SIMBL, trusteer, RIM, com.facebook.videochat.updater and all those out of date startup items (Apple deprecated them around 10.4).

Given the state of the HD (apparently failing) it's probably simplest to backup & migrate the user data you need and avoid migrating applications.

Reply

Answer 11

ptrbee Author

Level 1

9 points

Jul 11, 2014 7:32 AM in response to Drew Reece

I uninstalled it yes but no whatever it is is still restarting. I'm booked in to Apple store next Tuesday & currently backing up so fingers crossed.

Reply

Answer 12

ptrbee Author

Level 1

9 points

Jul 20, 2014 9:12 PM in response to Linc Davis

Hi Linc,

thanks for for your assist on this, my hard drive was failing and has now been replaced, collected the system back from Apple today restored from time machine but I'm still getting that httpd problem. I've uninstalled goodsync as well.

I'm also seeing ACL found but not expected when I run verify disk permissions in disk utility but from what I read says I need something called aclr8?

is there a anything else I can do to fix this?

Peter.

Reply

Answer 13

Drew Reece

Level 6

10,660 points

Jul 21, 2014 4:24 AM in response to ptrbee

ptrbee wrote:

is there a anything else I can do to fix this?

Peter.

Isn't now a good time to backup the data & reinstall the OS without the years of accumulated junk?

As I previously said …

…I'd be looking to remove SIMBL, trusteer, RIM, com.facebook.videochat.updater and all those out of date startup items (Apple deprecated them around 10.4).

SIMBL is an 'OS hack' it modifies the OS to do things not supported by Apple.

You have enough stuff old installed that troubleshooting it is going to require you update or remove it ALL. That means finding if versions for 10.9 exist for all the installed software or uninstalling it correctly if it isn't supported. Frankly there is enough installed to make me erase & start afresh (that really doesn't hurt every few years).

The process.

Backup to a bootable clone of your disk - check it boots (make several copies if you want to be safe).

Boot from Recovery mode - erase the internal HD in Disk Utility.

Install 10.9

Migrate your user data back to the internal disk (do not migrate applications back).

Reinstall ONLY the apps you actually need - avoid installing SIMBL, BlackBerry software, the vpn software…

This seems drastic, but it should be quicker than trying to clean up the software manually. It will fix anything you broke by logging in as root - do not log in as root anymore there is no need.

Reply