Q: Finder Keeps Crashing in OSX 10.9
-
Sep 23, 2014 3:07 PMby Linc Davis,Launch the Console application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
Step 1
For this step, the title of the Console window should be All Messages. If it isn't, select
SYSTEM LOG QUERIES ▹ All Messages
from the log list on the left. If you don't see that list, select
View ▹ Show Log List
from the menu bar at the top of the screen.
In the top right corner of the Console window, there's a search box labeled Filter. Initially the words "String Matching" are shown in that box. Enter the name of the crashed application or process. For example, if iTunes crashed, you would enter "iTunes" (without the quotes.)
Each message in the log begins with the date and time when it was entered. Select the messages from the time of the last crash, if any. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.
☞ The log contains a vast amount of information, almost all of which is irrelevant to solving any particular problem. When posting a log extract, be selective. A few dozen lines are almost always more than enough.
Please don't indiscriminately dump thousands of lines from the log into this discussion.
Please don't post screenshots of log messages—post the text.
☞ Some private information, such as your name, may appear in the log. Anonymize before posting.
Step 2
In the Console window, select
DIAGNOSTIC AND USAGE INFORMATION ▹ User Diagnostic Reports
(not Diagnostic and Usage Messages) from the log list on the left. There is a disclosure triangle to the left of the list item. If the triangle is pointing to the right, click it so that it points down. You'll see a list of crash reports. The name of each report starts with the name of the process, and ends with ".crash". Select the most recent report related to the process in question. The contents of the report will appear on the right. Use copy and paste to post the entire contents—the text, not a screenshot.
I know the report is long, maybe several hundred lines. Please post all of it anyway.
If you don't see any reports listed, but you know there was a crash, you may have chosen Diagnostic and Usage Messages from the log list. Choose DIAGNOSTIC AND USAGE INFORMATION instead.
In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)
Please don’t post other kinds of diagnostic report—they're very long and rarely helpful.
-
Sep 24, 2014 2:00 AMby fred_a,Thanks a lot,
Okay so in terms of the Console report for the last crash- here's the header of the report, not sure if you want me to post more than this?
Date/Time: 2014-09-23 17:16:18 +0100
OS Version: 10.9.5 (Build 13F34)
Architecture: x86_64
Report Version: 18
Command: Finder
Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
Version: 10.9.4 (10.9.4)
Build Version: 1
Project Name: Finder_FE
Source Version: 885004002000000
Parent: launchd [183]
PID: 203
Event: hang
Duration: 0.96s (process was unresponsive for 410 seconds before sampling)
Steps: 10 (100ms sampling interval)
Hardware model: MacPro5,1
Active cpus: 16
Fan speed: 799 rpm
Free pages: 1037110 pages (-1706)
Pageins: 2 pages
Pageouts: 0 pages
Swapins: 0 pages
Swapouts: 0 pages
Process: Finder [203]
Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
Architecture: x86_64
Parent: launchd [183]
UID: 501
Task size: 4638 pages
Note: Unresponsive for 410 seconds before sampling
Thread 0x8c9 DispatchQueue 1 priority 46
10 start + 1 (libdyld.dylib) [0x7fff894735fd]
10 ??? (Finder + 26416) [0x10a62a730]
10 NSApplicationMain + 940 (AppKit) [0x7fff8e358783]
10 -[NSApplication run] + 553 (AppKit) [0x7fff8e36d99c]
10 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122 (AppKit) [0x7fff8e37989b]
10 _DPSNextEvent + 1434 (AppKit) [0x7fff8e37a24e]
10 _BlockUntilNextEventMatchingListInModeWithFilter + 65 (HIToolbox) [0x7fff890095bc]
10 ReceiveNextEventCommon + 173 (HIToolbox) [0x7fff89009685]
10 RunCurrentEventLoopInMode + 49 (HIToolbox) [0x7fff8900995c]
10 _FirstEventTime + 1036 (HIToolbox) [0x7fff89009e91]
10 SyncIronwoodHotKey + 26 (HIToolbox) [0x7fff89010c26]
10 TISGetIronwoodEnabledState + 21 (HIToolbox) [0x7fff89010cfd]
10 CopyInputSourceRefForInputSourceID + 96 (HIToolbox) [0x7fff89010d9a]
10 TISCreateInputSourceList + 42 (HIToolbox) [0x7fff8900b3f9]
10 InitTSMFirstEventTime + 205 (HIToolbox) [0x7fff8900b840]
10 InstallInputSourceMgrHandlers + 616 (HIToolbox) [0x7fff8900bcda]
10 FSEventStreamStart + 260 (CarbonCore) [0x7fff8bc8769c]
10 register_with_server + 869 (CarbonCore) [0x7fff8bc87bb0]
10 f2d_register_rpc + 325 (CarbonCore) [0x7fff8bc87e15]
10 mach_msg_trap + 10 (libsystem_kernel.dylib) [0x7fff8c261a1a]
*10 ipc_mqueue_receive_continue + 0 (mach_kernel) [0xffffff80002167d0]
Thread 0x902 DispatchQueue 2 priority 48
10 _dispatch_mgr_thread + 52 (libdispatch.dylib) [0x7fff8fc57136]
10 kevent64 + 10 (libsystem_kernel.dylib) [0x7fff8c266662]
*10 ??? (mach_kernel + 3960080) [0xffffff80005c6d10]
Thread 0x92f DispatchQueue 4 priority 44
10 start_wqthread + 13 (libsystem_pthread.dylib) [0x7fff92ae2fb9]
10 _pthread_wqthread + 314 (libsystem_pthread.dylib) [0x7fff92adfef8]
10 _dispatch_worker_thread2 + 40 (libdispatch.dylib) [0x7fff8fc58177]
10 _dispatch_root_queue_drain + 326 (libdispatch.dylib) [0x7fff8fc57082]
10 _dispatch_client_callout + 8 (libdispatch.dylib) [0x7fff8fc5528d]
10 _dispatch_call_block_and_release + 12 (libdispatch.dylib) [0x7fff8fc581bb]
10 -[NSFileManager URLForUbiquityContainerIdentifier:] + 334 (Foundation) [0x7fff855e3d21]
10 semaphore_wait_trap + 10 (libsystem_kernel.dylib) [0x7fff8c261a56]
*10 semaphore_wait_continue + 0 (mach_kernel) [0xffffff800023b570]
Thread 0x90e DispatchQueue 56 priority 46
10 start_wqthread + 13 (libsystem_pthread.dylib) [0x7fff92ae2fb9]
10 _pthread_wqthread + 314 (libsystem_pthread.dylib) [0x7fff92adfef8]
10 _dispatch_worker_thread2 + 40 (libdispatch.dylib) [0x7fff8fc58177]
10 _dispatch_root_queue_drain + 75 (libdispatch.dylib) [0x7fff8fc56f87]
10 _dispatch_queue_invoke + 110 (libdispatch.dylib) [0x7fff8fc589c1]
10 _dispatch_queue_drain + 451 (libdispatch.dylib) [0x7fff8fc57673]
10 _dispatch_client_callout + 8 (libdispatch.dylib) [0x7fff8fc5528d]
10 _dispatch_call_block_and_release + 12 (libdispatch.dylib) [0x7fff8fc581bb]
10 ___ZN17TVolumeSyncThread19PostNodeTaskRequestEP9TNodeTask_block_invoke + 91 (DesktopServicesPriv) [0x7fff8d44389f]
10 ExceptionSafeBlock(void () block_pointer) + 12 (DesktopServicesPriv) [0x7fff8d4438b1]
10 ___ZN17TVolumeSyncThread19PostNodeTaskRequestEP9TNodeTask_block_invoke_2 + 84 (DesktopServicesPriv) [0x7fff8d443961]
10 TNode::HandleNodeRequest(TCountedPtr<TNodeTask> const&, TCountedPtr<TVolumeSyncThread> const&) + 1017 (DesktopServicesPriv) [0x7fff8d443e21]
10 TNode::HandleVolumeAdded(TCountedPtr<TNodeTask> const&, TNodePtr const&, bool, TCountedPtr<TVolumeSyncThread> const&) + 67 (DesktopServicesPriv) [0x7fff8d4a4c71]
10 TNode::AddVolume(TCountedPtr<TVolumeSyncThread> const&, short, unsigned char, TNodePtr&, bool&) + 133 (DesktopServicesPriv) [0x7fff8d444727]
10 TFSVolumeInfo::AddVolume(TCountedPtr<TVolumeSyncThread> const&, short, unsigned char, TCountedPtr<TFSVolumeInfo>&, bool&) + 131 (DesktopServicesPriv) [0x7fff8d43844f]
10 TFSVolumeInfo::Initialize(TCountedPtr<TVolumeSyncThread> const&, short, unsigned char, bool&) + 167 (DesktopServicesPriv) [0x7fff8d43882d]
10 FSGetVolumeParms + 46 (CarbonCore) [0x7fff8bc8508b]
10 FSMount::FSMount(short, int*, unsigned char, unsigned int const*) + 66 (CarbonCore) [0x7fff8bc7a194]
10 lstat$INODE64 + 10 (libsystem_kernel.dylib) [0x7fff8c26670a]
*10 hndl_unix_scall64 + 22 (mach_kernel) [0xffffff80002f4176]
*10 unix_syscall64 + 499 (mach_kernel) [0xffffff8000640c63]
*10 lstat64 + 156 (mach_kernel) [0xffffff80003e9bfc]
*10 ??? (mach_kernel + 2038082) [0xffffff80003f1942]
*10 namei + 1460 (mach_kernel) [0xffffff80003d5a74]
*10 lookup + 603 (mach_kernel) [0xffffff80003d611b]
*10 VNOP_LOOKUP + 75 (mach_kernel) [0xffffff80003fd75b]
*10 cd9660_lookup + 182 (cd9660) [0xffffff7f817c2b33]
*10 lck_mtx_lock + 653 (mach_kernel) [0xffffff80002d18fd]
*10 lck_mtx_lock_wait_x86 + 384 (mach_kernel) [0xffffff80002d6560]
*10 thread_block_reason + 204 (mach_kernel) [0xffffff8000235d5c]
*10 ??? (mach_kernel + 223579) [0xffffff800023695b]
*10 machine_switch_context + 354 (mach_kernel) [0xffffff80002d8452]
Thread 0x2b2f priority 46
10 start_wqthread + 13 (libsystem_pthread.dylib) [0x7fff92ae2fb9]
10 __workq_kernreturn + 10 (libsystem_kernel.dylib) [0x7fff8c265e6a]
*10 wq_unpark_continue + 0 (pthread) [0xffffff7f80c096ae]
Binary Images:
0x10a624000 - 0x10aaf2ff9 com.apple.finder 10.9.4 (10.9.4) <1CEEB00A-B22D-34DA-ABDB-EC5419F308A4> /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
0x7fff855bb000 - 0x7fff858bbff7 com.apple.Foundation 6.9 (1056.16) <24349208-3603-3F5D-95CC-B379616FBEF8> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x7fff88fdb000 - 0x7fff89285ff5 com.apple.HIToolbox 2.1.1 <26FF0E2C-1CD7-311F-ACF0-84F3D5273AD6> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.fra mework/Versions/A/HIToolbox
0x7fff89470000 - 0x7fff89473ff7 libdyld.dylib (239.4) <A1273A02-4928-3BAC-A846-6C069DC1A0A6> /usr/lib/system/libdyld.dylib
0x7fff8bc71000 - 0x7fff8bf5bfff com.apple.CoreServices.CarbonCore 1077.17 (1077.17) <3A2E92FD-DEE2-3D45-9619-11500801A61C> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonC ore.framework/Versions/A/CarbonCore
0x7fff8c250000 - 0x7fff8c26cff7 libsystem_kernel.dylib (2422.115.4) <9EDE872E-2A9E-3A78-8E1D-AB790794A098> /usr/lib/system/libsystem_kernel.dylib
0x7fff8d434000 - 0x7fff8d564ff7 com.apple.desktopservices 1.8.3 (1.8.3) <225BEC20-F8E0-3F22-9560-890A1A5B9050> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Desk topServicesPriv
0x7fff8e356000 - 0x7fff8eeccff7 com.apple.AppKit 6.9 (1265.21) <9DC13B27-841D-3839-93B2-3EDE66157BDE> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x7fff8fc54000 - 0x7fff8fc6efff libdispatch.dylib (339.92.1) <C4E4A18D-3C3B-3C9C-8709-A4270D998DE7> /usr/lib/system/libdispatch.dylib
0x7fff92add000 - 0x7fff92ae4ff7 libsystem_pthread.dylib (53.1.4) <AB498556-B555-310E-9041-F67EC9E00E2C> /usr/lib/system/libsystem_pthread.dylib
*0xffffff7f80c06000 - 0xffffff7f80c0dfff com.apple.kec.pthread 1.0 (1) <882075E6-12C4-3225-8750-928715183739> /System/Library/Extensions/pthread.kext/Contents/MacOS/pthread
*0xffffff7f817c2000 - 0xffffff7f817c8ff5 com.apple.filesystems.cd9660 1.4.4 (1.4.4) <B30918FD-1CFF-3D4E-9286-E0DD2D69C281> /System/Library/Extensions/cd9660.kext/Contents/MacOS/cd9660
*0xffffff8000200000 - 0xffffff80007a823a mach_kernel (2422.115.4) <9477416E-7BCA-3679-AF97-E1EAAD3DD5A0> /mach_kernel
Then in terms of the diagnostics report. The latest I could find was the below- however this is dated the 19th Sept, when the last time the finder hung was yesterday (23rd)... I'll post it anyway, but not sure how relevant it is.
Process: SIMBL Agent [250]
Path: /Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent
Identifier: net.culater.SIMBL_Agent
Version: 0.9.9 (0.9.9)
Code Type: X86-64 (Native)
Parent Process: launchd [192]
Responsible: SIMBL Agent [250]
User ID: 501
Date/Time: 2014-09-19 14:56:53.183 +0100
OS Version: Mac OS X 10.9.4 (13E28)
Report Version: 11
Anonymous UUID:
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000018
VM Regions Near 0x18:
-->
__TEXT 0000000100000000-0000000100005000 [ 20K] r-x/rwx SM=COW /Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent
Application Specific Information:
objc_msgSend() selector name: respondsToSelector:
objc[250]: garbage collection is ON
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libobjc.A.dylib 0x0000000100046097 objc_msgSend + 23
1 com.apple.Foundation 0x0000000100584184 _NSDescriptionWithLocaleFunc + 41
2 com.apple.CoreFoundation 0x000000010024fce4 __CFStringAppendFormatCore + 7332
3 com.apple.CoreFoundation 0x000000010027e263 _CFStringCreateWithFormatAndArgumentsAux + 115
4 com.apple.Foundation 0x000000010058412f -[NSPlaceholderString initWithFormat:locale:arguments:] + 132
5 com.apple.Foundation 0x000000010058798c +[NSString stringWithFormat:] + 170
6 net.culater.SIMBL_Agent 0x00000001000018f8 -[SIMBLAgent injectSIMBL:] + 874
7 com.apple.CoreFoundation 0x000000010032fe0c __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12
8 com.apple.CoreFoundation 0x000000010022382d _CFXNotificationPost + 2893
9 com.apple.Foundation 0x000000010056c7ba -[NSNotificationCenter postNotificationName:object:userInfo:] + 68
10 com.apple.AppKit 0x000000010132f80b applicationStatusSubsystemCallback + 455
11 com.apple.LaunchServices 0x00000001042b1c39 ___LSScheduleNotificationFunction_block_invoke_2 + 47
12 com.apple.CoreFoundation 0x000000010029248c __CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__ + 12
13 com.apple.CoreFoundation 0x0000000100283ae5 __CFRunLoopDoBlocks + 341
14 com.apple.CoreFoundation 0x000000010028386e __CFRunLoopRun + 1982
15 com.apple.CoreFoundation 0x0000000100282e75 CFRunLoopRunSpecific + 309
16 com.apple.HIToolbox 0x000000010628da0d RunCurrentEventLoopInMode + 226
17 com.apple.HIToolbox 0x000000010628d7b7 ReceiveNextEventCommon + 479
18 com.apple.HIToolbox 0x000000010628d5bc _BlockUntilNextEventMatchingListInModeWithFilter + 65
19 com.apple.AppKit 0x0000000100ac924e _DPSNextEvent + 1434
20 com.apple.AppKit 0x0000000100ac889b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
21 com.apple.AppKit 0x0000000100abc99c -[NSApplication run] + 553
22 com.apple.AppKit 0x0000000100aa7783 NSApplicationMain + 940
23 net.culater.SIMBL_Agent 0x00000001000012c8 start + 52
Thread 1:: Dispatch queue: com.apple.libdispatch-manager
0 libsystem_kernel.dylib 0x00000001020a8662 kevent64 + 10
1 libdispatch.dylib 0x0000000101eff421 _dispatch_mgr_invoke + 239
2 libdispatch.dylib 0x0000000101eff136 _dispatch_mgr_thread + 52
Thread 2:: Dispatch queue: NSWorkspace Volume Observer Queue
0 libsystem_kernel.dylib 0x00000001020a870a lstat$INODE64 + 10
1 com.apple.CoreServices.CarbonCore 0x0000000103bf0331 FSMount::initVolumeInfo(unsigned char) + 1315
2 com.apple.CoreServices.CarbonCore 0x0000000103bfd0e1 FSMount::FSMount(short, unsigned char*, short, char**, unsigned int, unsigned char*, short*, unsigned int const*) + 419
3 com.apple.CoreServices.CarbonCore 0x0000000103bfcc12 _FSGetVolumeInfoWithFlags + 88
4 com.apple.CoreServices.CarbonCore 0x0000000103bfcbb1 FSGetVolumeInfo + 29
5 com.apple.AppKit 0x000000010132fee5 addVolumeTrackerForVolumeRefNum + 222
6 com.apple.AppKit 0x000000010132fab5 volumeObserverCallback + 364
7 com.apple.CoreServices.CarbonCore 0x0000000103c27437 _FSVolumeObserverCallback + 173
8 com.apple.CoreServices.CarbonCore 0x0000000103c27365 ___FSAddVolumeObserverOnQueue_block_invoke_2 + 205
9 libdispatch.dylib 0x0000000101efd28d _dispatch_client_callout + 8
10 libdispatch.dylib 0x0000000101eff885 _dispatch_source_invoke + 413
11 libdispatch.dylib 0x0000000101eff617 _dispatch_queue_drain + 359
12 libdispatch.dylib 0x0000000101f009c1 _dispatch_queue_invoke + 110
13 libdispatch.dylib 0x0000000101efef87 _dispatch_root_queue_drain + 75
14 libdispatch.dylib 0x0000000101f00177 _dispatch_worker_thread2 + 40
15 libsystem_pthread.dylib 0x00000001021a1ef8 _pthread_wqthread + 314
16 libsystem_pthread.dylib 0x00000001021a4fb9 start_wqthread + 13
Thread 3:
0 libsystem_kernel.dylib 0x00000001020a3a1a mach_msg_trap + 10
1 libsystem_kernel.dylib 0x00000001020a2d18 mach_msg + 64
2 com.apple.CoreFoundation 0x0000000100283f15 __CFRunLoopServiceMachPort + 181
3 com.apple.CoreFoundation 0x0000000100283539 __CFRunLoopRun + 1161
4 com.apple.CoreFoundation 0x0000000100282e75 CFRunLoopRunSpecific + 309
5 com.apple.AppKit 0x0000000100c6905e _NSEventThread + 144
6 libsystem_pthread.dylib 0x00000001021a0899 _pthread_body + 138
7 libsystem_pthread.dylib 0x00000001021a072a _pthread_start + 137
8 libsystem_pthread.dylib 0x00000001021a4fc9 thread_start + 13
Thread 4:
0 libsystem_kernel.dylib 0x00000001020a7e6a __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00000001021a1f08 _pthread_wqthread + 330
2 libsystem_pthread.dylib 0x00000001021a4fb9 start_wqthread + 13
Thread 5:
0 libsystem_kernel.dylib 0x00000001020a7e6a __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00000001021a1f08 _pthread_wqthread + 330
2 libsystem_pthread.dylib 0x00000001021a4fb9 start_wqthread + 13
Thread 0 crashed with X86 Thread State (64-bit):
rax: 0x000000010058415b rbx: 0x7000b81799d368d5 rcx: 0x00007fff5fbfd348 rdx: 0x0000000105f2f3fa
rdi: 0x7000b81799d368d5 rsi: 0x00000001007e1284 rbp: 0x00007fff5fbfc790 rsp: 0x00007fff5fbfc778
r8: 0x00000004009bced0 r9: 0x000000040020da00 r10: 0x00000001007e1284 r11: 0x0000000000000000
r12: 0x00007fff5fbfcb70 r13: 0x00007fff5fbfd310 r14: 0x0000000000000000 r15: 0x00007fff5fbfcb70
rip: 0x0000000100046097 rfl: 0x0000000000010206 cr2: 0x0000000000000018
Logical CPU: 14
Error Code: 0x00000004
Trap Number: 14
Binary Images:
0x100000000 - 0x100004fff +net.culater.SIMBL_Agent (0.9.9 - 0.9.9) <74AD5FAB-C4B2-A087-D428-0CC597C2E716> /Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent
0x100009000 - 0x100009fff libimckit.dylib (1) <890A5A7A-E826-3556-5A5F-6C026AFB3AF3> /usr/lib/libimckit.dylib
0x10000c000 - 0x100023fff com.apple.ScriptingBridge (1.3.1 - 63) <CE24DD07-7A89-3105-AE57-A1BED0189292> /System/Library/Frameworks/ScriptingBridge.framework/Versions/A/ScriptingBridge
0x100036000 - 0x100036fff com.apple.Cocoa (6.8 - 20) <E90E99D7-A425-3301-A025-D9E0CD11918E> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x100039000 - 0x10003aff7 libSystem.B.dylib (1197.1.1) <E6BCC031-4342-318C-A1AD-A8E9AEAE716F> /usr/lib/libSystem.B.dylib
0x100041000 - 0x1001eef27 libobjc.A.dylib (551.1) <AD7FD984-271E-30F4-A361-6B20319EC73B> /usr/lib/libobjc.A.dylib
0x10020f000 - 0x10020ffff com.apple.CoreServices (59 - 59) <7A697B5E-F179-30DF-93F2-8B503CEEEFD5> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x100213000 - 0x1003f8fff com.apple.CoreFoundation (6.9 - 855.17) <729BD6DA-1F63-3E72-A148-26F21EBF52BB> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x10056a000 - 0x100868fff com.apple.Foundation (6.9 - 1056.13) <2EE9AB07-3EA0-37D3-B407-4A520F2CB497> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x100aa5000 - 0x10161bff7 com.apple.AppKit (6.9 - 1265.21) <9DC13B27-841D-3839-93B2-3EDE66157BDE> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x101da2000 - 0x101da3fff libffi.dylib (18.1) <FEB76C94-97BA-39BC-B713-D086B9757BA5> /usr/lib/libffi.dylib
0x101da7000 - 0x101da7fff com.apple.ApplicationServices (48 - 48) <3E3F01A8-314D-378F-835E-9CC4F8820031> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Application Services
0x101daa000 - 0x101daafff com.apple.Carbon (154 - 157) <45A9A40A-78FF-3EA0-8FAB-A4F81052FA55> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x101dad000 - 0x101dfffff libc++.1.dylib (120) <4F68DFC5-2077-39A8-A449-CAC5FDEE7BDE> /usr/lib/libc++.1.dylib
0x101e5b000 - 0x101e5fff7 libcache.dylib (62) <BDC1E65B-72A1-3DA3-A57C-B23159CAAD0B> /usr/lib/system/libcache.dylib
0x101e64000 - 0x101e6efff libcommonCrypto.dylib (60049) <8C4F0CA0-389C-3EDC-B155-E62DD2187E1D> /usr/lib/system/libcommonCrypto.dylib
0x101e7c000 - 0x101e83fff libcompiler_rt.dylib (35) <4CD916B2-1B17-362A-B403-EF24A1DAC141> /usr/lib/system/libcompiler_rt.dylib
0x101e8f000 - 0x101e96ffb libcopyfile.dylib (103.92.1) <CF29DFF6-0589-3590-834C-82E2316612E8> /usr/lib/system/libcopyfile.dylib
0x101e9d000 - 0x101eebfff libcorecrypto.dylib (161.1) <F3973C28-14B6-3006-BB2B-00DD7F09ABC7> /usr/lib/system/libcorecrypto.dylib
0x101efc000 - 0x101f16fff libdispatch.dylib (339.92.1) <C4E4A18D-3C3B-3C9C-8709-A4270D998DE7> /usr/lib/system/libdispatch.dylib
0x101f30000 - 0x101f33ff7 libdyld.dylib (239.4) <A1273A02-4928-3BAC-A846-6C069DC1A0A6> /usr/lib/system/libdyld.dylib
0x101f3a000 - 0x101f3aff7 libkeymgr.dylib (28) <3AA8D85D-CF00-3BD3-A5A0-E28E1A32A6D8> /usr/lib/system/libkeymgr.dylib
0x101f3f000 - 0x101f46ff8 liblaunch.dylib (842.92.1) <A40A0C7B-3216-39B4-8AE0-B5D3BAF1DA8A> /usr/lib/system/liblaunch.dylib
0x101f4e000 - 0x101f53fff libmacho.dylib (845) <1D2910DF-C036-3A82-A3FD-44FF73B5FF9B> /usr/lib/system/libmacho.dylib
0x101f59000 - 0x101f5bff7 libquarantine.dylib (71) <7A1A2BCB-C03D-3A25-BFA4-3E569B2D2C38> /usr/lib/system/libquarantine.dylib
0x101f61000 - 0x101f62ffb libremovefile.dylib (33) <3543F917-928E-3DB2-A2F4-7AB73B4970EF> /usr/lib/system/libremovefile.dylib
0x101f68000 - 0x101f79ff7 libsystem_asl.dylib (217.1.4) <655FB343-52CF-3E2F-B14D-BEBF5AAEF94D> /usr/lib/system/libsystem_asl.dylib
0x101f83000 - 0x101f84ff7 libsystem_blocks.dylib (63) <FB856CD1-2AEA-3907-8E9B-1E54B6827F82> /usr/lib/system/libsystem_blocks.dylib
0x101f89000 - 0x102012ff7 libsystem_c.dylib (997.90.3) <6FD3A400-4BB2-3B95-B90C-BE6E9D0D78FA> /usr/lib/system/libsystem_c.dylib
0x10203e000 - 0x102040ff3 libsystem_configuration.dylib (596.15) <4998CB6A-9D54-390A-9F57-5D1AC53C135C> /usr/lib/system/libsystem_configuration.dylib
0x102046000 - 0x10204efff libsystem_dnssd.dylib (522.92.1) <17B03FFD-92C5-3282-9981-EBB28B456207> /usr/lib/system/libsystem_dnssd.dylib
0x102055000 - 0x10207cffb libsystem_info.dylib (449.1.3) <7D41A156-D285-3849-A2C3-C04ADE797D98> /usr/lib/system/libsystem_info.dylib
0x102092000 - 0x1020aeff7 libsystem_kernel.dylib (2422.110.17) <873931CE-D1AF-3596-AADB-D2E63C9AB29F> /usr/lib/system/libsystem_kernel.dylib
0x1020d2000 - 0x102101fd2 libsystem_m.dylib (3047.16) <B7F0E2E4-2777-33FC-A787-D6430B630D54> /usr/lib/system/libsystem_m.dylib
0x10210c000 - 0x102127ff7 libsystem_malloc.dylib (23.10.1) <A695B4E4-38E9-332E-A772-29D31E3F1385> /usr/lib/system/libsystem_malloc.dylib
0x102131000 - 0x102158ff7 libsystem_network.dylib (241.3) <8B1E1F1D-A5CC-3BAE-8B1E-ABC84337A364> /usr/lib/system/libsystem_network.dylib
0x102174000 - 0x10217dff3 libsystem_notify.dylib (121) <52571EC3-6894-37E4-946E-064B021ED44E> /usr/lib/system/libsystem_notify.dylib
0x102186000 - 0x10218cff7 libsystem_platform.dylib (24.90.1) <3C3D3DA8-32B9-3243-98EC-D89B9A1670B3> /usr/lib/system/libsystem_platform.dylib
0x10219f000 - 0x1021a6ff7 libsystem_pthread.dylib (53.1.4) <AB498556-B555-310E-9041-F67EC9E00E2C> /usr/lib/system/libsystem_pthread.dylib
0x1021b2000 - 0x1021b3fff libsystem_sandbox.dylib (278.11.1) <0D0B13EA-6B7A-3AC8-BE60-B548543BEB77> /usr/lib/system/libsystem_sandbox.dylib
0x1021b8000 - 0x1021bcff7 libsystem_stats.dylib (93.90.3) <337946FC-B2E1-3DFA-A8B5-30DA8D584D75> /usr/lib/system/libsystem_stats.dylib
0x1021c3000 - 0x1021c4fff libunc.dylib (28) <62682455-1862-36FE-8A04-7A6B91256438> /usr/lib/system/libunc.dylib
0x1021ca000 - 0x1021cfff7 libunwind.dylib (35.3) <78DCC358-2FC1-302E-B395-0155B47CB547> /usr/lib/system/libunwind.dylib
0x1021d6000 - 0x1021fafff libxpc.dylib (300.90.2) <AB40CD57-F454-3FD4-B415-63B3C0D5C624> /usr/lib/system/libxpc.dylib
0x102217000 - 0x102259ff7 libauto.dylib (185.5) <F45C36E8-B606-3886-B5B1-B6745E757CA8> /usr/lib/libauto.dylib
0x102271000 - 0x10229aff7 libc++abi.dylib (49.1) <21A807D3-6732-3455-B77F-743E9F916DF0> /usr/lib/libc++abi.dylib
0x1022a8000 - 0x1022a9ff7 libDiagnosticMessagesClient.dylib (100) <4CDB0F7B-C0AF-3424-BC39-495696F0DB1E> /usr/lib/libDiagnosticMessagesClient.dylib
0x1022ae000 - 0x102bce32b com.apple.CoreGraphics (1.600.0 - 599.25.10.1) <EC14B831-96BB-3A50-A451-E36BDC8F59FB> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x102cfb000 - 0x102dbdff5 com.apple.CoreText (367.20 - 367.20) <B80D086D-93A9-3C35-860E-9C3FDD027F3B> /System/Library/Frameworks/CoreText.framework/Versions/A/CoreText
0x102e2b000 - 0x102f31ff7 com.apple.ImageIO.framework (3.3.0 - 1043) <C4ADE5B1-A540-34E1-A043-118185489C9D> /System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x102f99000 - 0x103008ff1 com.apple.ApplicationServices.ATS (360 - 363.3) <546E89D9-2AE7-3111-B2B8-2366650D22F0> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/ATS
0x103034000 - 0x1030bdfff com.apple.ColorSync (4.9.0 - 4.9.0) <B756B908-9AD1-3F5D-83F9-7A0B068387D2> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ColorSync.framework/Versions/A/ColorSync
0x103104000 - 0x103149ff6 com.apple.HIServices (1.23 - 468) <E06287C4-1534-3D46-B099-3DF8B8EE4EB5> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ HIServices.framework/Versions/A/HIServices
0x10317c000 - 0x10318bff8 com.apple.LangAnalysis (1.7.0 - 1.7.0) <8FE131B6-1180-3892-98F5-C9C9B79072D4> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ LangAnalysis.framework/Versions/A/LangAnalysis
0x103199000 - 0x1031e6ff2 com.apple.print.framework.PrintCore (9.0 - 428) <8D8253E3-302F-3DB2-9C5C-572CB974E8B3> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ PrintCore.framework/Versions/A/PrintCore
0x103213000 - 0x10324cff7 com.apple.QD (3.50 - 298) <C1F20764-DEF0-34CF-B3AB-AB5480D64E66> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ QD.framework/Versions/A/QD
0x103268000 - 0x103271fff com.apple.speech.synthesis.framework (4.7.1 - 4.7.1) <383FB557-E88E-3239-82B8-15F9F885B702> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x103284000 - 0x103295ff7 libz.1.dylib (53) <42E0C8C6-CA38-3CA4-8619-D24ED5DD492E> /usr/lib/libz.1.dylib
0x10329b000 - 0x1032abfff libbsm.0.dylib (33) <2CAC00A2-1352-302A-88FA-C567D4D69179> /usr/lib/libbsm.0.dylib
0x1032b4000 - 0x103320fff com.apple.framework.IOKit (2.0.1 - 907.100.13) <057FDBA3-56D6-3903-8C0B-849214BF1985> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x103355000 - 0x103358ffc com.apple.IOSurface (91.1 - 91.1) <D00EEB0C-8AA8-3986-90C1-C97B2486E8FA> /System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface
0x103361000 - 0x1035bbff9 com.apple.security (7.0 - 55471.14.8) <EA03E140-2509-3A07-8440-2DC97C0D478B> /System/Library/Frameworks/Security.framework/Versions/A/Security
0x103704000 - 0x103704fff com.apple.Accelerate (1.9 - Accelerate 1.9) <509BB27A-AE62-366D-86D8-0B06D217CF56> /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x103707000 - 0x103712fff libkxld.dylib (2422.110.17) <B6140BAB-0EAF-3E4F-B055-314068056BB4> /usr/lib/system/libkxld.dylib
0x103717000 - 0x1038cfffb libicucore.A.dylib (511.34) <616A65D6-3F20-3EAB-8CA8-273AD890261C> /usr/lib/libicucore.A.dylib
0x103975000 - 0x103ae5ff4 com.apple.CFNetwork (673.4 - 673.4) <F3BF6020-99BE-3844-A7B8-352B93AD02F3> /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x103bec000 - 0x103ed6fff com.apple.CoreServices.CarbonCore (1077.17 - 1077.17) <3A2E92FD-DEE2-3D45-9619-11500801A61C> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonC ore.framework/Versions/A/CarbonCore
0x103f53000 - 0x103fe3ff7 com.apple.Metadata (10.7.0 - 800.28) <CB43AF4C-F5DE-3161-B7D7-540DF9718EAD> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadat a.framework/Versions/A/Metadata
0x10404a000 - 0x1040c1fff com.apple.CoreServices.OSServices (600.4 - 600.4) <B9436B61-0885-3EF6-B981-EB77C325F745> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServi ces.framework/Versions/A/OSServices
0x104164000 - 0x1041d1fff com.apple.SearchKit (1.4.0 - 1.4.0) <B9B8D510-A27E-36B0-93E9-17146D9E9045> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchK it.framework/Versions/A/SearchKit
0x104215000 - 0x104270ffb com.apple.AE (665.5 - 665.5) <BBA230F9-144C-3CAB-A77A-0621719244CD> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.fram ework/Versions/A/AE
0x10429f000 - 0x104369fff com.apple.LaunchServices (572.28 - 572.28) <FDED4724-4CB6-3DE5-B785-AE6D4C261CF6> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchS ervices.framework/Versions/A/LaunchServices
0x1043de000 - 0x104407fff com.apple.DictionaryServices (1.2 - 208) <A539A058-BA57-35EE-AA08-D0B0E835127D> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/DictionaryServices
0x10442a000 - 0x10448dffb com.apple.SystemConfiguration (1.13.1 - 1.13.1) <2C8E1A73-5AD6-3A7D-8ED8-D6755555A993> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfi guration
0x1044c8000 - 0x1045b2fff libsqlite3.dylib (158) <00269BF9-43BE-39E0-9C85-24585B9923C8> /usr/lib/libsqlite3.dylib
0x1045c9000 - 0x1046b0ff7 libxml2.2.dylib (26) <A1DADD11-89E5-3DE4-8802-07186225967F> /usr/lib/libxml2.2.dylib
0x1046e6000 - 0x1046f3ff7 libxar.1.dylib (202) <5572AA71-E98D-3FE1-9402-BB4A84E0E71E> /usr/lib/libxar.1.dylib
0x1046fb000 - 0x1046fffff libpam.2.dylib (20) <B93CE8F5-DAA8-30A1-B1F6-F890509513CB> /usr/lib/libpam.2.dylib
0x104704000 - 0x104704ffd libOpenScriptingUtil.dylib (157) <19F0E769-0989-3062-9AFB-8976E90E9759> /usr/lib/libOpenScriptingUtil.dylib
0x104708000 - 0x104715ff0 libbz2.1.0.dylib (29) <0B98AC35-B138-349C-8063-2B987A75D24C> /usr/lib/libbz2.1.0.dylib
0x10471b000 - 0x104720fff com.apple.DiskArbitration (2.6 - 2.6) <A4165553-770E-3D27-B217-01FC1F852B87> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x10472a000 - 0x104731fff com.apple.NetFS (6.0 - 4.0) <8E26C099-CE9D-3819-91A2-64EA929C6137> /System/Library/Frameworks/NetFS.framework/Versions/A/NetFS
0x104739000 - 0x104744ff7 com.apple.NetAuth (5.0 - 5.0) <C811E662-9EC3-3B74-808A-A75D624F326B> /System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth
0x104750000 - 0x104751fff liblangid.dylib (117) <9546E641-F730-3AB0-B3CD-E0E2FDD173D9> /usr/lib/liblangid.dylib
0x104755000 - 0x104770ff7 libCRFSuite.dylib (34) <FFAE75FA-C54E-398B-AA97-18164CD9789D> /usr/lib/libCRFSuite.dylib
0x10477a000 - 0x1047defff com.apple.datadetectorscore (5.0 - 354.5) <0AE9749A-6BFC-3032-B802-210DF59AEDB0> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDe tectorsCore
0x10481d000 - 0x104820fff com.apple.TCC (1.0 - 1) <32A075D9-47FD-3E71-95BC-BFB0D583F41C> /System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC
0x104827000 - 0x10483eff7 com.apple.CFOpenDirectory (10.9 - 173.90.1) <EBC0A1F2-9054-3D39-99AE-A3F655E55D6A> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpen Directory.framework/Versions/A/CFOpenDirectory
0x10485c000 - 0x104866ff7 com.apple.bsd.ServiceManagement (2.0 - 2.0) <2D27B498-BB9C-3D88-B05A-76908A8A26F3> /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManage ment
0x104871000 - 0x104899ffb libxslt.1.dylib (13) <C9794936-633C-3F0C-9E71-30190B9B41C1> /usr/lib/libxslt.1.dylib
0x1048a6000 - 0x104b7afc7 com.apple.vImage (7.0 - 7.0) <D241DBFA-AC49-31E2-893D-EAAC31890C90> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.fr amework/Versions/A/vImage
0x104bbd000 - 0x104bbdfff com.apple.Accelerate.vecLib (3.9 - vecLib 3.9) <F8D0CC77-98AC-3B58-9FE6-0C25421827B6> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/vecLib
0x104bc0000 - 0x104c8bfff libvDSP.dylib (423.32) <3BF732BE-DDE0-38EB-8C54-E4E3C64F77A7> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libvDSP.dylib
0x104c96000 - 0x104d46ff7 libvMisc.dylib (423.32) <049C0735-1808-39B9-943F-76CB8021744F> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libvMisc.dylib
0x104d52000 - 0x105133ffe libLAPACK.dylib (1094.5) <7E7A9B8D-1638-3914-BAE0-663B69865986> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libLAPACK.dylib
0x105196000 - 0x105304ff7 libBLAS.dylib (1094.5) <DE93A590-5FA5-32A2-A16C-5D7D7361769F> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libBLAS.dylib
0x10532d000 - 0x10541cfff libFontParser.dylib (111.1) <835A8253-6AB9-3AAB-9CBF-171440DEC486> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libFontParser.dylib
0x105492000 - 0x1054d9fff libFontRegistry.dylib (127) <A77A0480-AA5D-3CC8-8B68-69985CD546DC> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libFontRegistry.dylib
0x1054ff000 - 0x105523ff7 libJPEG.dylib (1043) <25723F3F-48A6-3AC5-A7A3-58E418FEBF3F> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x10552b000 - 0x105584fff libTIFF.dylib (1043) <D7CAE68F-6087-3B40-9CB8-EC6DB47BF877> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x105593000 - 0x1055aeff7 libPng.dylib (1043) <23D2DAB7-C9A9-392F-989A-871E89E7751D> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x1055b7000 - 0x1055bbff7 libGIF.dylib (1043) <AF0FE71A-27AB-31E0-8CEA-BC0BF2091FA8> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x1055c0000 - 0x1056aefff libJP2.dylib (1043) <C4031D64-6C57-3FB4-9D87-874D387381DB> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
0x1056d8000 - 0x1056dafff libRadiance.dylib (1043) <9813995C-DEAA-3992-8DF8-320E4E4E288B> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.d ylib
0x1056de000 - 0x105725ff7 libcups.2.dylib (372.4) <36EA4350-43B4-3A5C-9904-10685BFDA7D4> /usr/lib/libcups.2.dylib
0x10573a000 - 0x105753ff7 com.apple.Kerberos (3.0 - 1) <F108AFEB-198A-3BAF-BCA5-9DFCE55EFF92> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x10576c000 - 0x10579bff9 com.apple.GSS (4.0 - 2.0) <44E914BE-B0D0-3E05-9451-CA9E539AFA52> /System/Library/Frameworks/GSS.framework/Versions/A/GSS
0x1057ba000 - 0x1057d6fff libresolv.9.dylib (54) <11C2C826-F1C6-39C6-B4E8-6E0C41D4FA95> /usr/lib/libresolv.9.dylib
0x1057e1000 - 0x1058d2ff9 libiconv.2.dylib (41) <BB44B115-AC32-3877-A0ED-AEC6232A4563> /usr/lib/libiconv.2.dylib
0x1058e2000 - 0x105947ffb com.apple.Heimdal (4.0 - 2.0) <F34D6627-9F80-3823-8B57-DB629307DF87> /System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal
0x105973000 - 0x105974fff com.apple.TrustEvaluationAgent (2.0 - 25) <334A82F4-4AE4-3719-A511-86D0B0723E2B> /System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/Tru stEvaluationAgent
0x105979000 - 0x10597dff7 libheimdal-asn1.dylib (323.92.1) <CAE21FFF-5763-399C-B7C5-EEBFFEEF2242> /usr/lib/libheimdal-asn1.dylib
0x105983000 - 0x10598fff7 com.apple.OpenDirectory (10.9 - 173.90.1) <256C265B-7FA6-326D-9F60-18DADF5F3A0E> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory
0x1059a4000 - 0x1059adffd com.apple.CommonAuth (4.0 - 2.0) <32BA436F-6319-3A0B-B5D2-2EB75FF36B5B> /System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth
0x1059b4000 - 0x105a27fff com.apple.securityfoundation (6.0 - 55122.3) <8575DF7A-EC79-3FCE-A737-7512363A5B12> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoun dation
0x105a67000 - 0x105ab8ff7 com.apple.audio.CoreAudio (4.2.1 - 4.2.1) <BE13E840-FB45-3BC2-BCF5-031629754FD5> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x105ade000 - 0x105c32ff3 com.apple.audio.toolbox.AudioToolbox (1.10 - 1.10) <69B273E8-5A8E-3FC7-B807-C16B657662FE> /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x105cc8000 - 0x105d00ff7 com.apple.RemoteViewServices (2.0 - 94) <3F34D630-3DDB-3411-BC28-A56A9B55EBDA> /System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/Remot eViewServices
0x105d39000 - 0x105d39ffd com.apple.audio.units.AudioUnit (1.10 - 1.10) <68B21135-55A6-3563-A3D6-3E692A7DEB7F> /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x105d3f000 - 0x105f87ff7 com.apple.CoreData (107 - 481.3) <E78734AA-E3D0-33CB-A014-620BBCAB2E96> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x1060af000 - 0x1061dfff7 com.apple.desktopservices (1.8.3 - 1.8.3) <225BEC20-F8E0-3F22-9560-890A1A5B9050> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Desk topServicesPriv
0x10625f000 - 0x106509ff5 com.apple.HIToolbox (2.1.1 - 698) <26FF0E2C-1CD7-311F-ACF0-84F3D5273AD6> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.fra mework/Versions/A/HIToolbox
0x106661000 - 0x1067fdff3 com.apple.QuartzCore (1.8 - 332.3) <D6285800-F386-3E6B-84F2-A62F9029D95F> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x1068d4000 - 0x1068dcff7 com.apple.speech.recognition.framework (4.2.4 - 4.2.4) <98BBB3E4-6239-3EF1-90B2-84EA0D3B8D61> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecogni tion.framework/Versions/A/SpeechRecognition
0x1068e6000 - 0x1069cafff com.apple.coreui (2.1 - 231) <432DB40C-6B7E-39C8-9FB5-B95917930056> /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
0x106a8c000 - 0x106a9eff7 com.apple.MultitouchSupport.framework (245.13 - 245.13) <E51DE5CA-9859-3C13-A24F-37EF4385C1D6> /System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/Multit ouchSupport
0x106aad000 - 0x106aeefff com.apple.PerformanceAnalysis (1.47 - 47) <5E045817-0C84-341A-9B33-74CF1324FA70> /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/Perf ormanceAnalysis
0x10733f000 - 0x107357ff7 com.apple.GenerationalStorage (2.0 - 160.3) <64749B08-0212-3AC8-9B49-73D662B09304> /System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/Gene rationalStorage
0x107367000 - 0x107375fff com.apple.opengl (9.6.1 - 9.6.1) <B22FA400-5824-36AF-9945-5FEC31995A0E> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x10737d000 - 0x10738afff com.apple.Sharing (132.2 - 132.2) <F983394A-226D-3244-B511-FA51FDB6ADDA> /System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing
0x10739b000 - 0x10745fff7 com.apple.backup.framework (1.5.4 - 1.5.4) <195DA868-47A5-37E6-8CF0-9BCF11846899> /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
0x1074e7000 - 0x107573ff7 com.apple.ink.framework (10.9 - 207) <8A50B893-AD03-3826-8555-A54FEAF08F47> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework /Versions/A/Ink
0x1075a6000 - 0x1075e1fff com.apple.bom (14.0 - 193.1) <EF24A562-6D3C-379E-8B9B-FAE0E4A0EF7C> /System/Library/PrivateFrameworks/Bom.framework/Versions/A/Bom
0x1075f4000 - 0x107619ff7 com.apple.CoreVideo (1.8 - 117.2) <4674339E-26D0-35FA-9958-422832B39B12> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x107635000 - 0x107906ff4 com.apple.CoreImage (9.4.0) <2C636ECD-0F1A-357C-9EFF-0452476FDDF5> /System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/CoreImage .framework/Versions/A/CoreImage
0x1079fb000 - 0x107a4efff com.apple.ScalableUserInterface (1.0 - 1) <CF745298-7373-38D2-B3B1-727D5A569E48> /System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/ScalableU serInterface.framework/Versions/A/ScalableUserInterface
0x107a73000 - 0x107ab2fff libGLU.dylib (9.6.1) <AE032555-3E2F-3DBF-A26D-EA4576061605> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x107ac1000 - 0x107ac9ffc libGFXShared.dylib (9.6.1) <25BBF325-AC57-3BAA-9427-2D14CC243AE6> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.d ylib
0x107ad0000 - 0x107adbfff libGL.dylib (9.6.1) <4B65BF9F-F34A-3CD1-94E8-DB26DAA0A59D> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x107aef000 - 0x107b2dff7 libGLImage.dylib (9.6.1) <5E02B38C-9F36-39BE-8746-724F0D8BBFC0> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dyl ib
0x107b35000 - 0x107b37fff libCVMSPluginSupport.dylib (9.6.1) <FB37F4C4-1E84-3349-BB03-92CA0A5F6837> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginS upport.dylib
0x107b3c000 - 0x107b3ffff libCoreVMClient.dylib (58.1) <EBC36C69-C896-3C3D-8589-3E9023E7E56F> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClien t.dylib
0x107b45000 - 0x107f78ffb com.apple.vision.FaceCore (3.0.0 - 3.0.0) <F42BFC9C-0B16-35EF-9A07-91B7FDAB7FC5> /System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore
0x108190000 - 0x10819aff7 com.apple.CrashReporterSupport (10.9 - 539) <B25A09EC-A021-32EC-86F8-05B4837E0EDE> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/Cra shReporterSupport
0x1081a8000 - 0x1081f6ff7 com.apple.opencl (2.3.59 - 2.3.59) <B49916BA-1D02-3BA6-9986-5A935A3C009B> /System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL
0x10820e000 - 0x10821affb com.apple.AppleFSCompression (56.92.1 - 1.0) <066255FD-DBD1-3041-8DDA-7AFC41C9096D> /System/Library/PrivateFrameworks/AppleFSCompression.framework/Versions/A/Apple FSCompression
0x108222000 - 0x10823bff7 com.apple.Ubiquity (1.3 - 289) <C7F1B734-CE81-334D-BE41-8B20D95A1F9B> /System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity
0x10824e000 - 0x10827efff com.apple.IconServices (25 - 25.17) <4751127E-FBD5-3ED5-8510-08D4E4166EFE> /System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconService s
0x1082a7000 - 0x1082ccff7 com.apple.ChunkingLibrary (2.0 - 155.1) <B845DC7A-D1EA-31E2-967C-D1FE0C628036> /System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/Chunking Library
0x1082d8000 - 0x108359fff com.apple.CoreSymbolication (3.0.1 - 141.0.5) <20E484C4-9F0E-3DF6-BB27-D509859FF57A> /System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSy mbolication
0x1083aa000 - 0x108402ff7 com.apple.Symbolication (1.4 - 129.0.2) <56F5E42C-4A23-3D0C-A830-616A03C16725> /System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolicat ion
0x108449000 - 0x108478fff com.apple.DebugSymbols (106 - 106) <E1BDED08-523A-36F4-B2DA-9D5C712F0AC7> /System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbol s
0x108493000 - 0x108497fff com.apple.CommonPanels (1.2.6 - 96) <6B434AFD-50F8-37C7-9A56-162C17E375B3> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels. framework/Versions/A/CommonPanels
0x10849e000 - 0x1084a1fff com.apple.help (1.3.3 - 46) <AE763646-D07A-3F9A-ACD4-F5CBD734EE36> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framewor k/Versions/A/Help
0x1084a7000 - 0x1084b9fff com.apple.ImageCapture (9.0 - 9.0) <BE0B65DA-3031-359B-8BBA-B9803D4ADBF4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture. framework/Versions/A/ImageCapture
0x1084d4000 - 0x1084ecff7 com.apple.openscripting (1.4 - 157) <B3B037D7-1019-31E6-9D17-08E699AF3701> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting .framework/Versions/A/OpenScripting
0x1084fe000 - 0x1084ffff7 com.apple.print.framework.Print (9.0 - 260) <EE00FAE1-DA03-3EC2-8571-562518C46994> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framewo rk/Versions/A/Print
0x108504000 - 0x108506ff7 com.apple.securityhi (9.0 - 55005) <446BE1A5-F65F-3ACB-8F33-A8EBFE0D0BD4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.fr amework/Versions/A/SecurityHI
0x10850c000 - 0x10855aff9 libstdc++.6.dylib (60) <0241E6A4-1368-33BE-950B-D0A175C41F54> /usr/lib/libstdc++.6.dylib
0x108b87000 - 0x108bb3fff com.apple.CoreServicesInternal (184.9 - 184.9) <4DEA54F9-81D6-3EDB-AA3C-1F9C497B3379> /System/Library/PrivateFrameworks/CoreServicesInternal.framework/CoreServicesIn ternal
0x108bef000 - 0x108bf7ff3 libCGCMS.A.dylib (599.25.10.1) <9A4FAAD7-1C16-33F8-A615-1DCAB0546E31> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGCMS .A.dylib
0x10adc6000 - 0x10adc7ff7 libodfde.dylib (20) <C00A4EBA-44BC-3C53-BFD0-819B03FFD462> /usr/lib/libodfde.dylib
0x10addf000 - 0x10adedfff com.apple.CommerceCore (1.0 - 42) <ACC2CE3A-913A-39E0-8344-B76F8F694EF5> /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Frameworks/C ommerceCore.framework/Versions/A/CommerceCore
0x10de83000 - 0x10dea5fff com.apple.framework.familycontrols (4.1 - 410) <4FDBCD10-CAA2-3A9C-99F2-06DCB8E81DEE> /System/Library/PrivateFrameworks/FamilyControls.framework/Versions/A/FamilyCon trols
0x10debf000 - 0x10decaff7 com.apple.DirectoryService.Framework (10.9 - 173.90.1) <B62B1994-1874-3F8D-B62E-589E6F6534C9> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryServi ce
0x10ded4000 - 0x10ded7ff7 com.apple.LoginUICore (3.0 - 3.0) <1ECBDA90-D6ED-3333-83EB-9C8232DFAD7C> /System/Library/PrivateFrameworks/LoginUIKit.framework/Versions/A/Frameworks/Lo ginUICore.framework/Versions/A/LoginUICore
0x10dedf000 - 0x10dee9ff7 libcsfde.dylib (380) <A5CF6F85-0537-399F-968B-1536B1235E65> /usr/lib/libcsfde.dylib
0x10def4000 - 0x10def6fff com.apple.EFILogin (2.0 - 2) <C360E8AF-E9BB-3BBA-9DF0-57A92CEF00D4> /System/Library/PrivateFrameworks/EFILogin.framework/Versions/A/EFILogin
0x110c89000 - 0x110c8bffb libutil.dylib (34) <DAC4A6CF-A1BB-3874-9569-A919316D30E8> /usr/lib/libutil.dylib
0x110c91000 - 0x110c97fff com.apple.AOSNotification (1.7.0 - 760.3) <7901B867-60F7-3645-BB3E-18C51A6FBCC6> /System/Library/PrivateFrameworks/AOSNotification.framework/Versions/A/AOSNotif ication
0x110ca3000 - 0x110cb3ffb libsasl2.2.dylib (170) <C8E25710-68B6-368A-BF3E-48EC7273177B> /usr/lib/libsasl2.2.dylib
0x110e88000 - 0x110eb4ff7 com.apple.framework.SystemAdministration (1.0 - 1.0) <6FD03EF6-32B6-397D-B9D7-D68E89A462F5> /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/Sys temAdministration
0x116489000 - 0x1164cefff libcurl.4.dylib (78.94.1) <88F27F9B-052E-3375-938D-2603E90D8AD5> /usr/lib/libcurl.4.dylib
0x11b000000 - 0x11b0d1ff1 com.apple.DiskImagesFramework (10.9 - 371.1) <D85430A6-1410-3B5F-9D11-17E2440B786E> /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages
0x11b131000 - 0x11b1bcfff libCoreStorage.dylib (380) <DE9B3F8C-045C-3010-9A25-C8CD72F1066B> /usr/lib/libCoreStorage.dylib
0x11b1e4000 - 0x11b29cff7 com.apple.DiscRecording (8.0 - 8000.4.6) <CDAAAD04-A1D0-3C67-ABCC-EFC9E8D44E7E> /System/Library/Frameworks/DiscRecording.framework/Versions/A/DiscRecording
0x11b304000 - 0x11b335fff com.apple.MediaKit (15 - 709) <23E33409-5C39-3F93-9E73-2B0E9EE8883E> /System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/MediaKit
0x11b347000 - 0x11b37cffc com.apple.LDAPFramework (2.4.28 - 194.5) <4ADD0595-25B9-3F09-897E-3FB790AD2C5A> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x11b38b000 - 0x11b46afff libcrypto.0.9.8.dylib (50) <B95B9DBA-39D3-3EEF-AF43-44608B28894E> /usr/lib/libcrypto.0.9.8.dylib
0x11b4d2000 - 0x11b506fff libssl.0.9.8.dylib (50) <B15F967C-B002-36C2-9621-3456D8509F50> /usr/lib/libssl.0.9.8.dylib
0x7fff66f8d000 - 0x7fff66fc0817 dyld (239.4) <042C4CED-6FB2-3B1C-948B-CAF2EE3B9F7A> /usr/lib/dyld
External Modification Summary:
Calls made by other processes targeting this process:
task_for_pid: 66
thread_create: 0
thread_set_state: 0
Calls made by this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by all processes on this machine:
task_for_pid: 10310
thread_create: 1
thread_set_state: 0
VM Region Summary:
ReadOnly portion of Libraries: Total=120.4M resident=116.2M(97%) swapped_out_or_unallocated=4296K(3%)
Writable regions: Total=16.4G written=16.9M(0%) resident=44.3M(0%) swapped_out=0K(0%) unallocated=16.3G(100%)
REGION TYPE VIRTUAL
=========== =======
CG shared images 140K
Dispatch continuations 32.0M
Kernel Alloc Once 8K
MALLOC 548.6M
MALLOC (admin) 48K
MALLOC (reserved) 15.8G reserved VM address space (unallocated)
Memory Tag 242 12K
Memory Tag 251 8K
STACK GUARD 56.0M
Stack 10.1M
VM_ALLOCATE 16.3M
__DATA 19.7M
__IMAGE 528K
__LINKEDIT 28.2M
__TEXT 92.3M
__UNICODE 544K
mapped file 34.7M
shared memory 212K
=========== =======
TOTAL 16.6G
TOTAL, minus reserved VM space 839.4M
System Profile:
Model: MacPro5,1, BootROM MP51.007F.B03, 8 processors, Quad-Core Intel Xeon, 2.4 GHz, 6 GB, SMC 1.39f11
Graphics: ATI Radeon HD 5770, ATI Radeon HD 5770, PCIe, 1024 MB
Memory Module: DIMM 1, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120
Memory Module: DIMM 2, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120
Memory Module: DIMM 3, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120
Memory Module: DIMM 5, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120
Memory Module: DIMM 6, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120
Memory Module: DIMM 7, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x8E), Broadcom BCM43xx 1.0 (5.106.98.100.22)
Bluetooth: Version 4.2.7f3 14616, 3 services, 23 devices, 1 incoming serial ports
Network Service: Ethernet 2, Ethernet, en1
Network Service: Wi-Fi, AirPort, en2
PCI Card: ATI Radeon HD 5770, Display Controller, Slot-1
PCI Card: pci1095,3132, SATA Controller, Slot-2
Serial ATA Device: HL-DT-ST DVD-RW GH41N, 4.29 GB
Serial ATA Device: WDC WD1001FALS-41Y6A0, 1 TB
USB Device: Hub
USB Device: Keyboard Hub
USB Device: iLok
USB Device: eLicenser
USB Device: Apple Keyboard
USB Device: Apple Cinema Display
USB Device: BRCM2046 Hub
USB Device: Bluetooth USB Host Controller
FireWire Device: built-in_hub, Up to 800 Mb/sec
Thunderbolt Bus:
Thanks again,
Fred,
-
Sep 24, 2014 5:39 AMby Linc Davis,A.
You installed the "Genieo" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.)
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.
Step 1
In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent. If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state.
There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer.
This step does not completely inactivate Genieo.
Step 2
Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions.
Triple-click anywhere in the line below on this page to select it:
/Library/Frameworks/GenieoExtra.framework
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.
If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password.
Move each of these items to the Trash in the same way:
/Applications/Reset Search.app
/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
~/Library/Application Support/com.genieoinnovation.Installer
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plistIf there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
Restart and empty the Trash. Don't try to empty the Trash until you have restarted.
Step 3
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results.
Make sure you don't repeat the mistake that led you to install this trojan. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If youever download a file that isn't obviously what you expected, delete it immediately.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
Finally, be forewarned that when Genieo is mentioned on this site, the attacker sometimes shows up under the name "Genieo support." He will tell you to download a fake "uninstaller." As he intends, the uninstaller does not completely remove the malware, and is in fact malware itself.
B.
Uninstall SIMBL as follows. Back up all data before making any changes.
Triple-click anywhere in the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library
In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens by pressing command-V, then press return. A folder will open. From that folder, delete the items listed below (some may be absent.) You may be prompted for your administrator login password.
Application Support/SIMBL
InputManagers/SIMBL
LaunchAgents/net.culater.SIMBL.Agent.plist
LaunchAgents/net.infinite-labs.SIMBLEnablerForSandboxedApps.plist
ScriptingAdditions/SIMBL.osax
Log out and log back in.
Make sure you never reinstall SIMBL. It’s likely to come bundled with another third-party system modfication that depends on it. If you want trouble-free computing, avoid software that makes miraculous changes to other software, especially built-in applications. The only real exception to that rule is Safari extensions, which are mostly safe, and are easy to get rid of when they don’t work. SIMBL and its dependents are not Safari extensions.
-
Sep 26, 2014 3:00 AMby fred_a,Thanks- sorry didn't get back sooner....
So I followed the above instructions as closely as I could, but must have made a mistake and ended up locking the computer on startup. Reading up online it seems I'm not the only one to do this....
I've since reformatted the HD and reinstalled Mac OSX 10.9 but the problem persists!! I've searched the computer for the above files and none can be found, and I'm certain a format and reinstall will have removed Genieo?? Is there anything else it could be??
Thanks,
Fred, -
Sep 29, 2014 2:03 AMby fred_a,Hmm well you did say-
/Library/Frameworks/GenieoExtra.framework
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
So in effect I'd be searching the computer for the files you listed above.
Anyway- I've bought a new HD, formatted and re-installed 10.9 which seems to have resolved the issue.
Thanks for your help.
-
Jan 20, 2015 10:49 AMby orubin,Hey Linc,
I am having a similar problem, but so far, I do not have any Genieo components.
I am wondering if I can post one of my MANY crash logs and you can help me.
Right now, this is the excerpt that seems to be important, but I am happy to post the entire thing if this is not enough:
----------------------------
Thread 9 Crashed:
0 com.apple.securityfoundation 0x000000010dd3bf9e +[SecFoundationModVector pathForKeychain:] + 35
Thread 9 crashed with X86 Thread State (64-bit):
rax: 0xfeb883509405332b rbx: 0x0000000000000000 rcx: 0x000000010ee31000 rdx: 0x0000000000000046
rdi: 0x000000010ee31000 rsi: 0x000000010ed6e000 rbp: 0x000000010ee32ff0 rsp: 0x000000010ee32f68
r8: 0x0000000000000000 r9: 0x0000000000000000 r10: 0x0000000000000000 r11: 0x0000000000000000
r12: 0x000000010db8d420 r13: 0x0000000000000000 r14: 0x0000000000000000 r15: 0x000000010ed6e000
rip: 0x000000010dd3bf9e rfl: 0x0000000000010206 cr2: 0x00007f9c31498000
Logical CPU: 3
Error Code: 0x00000000
Trap Number: 13
-------------------------
Would appreciate your thoughts. Thanks
One note of interest: I had installed the latest Little Snitch, and it hung the boot. I was able to get it uninstalled, and believe I have all the parts out (their uninstaller ran) but ever since, I am plagued by this constant crash and restart of the Finder. So bad, that it took me an hour to get the console open! :-(
Oh, and in case this helps:
Process: Finder [441]
Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
Identifier: com.apple.finder
Version: 10.9.4 (10.9.4)
Build Info: Finder_FE-885004002000000~1
Code Type: X86-64 (Native)
Parent Process: launchd [292]
Responsible: Finder [441]
User ID: 501
Date/Time: 2015-01-20 10:21:26.469 -0800
OS Version: Mac OS X 10.9.5 (13F34)
Report Version: 11
Anonymous UUID: ***********************************
Crashed Thread: 9
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: EXC_I386_GPFLT
-
Jan 20, 2015 1:43 PMby orubin,More digging:
Removed Google Drive after reading that could cause this issue. Did not seem to change anything.
Removed Dropbox as well, as there were reports that updating icons in the Finder can cause this problem. No change.
If I let it run on and on, after a while, it finally stops and settles down. Rebooting brings back the problem for some time.
This is odd
-
Nov 24, 2015 6:47 PMby aregeebee,Actually - this is a report from Linc Davis (thank you a million times over) - I can't find the original post...- I'd spent all day trying to figure this out and this is what worked for me:
Back up all data if you haven’t already done so. Before proceeding, you must be sure you can restore your system to the state it’s in now.
Launch the Terminal application by entering the first few letters of its name into a Spotlight search. If that doesn’t work, then in the Finder, press the key combination shift-command-U. The application is in the folder that opens.
Copy or drag – do not type – the line below into the Terminal window, then press return:
find ~ -type f -name .DS_Store -delete
The command will take a noticeable amount of time to run. When a new dollar-sign (“$”) prompt appears below what you entered, quit Terminal.
