Finder Keeps Crashing in OSX 10.9

Question

Level 1

1 points

Finder Keeps Crashing in OSX 10.9

Hi-

My Finder recently started a new habit of crashing in 10.9. The only way I've worked around it, is to turn the network connections off, restart in safe boot and trash com.apple.apsd.plist, com.apple.MCX.plist, NetworkInterfaces.plist, com.apple.smb.server.plist, preferences.plist, com.apple.wifi.message-tracer.plist and com.apple.airport.preferences.plist.

I'm not sure which of those preference files does it- but they are the only recently modified ones. I also then run disk utility and repair permissions which seem to have changed in Applications and Safari among others (I'll post the log up the next time it crashes). After restarting, finder then works and I can open applications etc, but on the next boot after that it'll crash again and I'll have to repeat that whole procces...

I've got rid of Dropbox/Googledrive/Hightail but can't think what's doing it? I've made sure no apps are loading on startup- but the problem persists. I have a feeling it might be to do with something trying to access the network on startup, and knocking the network connections off does seem to help- but no idea what. If anyone's got any ideas I'd really appreciate it.

I'm running a 2 x 2.4 GHz Quad-Core Xeon Mac Pro, 6GB DDR3 Ram, on OSX 10.9.5

Many thanks!

Fred,

Posted on Sep 23, 2014 2:26 AM

Reply

Answer 1

Linc Davis

Level 10

209,541 points

Sep 23, 2014 3:07 PM in response to fred_a

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Console in the icon grid.

Step 1

For this step, the title of the Console window should be All Messages. If it isn't, select

SYSTEM LOG QUERIES ▹ All Messages

from the log list on the left. If you don't see that list, select

View ▹ Show Log List

from the menu bar at the top of the screen.

In the top right corner of the Console window, there's a search box labeled Filter. Initially the words "String Matching" are shown in that box. Enter the name of the crashed application or process. For example, if iTunes crashed, you would enter "iTunes" (without the quotes.)

Each message in the log begins with the date and time when it was entered. Select the messages from the time of the last crash, if any. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.

☞ The log contains a vast amount of information, almost all of which is irrelevant to solving any particular problem. When posting a log extract, be selective. A few dozen lines are almost always more than enough.

Please don't indiscriminately dump thousands of lines from the log into this discussion.

Please don't post screenshots of log messages—post the text.

☞ Some private information, such as your name, may appear in the log. Anonymize before posting.

Step 2

In the Console window, select

DIAGNOSTIC AND USAGE INFORMATION ▹ User Diagnostic Reports

(not Diagnostic and Usage Messages) from the log list on the left. There is a disclosure triangle to the left of the list item. If the triangle is pointing to the right, click it so that it points down. You'll see a list of crash reports. The name of each report starts with the name of the process, and ends with ".crash". Select the most recent report related to the process in question. The contents of the report will appear on the right. Use copy and paste to post the entire contents—the text, not a screenshot.

I know the report is long, maybe several hundred lines. Please post all of it anyway.

If you don't see any reports listed, but you know there was a crash, you may have chosen Diagnostic and Usage Messages from the log list. Choose DIAGNOSTIC AND USAGE INFORMATION instead.

In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)

Please don’t post other kinds of diagnostic report—they're very long and rarely helpful.

Reply

Answer 2

fred_a Author

Level 1

1 points

Sep 24, 2014 2:00 AM in response to Linc Davis

Thanks a lot,

Okay so in terms of the Console report for the last crash- here's the header of the report, not sure if you want me to post more than this?

Date/Time: 2014-09-23 17:16:18 +0100

OS Version: 10.9.5 (Build 13F34)

Architecture: x86_64

Report Version: 18

Command: Finder

Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

Version: 10.9.4 (10.9.4)

Build Version: 1

Project Name: Finder_FE

Source Version: 885004002000000

Parent: launchd [183]

PID: 203

Event: hang

Duration: 0.96s (process was unresponsive for 410 seconds before sampling)

Steps: 10 (100ms sampling interval)

Hardware model: MacPro5,1

Active cpus: 16

Fan speed: 799 rpm

Free pages: 1037110 pages (-1706)

Pageins: 2 pages

Pageouts: 0 pages

Swapins: 0 pages

Swapouts: 0 pages

Process: Finder [203]

Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

Architecture: x86_64

Parent: launchd [183]

UID: 501

Task size: 4638 pages

Note: Unresponsive for 410 seconds before sampling

Thread 0x8c9 DispatchQueue 1 priority 46

10 start + 1 (libdyld.dylib) [0x7fff894735fd]

10 ??? (Finder + 26416) [0x10a62a730]

10 NSApplicationMain + 940 (AppKit) [0x7fff8e358783]

10 -[NSApplication run] + 553 (AppKit) [0x7fff8e36d99c]

10 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122 (AppKit) [0x7fff8e37989b]

10 _DPSNextEvent + 1434 (AppKit) [0x7fff8e37a24e]

10 _BlockUntilNextEventMatchingListInModeWithFilter + 65 (HIToolbox) [0x7fff890095bc]

10 ReceiveNextEventCommon + 173 (HIToolbox) [0x7fff89009685]

10 RunCurrentEventLoopInMode + 49 (HIToolbox) [0x7fff8900995c]

10 _FirstEventTime + 1036 (HIToolbox) [0x7fff89009e91]

10 SyncIronwoodHotKey + 26 (HIToolbox) [0x7fff89010c26]

10 TISGetIronwoodEnabledState + 21 (HIToolbox) [0x7fff89010cfd]

10 CopyInputSourceRefForInputSourceID + 96 (HIToolbox) [0x7fff89010d9a]

10 TISCreateInputSourceList + 42 (HIToolbox) [0x7fff8900b3f9]

10 InitTSMFirstEventTime + 205 (HIToolbox) [0x7fff8900b840]

10 InstallInputSourceMgrHandlers + 616 (HIToolbox) [0x7fff8900bcda]

10 FSEventStreamStart + 260 (CarbonCore) [0x7fff8bc8769c]

10 register_with_server + 869 (CarbonCore) [0x7fff8bc87bb0]

10 f2d_register_rpc + 325 (CarbonCore) [0x7fff8bc87e15]

10 mach_msg_trap + 10 (libsystem_kernel.dylib) [0x7fff8c261a1a]

*10 ipc_mqueue_receive_continue + 0 (mach_kernel) [0xffffff80002167d0]

Thread 0x902 DispatchQueue 2 priority 48

10 _dispatch_mgr_thread + 52 (libdispatch.dylib) [0x7fff8fc57136]

10 kevent64 + 10 (libsystem_kernel.dylib) [0x7fff8c266662]

*10 ??? (mach_kernel + 3960080) [0xffffff80005c6d10]

Thread 0x92f DispatchQueue 4 priority 44

10 start_wqthread + 13 (libsystem_pthread.dylib) [0x7fff92ae2fb9]

10 _pthread_wqthread + 314 (libsystem_pthread.dylib) [0x7fff92adfef8]

10 _dispatch_worker_thread2 + 40 (libdispatch.dylib) [0x7fff8fc58177]

10 _dispatch_root_queue_drain + 326 (libdispatch.dylib) [0x7fff8fc57082]

10 _dispatch_client_callout + 8 (libdispatch.dylib) [0x7fff8fc5528d]

10 _dispatch_call_block_and_release + 12 (libdispatch.dylib) [0x7fff8fc581bb]

10 -[NSFileManager URLForUbiquityContainerIdentifier:] + 334 (Foundation) [0x7fff855e3d21]

10 semaphore_wait_trap + 10 (libsystem_kernel.dylib) [0x7fff8c261a56]

*10 semaphore_wait_continue + 0 (mach_kernel) [0xffffff800023b570]

Thread 0x90e DispatchQueue 56 priority 46

10 start_wqthread + 13 (libsystem_pthread.dylib) [0x7fff92ae2fb9]

10 _pthread_wqthread + 314 (libsystem_pthread.dylib) [0x7fff92adfef8]

10 _dispatch_worker_thread2 + 40 (libdispatch.dylib) [0x7fff8fc58177]

10 _dispatch_root_queue_drain + 75 (libdispatch.dylib) [0x7fff8fc56f87]

10 _dispatch_queue_invoke + 110 (libdispatch.dylib) [0x7fff8fc589c1]

10 _dispatch_queue_drain + 451 (libdispatch.dylib) [0x7fff8fc57673]

10 _dispatch_client_callout + 8 (libdispatch.dylib) [0x7fff8fc5528d]

10 _dispatch_call_block_and_release + 12 (libdispatch.dylib) [0x7fff8fc581bb]

10 ___ZN17TVolumeSyncThread19PostNodeTaskRequestEP9TNodeTask_block_invoke + 91 (DesktopServicesPriv) [0x7fff8d44389f]

10 ExceptionSafeBlock(void () block_pointer) + 12 (DesktopServicesPriv) [0x7fff8d4438b1]

10 ___ZN17TVolumeSyncThread19PostNodeTaskRequestEP9TNodeTask_block_invoke_2 + 84 (DesktopServicesPriv) [0x7fff8d443961]

10 TNode::HandleNodeRequest(TCountedPtr<TNodeTask> const&, TCountedPtr<TVolumeSyncThread> const&) + 1017 (DesktopServicesPriv) [0x7fff8d443e21]

10 TNode::HandleVolumeAdded(TCountedPtr<TNodeTask> const&, TNodePtr const&, bool, TCountedPtr<TVolumeSyncThread> const&) + 67 (DesktopServicesPriv) [0x7fff8d4a4c71]

10 TNode::AddVolume(TCountedPtr<TVolumeSyncThread> const&, short, unsigned char, TNodePtr&, bool&) + 133 (DesktopServicesPriv) [0x7fff8d444727]

10 TFSVolumeInfo::AddVolume(TCountedPtr<TVolumeSyncThread> const&, short, unsigned char, TCountedPtr<TFSVolumeInfo>&, bool&) + 131 (DesktopServicesPriv) [0x7fff8d43844f]

10 TFSVolumeInfo::Initialize(TCountedPtr<TVolumeSyncThread> const&, short, unsigned char, bool&) + 167 (DesktopServicesPriv) [0x7fff8d43882d]

10 FSGetVolumeParms + 46 (CarbonCore) [0x7fff8bc8508b]

10 FSMount::FSMount(short, int*, unsigned char, unsigned int const*) + 66 (CarbonCore) [0x7fff8bc7a194]

10 lstat$INODE64 + 10 (libsystem_kernel.dylib) [0x7fff8c26670a]

*10 hndl_unix_scall64 + 22 (mach_kernel) [0xffffff80002f4176]

*10 unix_syscall64 + 499 (mach_kernel) [0xffffff8000640c63]

*10 lstat64 + 156 (mach_kernel) [0xffffff80003e9bfc]

*10 ??? (mach_kernel + 2038082) [0xffffff80003f1942]

*10 namei + 1460 (mach_kernel) [0xffffff80003d5a74]

*10 lookup + 603 (mach_kernel) [0xffffff80003d611b]

*10 VNOP_LOOKUP + 75 (mach_kernel) [0xffffff80003fd75b]

*10 cd9660_lookup + 182 (cd9660) [0xffffff7f817c2b33]

*10 lck_mtx_lock + 653 (mach_kernel) [0xffffff80002d18fd]

*10 lck_mtx_lock_wait_x86 + 384 (mach_kernel) [0xffffff80002d6560]

*10 thread_block_reason + 204 (mach_kernel) [0xffffff8000235d5c]

*10 ??? (mach_kernel + 223579) [0xffffff800023695b]

*10 machine_switch_context + 354 (mach_kernel) [0xffffff80002d8452]

Thread 0x2b2f priority 46

10 start_wqthread + 13 (libsystem_pthread.dylib) [0x7fff92ae2fb9]

10 __workq_kernreturn + 10 (libsystem_kernel.dylib) [0x7fff8c265e6a]

*10 wq_unpark_continue + 0 (pthread) [0xffffff7f80c096ae]

Binary Images:

0x10a624000 - 0x10aaf2ff9 com.apple.finder 10.9.4 (10.9.4) <1CEEB00A-B22D-34DA-ABDB-EC5419F308A4> /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

0x7fff855bb000 - 0x7fff858bbff7 com.apple.Foundation 6.9 (1056.16) <24349208-3603-3F5D-95CC-B379616FBEF8> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

0x7fff88fdb000 - 0x7fff89285ff5 com.apple.HIToolbox 2.1.1 <26FF0E2C-1CD7-311F-ACF0-84F3D5273AD6> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.fra mework/Versions/A/HIToolbox

0x7fff89470000 - 0x7fff89473ff7 libdyld.dylib (239.4) <A1273A02-4928-3BAC-A846-6C069DC1A0A6> /usr/lib/system/libdyld.dylib

0x7fff8bc71000 - 0x7fff8bf5bfff com.apple.CoreServices.CarbonCore 1077.17 (1077.17) <3A2E92FD-DEE2-3D45-9619-11500801A61C> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonC ore.framework/Versions/A/CarbonCore

0x7fff8c250000 - 0x7fff8c26cff7 libsystem_kernel.dylib (2422.115.4) <9EDE872E-2A9E-3A78-8E1D-AB790794A098> /usr/lib/system/libsystem_kernel.dylib

0x7fff8d434000 - 0x7fff8d564ff7 com.apple.desktopservices 1.8.3 (1.8.3) <225BEC20-F8E0-3F22-9560-890A1A5B9050> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Desk topServicesPriv

0x7fff8e356000 - 0x7fff8eeccff7 com.apple.AppKit 6.9 (1265.21) <9DC13B27-841D-3839-93B2-3EDE66157BDE> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

0x7fff8fc54000 - 0x7fff8fc6efff libdispatch.dylib (339.92.1) <C4E4A18D-3C3B-3C9C-8709-A4270D998DE7> /usr/lib/system/libdispatch.dylib

0x7fff92add000 - 0x7fff92ae4ff7 libsystem_pthread.dylib (53.1.4) <AB498556-B555-310E-9041-F67EC9E00E2C> /usr/lib/system/libsystem_pthread.dylib

*0xffffff7f80c06000 - 0xffffff7f80c0dfff com.apple.kec.pthread 1.0 (1) <882075E6-12C4-3225-8750-928715183739> /System/Library/Extensions/pthread.kext/Contents/MacOS/pthread

*0xffffff7f817c2000 - 0xffffff7f817c8ff5 com.apple.filesystems.cd9660 1.4.4 (1.4.4) <B30918FD-1CFF-3D4E-9286-E0DD2D69C281> /System/Library/Extensions/cd9660.kext/Contents/MacOS/cd9660

*0xffffff8000200000 - 0xffffff80007a823a mach_kernel (2422.115.4) <9477416E-7BCA-3679-AF97-E1EAAD3DD5A0> /mach_kernel

Then in terms of the diagnostics report. The latest I could find was the below- however this is dated the 19th Sept, when the last time the finder hung was yesterday (23rd)... I'll post it anyway, but not sure how relevant it is.

Process: SIMBL Agent [250]

Path: /Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent

Identifier: net.culater.SIMBL_Agent

Version: 0.9.9 (0.9.9)

Code Type: X86-64 (Native)

Parent Process: launchd [192]

Responsible: SIMBL Agent [250]

User ID: 501

Date/Time: 2014-09-19 14:56:53.183 +0100

OS Version: Mac OS X 10.9.4 (13E28)

Report Version: 11

Anonymous UUID:

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (SIGSEGV)

Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000018

VM Regions Near 0x18:

-->

__TEXT 0000000100000000-0000000100005000 [ 20K] r-x/rwx SM=COW /Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent

Application Specific Information:

objc_msgSend() selector name: respondsToSelector:

objc[250]: garbage collection is ON

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread

0 libobjc.A.dylib 0x0000000100046097 objc_msgSend + 23

1 com.apple.Foundation 0x0000000100584184 _NSDescriptionWithLocaleFunc + 41

2 com.apple.CoreFoundation 0x000000010024fce4 __CFStringAppendFormatCore + 7332

3 com.apple.CoreFoundation 0x000000010027e263 _CFStringCreateWithFormatAndArgumentsAux + 115

4 com.apple.Foundation 0x000000010058412f -[NSPlaceholderString initWithFormat:locale:arguments:] + 132

5 com.apple.Foundation 0x000000010058798c +[NSString stringWithFormat:] + 170

6 net.culater.SIMBL_Agent 0x00000001000018f8 -[SIMBLAgent injectSIMBL:] + 874

7 com.apple.CoreFoundation 0x000000010032fe0c __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12

8 com.apple.CoreFoundation 0x000000010022382d _CFXNotificationPost + 2893

9 com.apple.Foundation 0x000000010056c7ba -[NSNotificationCenter postNotificationName:object:userInfo:] + 68

10 com.apple.AppKit 0x000000010132f80b applicationStatusSubsystemCallback + 455

11 com.apple.LaunchServices 0x00000001042b1c39 ___LSScheduleNotificationFunction_block_invoke_2 + 47

12 com.apple.CoreFoundation 0x000000010029248c __CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__ + 12

13 com.apple.CoreFoundation 0x0000000100283ae5 __CFRunLoopDoBlocks + 341

14 com.apple.CoreFoundation 0x000000010028386e __CFRunLoopRun + 1982

15 com.apple.CoreFoundation 0x0000000100282e75 CFRunLoopRunSpecific + 309

16 com.apple.HIToolbox 0x000000010628da0d RunCurrentEventLoopInMode + 226

17 com.apple.HIToolbox 0x000000010628d7b7 ReceiveNextEventCommon + 479

18 com.apple.HIToolbox 0x000000010628d5bc _BlockUntilNextEventMatchingListInModeWithFilter + 65

19 com.apple.AppKit 0x0000000100ac924e _DPSNextEvent + 1434

20 com.apple.AppKit 0x0000000100ac889b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122

21 com.apple.AppKit 0x0000000100abc99c -[NSApplication run] + 553

22 com.apple.AppKit 0x0000000100aa7783 NSApplicationMain + 940

23 net.culater.SIMBL_Agent 0x00000001000012c8 start + 52

Thread 1:: Dispatch queue: com.apple.libdispatch-manager

0 libsystem_kernel.dylib 0x00000001020a8662 kevent64 + 10

1 libdispatch.dylib 0x0000000101eff421 _dispatch_mgr_invoke + 239

2 libdispatch.dylib 0x0000000101eff136 _dispatch_mgr_thread + 52

Thread 2:: Dispatch queue: NSWorkspace Volume Observer Queue

0 libsystem_kernel.dylib 0x00000001020a870a lstat$INODE64 + 10

1 com.apple.CoreServices.CarbonCore 0x0000000103bf0331 FSMount::initVolumeInfo(unsigned char) + 1315

2 com.apple.CoreServices.CarbonCore 0x0000000103bfd0e1 FSMount::FSMount(short, unsigned char*, short, char**, unsigned int, unsigned char*, short*, unsigned int const*) + 419

3 com.apple.CoreServices.CarbonCore 0x0000000103bfcc12 _FSGetVolumeInfoWithFlags + 88

4 com.apple.CoreServices.CarbonCore 0x0000000103bfcbb1 FSGetVolumeInfo + 29

5 com.apple.AppKit 0x000000010132fee5 addVolumeTrackerForVolumeRefNum + 222

6 com.apple.AppKit 0x000000010132fab5 volumeObserverCallback + 364

7 com.apple.CoreServices.CarbonCore 0x0000000103c27437 _FSVolumeObserverCallback + 173

8 com.apple.CoreServices.CarbonCore 0x0000000103c27365 ___FSAddVolumeObserverOnQueue_block_invoke_2 + 205

9 libdispatch.dylib 0x0000000101efd28d _dispatch_client_callout + 8

10 libdispatch.dylib 0x0000000101eff885 _dispatch_source_invoke + 413

11 libdispatch.dylib 0x0000000101eff617 _dispatch_queue_drain + 359

12 libdispatch.dylib 0x0000000101f009c1 _dispatch_queue_invoke + 110

13 libdispatch.dylib 0x0000000101efef87 _dispatch_root_queue_drain + 75

14 libdispatch.dylib 0x0000000101f00177 _dispatch_worker_thread2 + 40

15 libsystem_pthread.dylib 0x00000001021a1ef8 _pthread_wqthread + 314

16 libsystem_pthread.dylib 0x00000001021a4fb9 start_wqthread + 13

Thread 3:

0 libsystem_kernel.dylib 0x00000001020a3a1a mach_msg_trap + 10

1 libsystem_kernel.dylib 0x00000001020a2d18 mach_msg + 64

2 com.apple.CoreFoundation 0x0000000100283f15 __CFRunLoopServiceMachPort + 181

3 com.apple.CoreFoundation 0x0000000100283539 __CFRunLoopRun + 1161

4 com.apple.CoreFoundation 0x0000000100282e75 CFRunLoopRunSpecific + 309

5 com.apple.AppKit 0x0000000100c6905e _NSEventThread + 144

6 libsystem_pthread.dylib 0x00000001021a0899 _pthread_body + 138

7 libsystem_pthread.dylib 0x00000001021a072a _pthread_start + 137

8 libsystem_pthread.dylib 0x00000001021a4fc9 thread_start + 13

Thread 4:

0 libsystem_kernel.dylib 0x00000001020a7e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x00000001021a1f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x00000001021a4fb9 start_wqthread + 13

Thread 5:

0 libsystem_kernel.dylib 0x00000001020a7e6a __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x00000001021a1f08 _pthread_wqthread + 330

2 libsystem_pthread.dylib 0x00000001021a4fb9 start_wqthread + 13

Thread 0 crashed with X86 Thread State (64-bit):

rax: 0x000000010058415b rbx: 0x7000b81799d368d5 rcx: 0x00007fff5fbfd348 rdx: 0x0000000105f2f3fa

rdi: 0x7000b81799d368d5 rsi: 0x00000001007e1284 rbp: 0x00007fff5fbfc790 rsp: 0x00007fff5fbfc778

r8: 0x00000004009bced0 r9: 0x000000040020da00 r10: 0x00000001007e1284 r11: 0x0000000000000000

r12: 0x00007fff5fbfcb70 r13: 0x00007fff5fbfd310 r14: 0x0000000000000000 r15: 0x00007fff5fbfcb70

rip: 0x0000000100046097 rfl: 0x0000000000010206 cr2: 0x0000000000000018

Logical CPU: 14

Error Code: 0x00000004

Trap Number: 14

Binary Images:

0x100000000 - 0x100004fff +net.culater.SIMBL_Agent (0.9.9 - 0.9.9) <74AD5FAB-C4B2-A087-D428-0CC597C2E716> /Library/ScriptingAdditions/SIMBL.osax/Contents/Resources/SIMBL Agent.app/Contents/MacOS/SIMBL Agent

0x100009000 - 0x100009fff libimckit.dylib (1) <890A5A7A-E826-3556-5A5F-6C026AFB3AF3> /usr/lib/libimckit.dylib

0x10000c000 - 0x100023fff com.apple.ScriptingBridge (1.3.1 - 63) <CE24DD07-7A89-3105-AE57-A1BED0189292> /System/Library/Frameworks/ScriptingBridge.framework/Versions/A/ScriptingBridge

0x100036000 - 0x100036fff com.apple.Cocoa (6.8 - 20) <E90E99D7-A425-3301-A025-D9E0CD11918E> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa

0x100039000 - 0x10003aff7 libSystem.B.dylib (1197.1.1) <E6BCC031-4342-318C-A1AD-A8E9AEAE716F> /usr/lib/libSystem.B.dylib

0x100041000 - 0x1001eef27 libobjc.A.dylib (551.1) <AD7FD984-271E-30F4-A361-6B20319EC73B> /usr/lib/libobjc.A.dylib

0x10020f000 - 0x10020ffff com.apple.CoreServices (59 - 59) <7A697B5E-F179-30DF-93F2-8B503CEEEFD5> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices

0x100213000 - 0x1003f8fff com.apple.CoreFoundation (6.9 - 855.17) <729BD6DA-1F63-3E72-A148-26F21EBF52BB> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

0x10056a000 - 0x100868fff com.apple.Foundation (6.9 - 1056.13) <2EE9AB07-3EA0-37D3-B407-4A520F2CB497> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

0x100aa5000 - 0x10161bff7 com.apple.AppKit (6.9 - 1265.21) <9DC13B27-841D-3839-93B2-3EDE66157BDE> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

0x101da2000 - 0x101da3fff libffi.dylib (18.1) <FEB76C94-97BA-39BC-B713-D086B9757BA5> /usr/lib/libffi.dylib

0x101da7000 - 0x101da7fff com.apple.ApplicationServices (48 - 48) <3E3F01A8-314D-378F-835E-9CC4F8820031> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Application Services

0x101daa000 - 0x101daafff com.apple.Carbon (154 - 157) <45A9A40A-78FF-3EA0-8FAB-A4F81052FA55> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon

0x101dad000 - 0x101dfffff libc++.1.dylib (120) <4F68DFC5-2077-39A8-A449-CAC5FDEE7BDE> /usr/lib/libc++.1.dylib

0x101e5b000 - 0x101e5fff7 libcache.dylib (62) <BDC1E65B-72A1-3DA3-A57C-B23159CAAD0B> /usr/lib/system/libcache.dylib

0x101e64000 - 0x101e6efff libcommonCrypto.dylib (60049) <8C4F0CA0-389C-3EDC-B155-E62DD2187E1D> /usr/lib/system/libcommonCrypto.dylib

0x101e7c000 - 0x101e83fff libcompiler_rt.dylib (35) <4CD916B2-1B17-362A-B403-EF24A1DAC141> /usr/lib/system/libcompiler_rt.dylib

0x101e8f000 - 0x101e96ffb libcopyfile.dylib (103.92.1) <CF29DFF6-0589-3590-834C-82E2316612E8> /usr/lib/system/libcopyfile.dylib

0x101e9d000 - 0x101eebfff libcorecrypto.dylib (161.1) <F3973C28-14B6-3006-BB2B-00DD7F09ABC7> /usr/lib/system/libcorecrypto.dylib

0x101efc000 - 0x101f16fff libdispatch.dylib (339.92.1) <C4E4A18D-3C3B-3C9C-8709-A4270D998DE7> /usr/lib/system/libdispatch.dylib

0x101f30000 - 0x101f33ff7 libdyld.dylib (239.4) <A1273A02-4928-3BAC-A846-6C069DC1A0A6> /usr/lib/system/libdyld.dylib

0x101f3a000 - 0x101f3aff7 libkeymgr.dylib (28) <3AA8D85D-CF00-3BD3-A5A0-E28E1A32A6D8> /usr/lib/system/libkeymgr.dylib

0x101f3f000 - 0x101f46ff8 liblaunch.dylib (842.92.1) <A40A0C7B-3216-39B4-8AE0-B5D3BAF1DA8A> /usr/lib/system/liblaunch.dylib

0x101f4e000 - 0x101f53fff libmacho.dylib (845) <1D2910DF-C036-3A82-A3FD-44FF73B5FF9B> /usr/lib/system/libmacho.dylib

0x101f59000 - 0x101f5bff7 libquarantine.dylib (71) <7A1A2BCB-C03D-3A25-BFA4-3E569B2D2C38> /usr/lib/system/libquarantine.dylib

0x101f61000 - 0x101f62ffb libremovefile.dylib (33) <3543F917-928E-3DB2-A2F4-7AB73B4970EF> /usr/lib/system/libremovefile.dylib

0x101f68000 - 0x101f79ff7 libsystem_asl.dylib (217.1.4) <655FB343-52CF-3E2F-B14D-BEBF5AAEF94D> /usr/lib/system/libsystem_asl.dylib

0x101f83000 - 0x101f84ff7 libsystem_blocks.dylib (63) <FB856CD1-2AEA-3907-8E9B-1E54B6827F82> /usr/lib/system/libsystem_blocks.dylib

0x101f89000 - 0x102012ff7 libsystem_c.dylib (997.90.3) <6FD3A400-4BB2-3B95-B90C-BE6E9D0D78FA> /usr/lib/system/libsystem_c.dylib

0x10203e000 - 0x102040ff3 libsystem_configuration.dylib (596.15) <4998CB6A-9D54-390A-9F57-5D1AC53C135C> /usr/lib/system/libsystem_configuration.dylib

0x102046000 - 0x10204efff libsystem_dnssd.dylib (522.92.1) <17B03FFD-92C5-3282-9981-EBB28B456207> /usr/lib/system/libsystem_dnssd.dylib

0x102055000 - 0x10207cffb libsystem_info.dylib (449.1.3) <7D41A156-D285-3849-A2C3-C04ADE797D98> /usr/lib/system/libsystem_info.dylib

0x102092000 - 0x1020aeff7 libsystem_kernel.dylib (2422.110.17) <873931CE-D1AF-3596-AADB-D2E63C9AB29F> /usr/lib/system/libsystem_kernel.dylib

0x1020d2000 - 0x102101fd2 libsystem_m.dylib (3047.16) <B7F0E2E4-2777-33FC-A787-D6430B630D54> /usr/lib/system/libsystem_m.dylib

0x10210c000 - 0x102127ff7 libsystem_malloc.dylib (23.10.1) <A695B4E4-38E9-332E-A772-29D31E3F1385> /usr/lib/system/libsystem_malloc.dylib

0x102131000 - 0x102158ff7 libsystem_network.dylib (241.3) <8B1E1F1D-A5CC-3BAE-8B1E-ABC84337A364> /usr/lib/system/libsystem_network.dylib

0x102174000 - 0x10217dff3 libsystem_notify.dylib (121) <52571EC3-6894-37E4-946E-064B021ED44E> /usr/lib/system/libsystem_notify.dylib

0x102186000 - 0x10218cff7 libsystem_platform.dylib (24.90.1) <3C3D3DA8-32B9-3243-98EC-D89B9A1670B3> /usr/lib/system/libsystem_platform.dylib

0x10219f000 - 0x1021a6ff7 libsystem_pthread.dylib (53.1.4) <AB498556-B555-310E-9041-F67EC9E00E2C> /usr/lib/system/libsystem_pthread.dylib

0x1021b2000 - 0x1021b3fff libsystem_sandbox.dylib (278.11.1) <0D0B13EA-6B7A-3AC8-BE60-B548543BEB77> /usr/lib/system/libsystem_sandbox.dylib

0x1021b8000 - 0x1021bcff7 libsystem_stats.dylib (93.90.3) <337946FC-B2E1-3DFA-A8B5-30DA8D584D75> /usr/lib/system/libsystem_stats.dylib

0x1021c3000 - 0x1021c4fff libunc.dylib (28) <62682455-1862-36FE-8A04-7A6B91256438> /usr/lib/system/libunc.dylib

0x1021ca000 - 0x1021cfff7 libunwind.dylib (35.3) <78DCC358-2FC1-302E-B395-0155B47CB547> /usr/lib/system/libunwind.dylib

0x1021d6000 - 0x1021fafff libxpc.dylib (300.90.2) <AB40CD57-F454-3FD4-B415-63B3C0D5C624> /usr/lib/system/libxpc.dylib

0x102217000 - 0x102259ff7 libauto.dylib (185.5) <F45C36E8-B606-3886-B5B1-B6745E757CA8> /usr/lib/libauto.dylib

0x102271000 - 0x10229aff7 libc++abi.dylib (49.1) <21A807D3-6732-3455-B77F-743E9F916DF0> /usr/lib/libc++abi.dylib

0x1022a8000 - 0x1022a9ff7 libDiagnosticMessagesClient.dylib (100) <4CDB0F7B-C0AF-3424-BC39-495696F0DB1E> /usr/lib/libDiagnosticMessagesClient.dylib

0x1022ae000 - 0x102bce32b com.apple.CoreGraphics (1.600.0 - 599.25.10.1) <EC14B831-96BB-3A50-A451-E36BDC8F59FB> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

0x102cfb000 - 0x102dbdff5 com.apple.CoreText (367.20 - 367.20) <B80D086D-93A9-3C35-860E-9C3FDD027F3B> /System/Library/Frameworks/CoreText.framework/Versions/A/CoreText

0x102e2b000 - 0x102f31ff7 com.apple.ImageIO.framework (3.3.0 - 1043) <C4ADE5B1-A540-34E1-A043-118185489C9D> /System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO

0x102f99000 - 0x103008ff1 com.apple.ApplicationServices.ATS (360 - 363.3) <546E89D9-2AE7-3111-B2B8-2366650D22F0> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/ATS

0x103034000 - 0x1030bdfff com.apple.ColorSync (4.9.0 - 4.9.0) <B756B908-9AD1-3F5D-83F9-7A0B068387D2> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ColorSync.framework/Versions/A/ColorSync

0x103104000 - 0x103149ff6 com.apple.HIServices (1.23 - 468) <E06287C4-1534-3D46-B099-3DF8B8EE4EB5> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ HIServices.framework/Versions/A/HIServices

0x10317c000 - 0x10318bff8 com.apple.LangAnalysis (1.7.0 - 1.7.0) <8FE131B6-1180-3892-98F5-C9C9B79072D4> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ LangAnalysis.framework/Versions/A/LangAnalysis

0x103199000 - 0x1031e6ff2 com.apple.print.framework.PrintCore (9.0 - 428) <8D8253E3-302F-3DB2-9C5C-572CB974E8B3> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ PrintCore.framework/Versions/A/PrintCore

0x103213000 - 0x10324cff7 com.apple.QD (3.50 - 298) <C1F20764-DEF0-34CF-B3AB-AB5480D64E66> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ QD.framework/Versions/A/QD

0x103268000 - 0x103271fff com.apple.speech.synthesis.framework (4.7.1 - 4.7.1) <383FB557-E88E-3239-82B8-15F9F885B702> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ SpeechSynthesis.framework/Versions/A/SpeechSynthesis

0x103284000 - 0x103295ff7 libz.1.dylib (53) <42E0C8C6-CA38-3CA4-8619-D24ED5DD492E> /usr/lib/libz.1.dylib

0x10329b000 - 0x1032abfff libbsm.0.dylib (33) <2CAC00A2-1352-302A-88FA-C567D4D69179> /usr/lib/libbsm.0.dylib

0x1032b4000 - 0x103320fff com.apple.framework.IOKit (2.0.1 - 907.100.13) <057FDBA3-56D6-3903-8C0B-849214BF1985> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

0x103355000 - 0x103358ffc com.apple.IOSurface (91.1 - 91.1) <D00EEB0C-8AA8-3986-90C1-C97B2486E8FA> /System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface

0x103361000 - 0x1035bbff9 com.apple.security (7.0 - 55471.14.8) <EA03E140-2509-3A07-8440-2DC97C0D478B> /System/Library/Frameworks/Security.framework/Versions/A/Security

0x103704000 - 0x103704fff com.apple.Accelerate (1.9 - Accelerate 1.9) <509BB27A-AE62-366D-86D8-0B06D217CF56> /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate

0x103707000 - 0x103712fff libkxld.dylib (2422.110.17) <B6140BAB-0EAF-3E4F-B055-314068056BB4> /usr/lib/system/libkxld.dylib

0x103717000 - 0x1038cfffb libicucore.A.dylib (511.34) <616A65D6-3F20-3EAB-8CA8-273AD890261C> /usr/lib/libicucore.A.dylib

0x103975000 - 0x103ae5ff4 com.apple.CFNetwork (673.4 - 673.4) <F3BF6020-99BE-3844-A7B8-352B93AD02F3> /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork

0x103bec000 - 0x103ed6fff com.apple.CoreServices.CarbonCore (1077.17 - 1077.17) <3A2E92FD-DEE2-3D45-9619-11500801A61C> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonC ore.framework/Versions/A/CarbonCore

0x103f53000 - 0x103fe3ff7 com.apple.Metadata (10.7.0 - 800.28) <CB43AF4C-F5DE-3161-B7D7-540DF9718EAD> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadat a.framework/Versions/A/Metadata

0x10404a000 - 0x1040c1fff com.apple.CoreServices.OSServices (600.4 - 600.4) <B9436B61-0885-3EF6-B981-EB77C325F745> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServi ces.framework/Versions/A/OSServices

0x104164000 - 0x1041d1fff com.apple.SearchKit (1.4.0 - 1.4.0) <B9B8D510-A27E-36B0-93E9-17146D9E9045> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchK it.framework/Versions/A/SearchKit

0x104215000 - 0x104270ffb com.apple.AE (665.5 - 665.5) <BBA230F9-144C-3CAB-A77A-0621719244CD> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.fram ework/Versions/A/AE

0x10429f000 - 0x104369fff com.apple.LaunchServices (572.28 - 572.28) <FDED4724-4CB6-3DE5-B785-AE6D4C261CF6> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchS ervices.framework/Versions/A/LaunchServices

0x1043de000 - 0x104407fff com.apple.DictionaryServices (1.2 - 208) <A539A058-BA57-35EE-AA08-D0B0E835127D> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/DictionaryServices

0x10442a000 - 0x10448dffb com.apple.SystemConfiguration (1.13.1 - 1.13.1) <2C8E1A73-5AD6-3A7D-8ED8-D6755555A993> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfi guration

0x1044c8000 - 0x1045b2fff libsqlite3.dylib (158) <00269BF9-43BE-39E0-9C85-24585B9923C8> /usr/lib/libsqlite3.dylib

0x1045c9000 - 0x1046b0ff7 libxml2.2.dylib (26) <A1DADD11-89E5-3DE4-8802-07186225967F> /usr/lib/libxml2.2.dylib

0x1046e6000 - 0x1046f3ff7 libxar.1.dylib (202) <5572AA71-E98D-3FE1-9402-BB4A84E0E71E> /usr/lib/libxar.1.dylib

0x1046fb000 - 0x1046fffff libpam.2.dylib (20) <B93CE8F5-DAA8-30A1-B1F6-F890509513CB> /usr/lib/libpam.2.dylib

0x104704000 - 0x104704ffd libOpenScriptingUtil.dylib (157) <19F0E769-0989-3062-9AFB-8976E90E9759> /usr/lib/libOpenScriptingUtil.dylib

0x104708000 - 0x104715ff0 libbz2.1.0.dylib (29) <0B98AC35-B138-349C-8063-2B987A75D24C> /usr/lib/libbz2.1.0.dylib

0x10471b000 - 0x104720fff com.apple.DiskArbitration (2.6 - 2.6) <A4165553-770E-3D27-B217-01FC1F852B87> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration

0x10472a000 - 0x104731fff com.apple.NetFS (6.0 - 4.0) <8E26C099-CE9D-3819-91A2-64EA929C6137> /System/Library/Frameworks/NetFS.framework/Versions/A/NetFS

0x104739000 - 0x104744ff7 com.apple.NetAuth (5.0 - 5.0) <C811E662-9EC3-3B74-808A-A75D624F326B> /System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth

0x104750000 - 0x104751fff liblangid.dylib (117) <9546E641-F730-3AB0-B3CD-E0E2FDD173D9> /usr/lib/liblangid.dylib

0x104755000 - 0x104770ff7 libCRFSuite.dylib (34) <FFAE75FA-C54E-398B-AA97-18164CD9789D> /usr/lib/libCRFSuite.dylib

0x10477a000 - 0x1047defff com.apple.datadetectorscore (5.0 - 354.5) <0AE9749A-6BFC-3032-B802-210DF59AEDB0> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDe tectorsCore

0x10481d000 - 0x104820fff com.apple.TCC (1.0 - 1) <32A075D9-47FD-3E71-95BC-BFB0D583F41C> /System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC

0x104827000 - 0x10483eff7 com.apple.CFOpenDirectory (10.9 - 173.90.1) <EBC0A1F2-9054-3D39-99AE-A3F655E55D6A> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpen Directory.framework/Versions/A/CFOpenDirectory

0x10485c000 - 0x104866ff7 com.apple.bsd.ServiceManagement (2.0 - 2.0) <2D27B498-BB9C-3D88-B05A-76908A8A26F3> /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManage ment

0x104871000 - 0x104899ffb libxslt.1.dylib (13) <C9794936-633C-3F0C-9E71-30190B9B41C1> /usr/lib/libxslt.1.dylib

0x1048a6000 - 0x104b7afc7 com.apple.vImage (7.0 - 7.0) <D241DBFA-AC49-31E2-893D-EAAC31890C90> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.fr amework/Versions/A/vImage

0x104bbd000 - 0x104bbdfff com.apple.Accelerate.vecLib (3.9 - vecLib 3.9) <F8D0CC77-98AC-3B58-9FE6-0C25421827B6> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/vecLib

0x104bc0000 - 0x104c8bfff libvDSP.dylib (423.32) <3BF732BE-DDE0-38EB-8C54-E4E3C64F77A7> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libvDSP.dylib

0x104c96000 - 0x104d46ff7 libvMisc.dylib (423.32) <049C0735-1808-39B9-943F-76CB8021744F> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libvMisc.dylib

0x104d52000 - 0x105133ffe libLAPACK.dylib (1094.5) <7E7A9B8D-1638-3914-BAE0-663B69865986> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libLAPACK.dylib

0x105196000 - 0x105304ff7 libBLAS.dylib (1094.5) <DE93A590-5FA5-32A2-A16C-5D7D7361769F> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fr amework/Versions/A/libBLAS.dylib

0x10532d000 - 0x10541cfff libFontParser.dylib (111.1) <835A8253-6AB9-3AAB-9CBF-171440DEC486> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libFontParser.dylib

0x105492000 - 0x1054d9fff libFontRegistry.dylib (127) <A77A0480-AA5D-3CC8-8B68-69985CD546DC> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ ATS.framework/Versions/A/Resources/libFontRegistry.dylib

0x1054ff000 - 0x105523ff7 libJPEG.dylib (1043) <25723F3F-48A6-3AC5-A7A3-58E418FEBF3F> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib

0x10552b000 - 0x105584fff libTIFF.dylib (1043) <D7CAE68F-6087-3B40-9CB8-EC6DB47BF877> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib

0x105593000 - 0x1055aeff7 libPng.dylib (1043) <23D2DAB7-C9A9-392F-989A-871E89E7751D> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib

0x1055b7000 - 0x1055bbff7 libGIF.dylib (1043) <AF0FE71A-27AB-31E0-8CEA-BC0BF2091FA8> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib

0x1055c0000 - 0x1056aefff libJP2.dylib (1043) <C4031D64-6C57-3FB4-9D87-874D387381DB> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib

0x1056d8000 - 0x1056dafff libRadiance.dylib (1043) <9813995C-DEAA-3992-8DF8-320E4E4E288B> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.d ylib

0x1056de000 - 0x105725ff7 libcups.2.dylib (372.4) <36EA4350-43B4-3A5C-9904-10685BFDA7D4> /usr/lib/libcups.2.dylib

0x10573a000 - 0x105753ff7 com.apple.Kerberos (3.0 - 1) <F108AFEB-198A-3BAF-BCA5-9DFCE55EFF92> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos

0x10576c000 - 0x10579bff9 com.apple.GSS (4.0 - 2.0) <44E914BE-B0D0-3E05-9451-CA9E539AFA52> /System/Library/Frameworks/GSS.framework/Versions/A/GSS

0x1057ba000 - 0x1057d6fff libresolv.9.dylib (54) <11C2C826-F1C6-39C6-B4E8-6E0C41D4FA95> /usr/lib/libresolv.9.dylib

0x1057e1000 - 0x1058d2ff9 libiconv.2.dylib (41) <BB44B115-AC32-3877-A0ED-AEC6232A4563> /usr/lib/libiconv.2.dylib

0x1058e2000 - 0x105947ffb com.apple.Heimdal (4.0 - 2.0) <F34D6627-9F80-3823-8B57-DB629307DF87> /System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal

0x105973000 - 0x105974fff com.apple.TrustEvaluationAgent (2.0 - 25) <334A82F4-4AE4-3719-A511-86D0B0723E2B> /System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/Tru stEvaluationAgent

0x105979000 - 0x10597dff7 libheimdal-asn1.dylib (323.92.1) <CAE21FFF-5763-399C-B7C5-EEBFFEEF2242> /usr/lib/libheimdal-asn1.dylib

0x105983000 - 0x10598fff7 com.apple.OpenDirectory (10.9 - 173.90.1) <256C265B-7FA6-326D-9F60-18DADF5F3A0E> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory

0x1059a4000 - 0x1059adffd com.apple.CommonAuth (4.0 - 2.0) <32BA436F-6319-3A0B-B5D2-2EB75FF36B5B> /System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth

0x1059b4000 - 0x105a27fff com.apple.securityfoundation (6.0 - 55122.3) <8575DF7A-EC79-3FCE-A737-7512363A5B12> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoun dation

0x105a67000 - 0x105ab8ff7 com.apple.audio.CoreAudio (4.2.1 - 4.2.1) <BE13E840-FB45-3BC2-BCF5-031629754FD5> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio

0x105ade000 - 0x105c32ff3 com.apple.audio.toolbox.AudioToolbox (1.10 - 1.10) <69B273E8-5A8E-3FC7-B807-C16B657662FE> /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox

0x105cc8000 - 0x105d00ff7 com.apple.RemoteViewServices (2.0 - 94) <3F34D630-3DDB-3411-BC28-A56A9B55EBDA> /System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/Remot eViewServices

0x105d39000 - 0x105d39ffd com.apple.audio.units.AudioUnit (1.10 - 1.10) <68B21135-55A6-3563-A3D6-3E692A7DEB7F> /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit

0x105d3f000 - 0x105f87ff7 com.apple.CoreData (107 - 481.3) <E78734AA-E3D0-33CB-A014-620BBCAB2E96> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData

0x1060af000 - 0x1061dfff7 com.apple.desktopservices (1.8.3 - 1.8.3) <225BEC20-F8E0-3F22-9560-890A1A5B9050> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Desk topServicesPriv

0x10625f000 - 0x106509ff5 com.apple.HIToolbox (2.1.1 - 698) <26FF0E2C-1CD7-311F-ACF0-84F3D5273AD6> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.fra mework/Versions/A/HIToolbox

0x106661000 - 0x1067fdff3 com.apple.QuartzCore (1.8 - 332.3) <D6285800-F386-3E6B-84F2-A62F9029D95F> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore

0x1068d4000 - 0x1068dcff7 com.apple.speech.recognition.framework (4.2.4 - 4.2.4) <98BBB3E4-6239-3EF1-90B2-84EA0D3B8D61> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecogni tion.framework/Versions/A/SpeechRecognition

0x1068e6000 - 0x1069cafff com.apple.coreui (2.1 - 231) <432DB40C-6B7E-39C8-9FB5-B95917930056> /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI

0x106a8c000 - 0x106a9eff7 com.apple.MultitouchSupport.framework (245.13 - 245.13) <E51DE5CA-9859-3C13-A24F-37EF4385C1D6> /System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/Multit ouchSupport

0x106aad000 - 0x106aeefff com.apple.PerformanceAnalysis (1.47 - 47) <5E045817-0C84-341A-9B33-74CF1324FA70> /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/Perf ormanceAnalysis

0x10733f000 - 0x107357ff7 com.apple.GenerationalStorage (2.0 - 160.3) <64749B08-0212-3AC8-9B49-73D662B09304> /System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/Gene rationalStorage

0x107367000 - 0x107375fff com.apple.opengl (9.6.1 - 9.6.1) <B22FA400-5824-36AF-9945-5FEC31995A0E> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL

0x10737d000 - 0x10738afff com.apple.Sharing (132.2 - 132.2) <F983394A-226D-3244-B511-FA51FDB6ADDA> /System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing

0x10739b000 - 0x10745fff7 com.apple.backup.framework (1.5.4 - 1.5.4) <195DA868-47A5-37E6-8CF0-9BCF11846899> /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup

0x1074e7000 - 0x107573ff7 com.apple.ink.framework (10.9 - 207) <8A50B893-AD03-3826-8555-A54FEAF08F47> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework /Versions/A/Ink

0x1075a6000 - 0x1075e1fff com.apple.bom (14.0 - 193.1) <EF24A562-6D3C-379E-8B9B-FAE0E4A0EF7C> /System/Library/PrivateFrameworks/Bom.framework/Versions/A/Bom

0x1075f4000 - 0x107619ff7 com.apple.CoreVideo (1.8 - 117.2) <4674339E-26D0-35FA-9958-422832B39B12> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

0x107635000 - 0x107906ff4 com.apple.CoreImage (9.4.0) <2C636ECD-0F1A-357C-9EFF-0452476FDDF5> /System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/CoreImage .framework/Versions/A/CoreImage

0x1079fb000 - 0x107a4efff com.apple.ScalableUserInterface (1.0 - 1) <CF745298-7373-38D2-B3B1-727D5A569E48> /System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/ScalableU serInterface.framework/Versions/A/ScalableUserInterface

0x107a73000 - 0x107ab2fff libGLU.dylib (9.6.1) <AE032555-3E2F-3DBF-A26D-EA4576061605> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib

0x107ac1000 - 0x107ac9ffc libGFXShared.dylib (9.6.1) <25BBF325-AC57-3BAA-9427-2D14CC243AE6> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.d ylib

0x107ad0000 - 0x107adbfff libGL.dylib (9.6.1) <4B65BF9F-F34A-3CD1-94E8-DB26DAA0A59D> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib

0x107aef000 - 0x107b2dff7 libGLImage.dylib (9.6.1) <5E02B38C-9F36-39BE-8746-724F0D8BBFC0> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dyl ib

0x107b35000 - 0x107b37fff libCVMSPluginSupport.dylib (9.6.1) <FB37F4C4-1E84-3349-BB03-92CA0A5F6837> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginS upport.dylib

0x107b3c000 - 0x107b3ffff libCoreVMClient.dylib (58.1) <EBC36C69-C896-3C3D-8589-3E9023E7E56F> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClien t.dylib

0x107b45000 - 0x107f78ffb com.apple.vision.FaceCore (3.0.0 - 3.0.0) <F42BFC9C-0B16-35EF-9A07-91B7FDAB7FC5> /System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore

0x108190000 - 0x10819aff7 com.apple.CrashReporterSupport (10.9 - 539) <B25A09EC-A021-32EC-86F8-05B4837E0EDE> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/Cra shReporterSupport

0x1081a8000 - 0x1081f6ff7 com.apple.opencl (2.3.59 - 2.3.59) <B49916BA-1D02-3BA6-9986-5A935A3C009B> /System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL

0x10820e000 - 0x10821affb com.apple.AppleFSCompression (56.92.1 - 1.0) <066255FD-DBD1-3041-8DDA-7AFC41C9096D> /System/Library/PrivateFrameworks/AppleFSCompression.framework/Versions/A/Apple FSCompression

0x108222000 - 0x10823bff7 com.apple.Ubiquity (1.3 - 289) <C7F1B734-CE81-334D-BE41-8B20D95A1F9B> /System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity

0x10824e000 - 0x10827efff com.apple.IconServices (25 - 25.17) <4751127E-FBD5-3ED5-8510-08D4E4166EFE> /System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconService s

0x1082a7000 - 0x1082ccff7 com.apple.ChunkingLibrary (2.0 - 155.1) <B845DC7A-D1EA-31E2-967C-D1FE0C628036> /System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/Chunking Library

0x1082d8000 - 0x108359fff com.apple.CoreSymbolication (3.0.1 - 141.0.5) <20E484C4-9F0E-3DF6-BB27-D509859FF57A> /System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSy mbolication

0x1083aa000 - 0x108402ff7 com.apple.Symbolication (1.4 - 129.0.2) <56F5E42C-4A23-3D0C-A830-616A03C16725> /System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolicat ion

0x108449000 - 0x108478fff com.apple.DebugSymbols (106 - 106) <E1BDED08-523A-36F4-B2DA-9D5C712F0AC7> /System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbol s

0x108493000 - 0x108497fff com.apple.CommonPanels (1.2.6 - 96) <6B434AFD-50F8-37C7-9A56-162C17E375B3> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels. framework/Versions/A/CommonPanels

0x10849e000 - 0x1084a1fff com.apple.help (1.3.3 - 46) <AE763646-D07A-3F9A-ACD4-F5CBD734EE36> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framewor k/Versions/A/Help

0x1084a7000 - 0x1084b9fff com.apple.ImageCapture (9.0 - 9.0) <BE0B65DA-3031-359B-8BBA-B9803D4ADBF4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture. framework/Versions/A/ImageCapture

0x1084d4000 - 0x1084ecff7 com.apple.openscripting (1.4 - 157) <B3B037D7-1019-31E6-9D17-08E699AF3701> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting .framework/Versions/A/OpenScripting

0x1084fe000 - 0x1084ffff7 com.apple.print.framework.Print (9.0 - 260) <EE00FAE1-DA03-3EC2-8571-562518C46994> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framewo rk/Versions/A/Print

0x108504000 - 0x108506ff7 com.apple.securityhi (9.0 - 55005) <446BE1A5-F65F-3ACB-8F33-A8EBFE0D0BD4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.fr amework/Versions/A/SecurityHI

0x10850c000 - 0x10855aff9 libstdc++.6.dylib (60) <0241E6A4-1368-33BE-950B-D0A175C41F54> /usr/lib/libstdc++.6.dylib

0x108b87000 - 0x108bb3fff com.apple.CoreServicesInternal (184.9 - 184.9) <4DEA54F9-81D6-3EDB-AA3C-1F9C497B3379> /System/Library/PrivateFrameworks/CoreServicesInternal.framework/CoreServicesIn ternal

0x108bef000 - 0x108bf7ff3 libCGCMS.A.dylib (599.25.10.1) <9A4FAAD7-1C16-33F8-A615-1DCAB0546E31> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGCMS .A.dylib

0x10adc6000 - 0x10adc7ff7 libodfde.dylib (20) <C00A4EBA-44BC-3C53-BFD0-819B03FFD462> /usr/lib/libodfde.dylib

0x10addf000 - 0x10adedfff com.apple.CommerceCore (1.0 - 42) <ACC2CE3A-913A-39E0-8344-B76F8F694EF5> /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Frameworks/C ommerceCore.framework/Versions/A/CommerceCore

0x10de83000 - 0x10dea5fff com.apple.framework.familycontrols (4.1 - 410) <4FDBCD10-CAA2-3A9C-99F2-06DCB8E81DEE> /System/Library/PrivateFrameworks/FamilyControls.framework/Versions/A/FamilyCon trols

0x10debf000 - 0x10decaff7 com.apple.DirectoryService.Framework (10.9 - 173.90.1) <B62B1994-1874-3F8D-B62E-589E6F6534C9> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryServi ce

0x10ded4000 - 0x10ded7ff7 com.apple.LoginUICore (3.0 - 3.0) <1ECBDA90-D6ED-3333-83EB-9C8232DFAD7C> /System/Library/PrivateFrameworks/LoginUIKit.framework/Versions/A/Frameworks/Lo ginUICore.framework/Versions/A/LoginUICore

0x10dedf000 - 0x10dee9ff7 libcsfde.dylib (380) <A5CF6F85-0537-399F-968B-1536B1235E65> /usr/lib/libcsfde.dylib

0x10def4000 - 0x10def6fff com.apple.EFILogin (2.0 - 2) <C360E8AF-E9BB-3BBA-9DF0-57A92CEF00D4> /System/Library/PrivateFrameworks/EFILogin.framework/Versions/A/EFILogin

0x110c89000 - 0x110c8bffb libutil.dylib (34) <DAC4A6CF-A1BB-3874-9569-A919316D30E8> /usr/lib/libutil.dylib

0x110c91000 - 0x110c97fff com.apple.AOSNotification (1.7.0 - 760.3) <7901B867-60F7-3645-BB3E-18C51A6FBCC6> /System/Library/PrivateFrameworks/AOSNotification.framework/Versions/A/AOSNotif ication

0x110ca3000 - 0x110cb3ffb libsasl2.2.dylib (170) <C8E25710-68B6-368A-BF3E-48EC7273177B> /usr/lib/libsasl2.2.dylib

0x110e88000 - 0x110eb4ff7 com.apple.framework.SystemAdministration (1.0 - 1.0) <6FD03EF6-32B6-397D-B9D7-D68E89A462F5> /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/Sys temAdministration

0x116489000 - 0x1164cefff libcurl.4.dylib (78.94.1) <88F27F9B-052E-3375-938D-2603E90D8AD5> /usr/lib/libcurl.4.dylib

0x11b000000 - 0x11b0d1ff1 com.apple.DiskImagesFramework (10.9 - 371.1) <D85430A6-1410-3B5F-9D11-17E2440B786E> /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages

0x11b131000 - 0x11b1bcfff libCoreStorage.dylib (380) <DE9B3F8C-045C-3010-9A25-C8CD72F1066B> /usr/lib/libCoreStorage.dylib

0x11b1e4000 - 0x11b29cff7 com.apple.DiscRecording (8.0 - 8000.4.6) <CDAAAD04-A1D0-3C67-ABCC-EFC9E8D44E7E> /System/Library/Frameworks/DiscRecording.framework/Versions/A/DiscRecording

0x11b304000 - 0x11b335fff com.apple.MediaKit (15 - 709) <23E33409-5C39-3F93-9E73-2B0E9EE8883E> /System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/MediaKit

0x11b347000 - 0x11b37cffc com.apple.LDAPFramework (2.4.28 - 194.5) <4ADD0595-25B9-3F09-897E-3FB790AD2C5A> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP

0x11b38b000 - 0x11b46afff libcrypto.0.9.8.dylib (50) <B95B9DBA-39D3-3EEF-AF43-44608B28894E> /usr/lib/libcrypto.0.9.8.dylib

0x11b4d2000 - 0x11b506fff libssl.0.9.8.dylib (50) <B15F967C-B002-36C2-9621-3456D8509F50> /usr/lib/libssl.0.9.8.dylib

0x7fff66f8d000 - 0x7fff66fc0817 dyld (239.4) <042C4CED-6FB2-3B1C-948B-CAF2EE3B9F7A> /usr/lib/dyld

External Modification Summary:

Calls made by other processes targeting this process:

task_for_pid: 66

thread_create: 0

thread_set_state: 0

Calls made by this process:

task_for_pid: 0

thread_create: 0

thread_set_state: 0

Calls made by all processes on this machine:

task_for_pid: 10310

thread_create: 1

thread_set_state: 0

VM Region Summary:

ReadOnly portion of Libraries: Total=120.4M resident=116.2M(97%) swapped_out_or_unallocated=4296K(3%)

Writable regions: Total=16.4G written=16.9M(0%) resident=44.3M(0%) swapped_out=0K(0%) unallocated=16.3G(100%)

REGION TYPE VIRTUAL

=========== =======

CG shared images 140K

Dispatch continuations 32.0M

Kernel Alloc Once 8K

MALLOC 548.6M

MALLOC (admin) 48K

MALLOC (reserved) 15.8G reserved VM address space (unallocated)

Memory Tag 242 12K

Memory Tag 251 8K

STACK GUARD 56.0M

Stack 10.1M

VM_ALLOCATE 16.3M

__DATA 19.7M

__IMAGE 528K

__LINKEDIT 28.2M

__TEXT 92.3M

__UNICODE 544K

mapped file 34.7M

shared memory 212K

=========== =======

TOTAL 16.6G

TOTAL, minus reserved VM space 839.4M

System Profile:

Model: MacPro5,1, BootROM MP51.007F.B03, 8 processors, Quad-Core Intel Xeon, 2.4 GHz, 6 GB, SMC 1.39f11

Graphics: ATI Radeon HD 5770, ATI Radeon HD 5770, PCIe, 1024 MB

Memory Module: DIMM 1, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120

Memory Module: DIMM 2, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120

Memory Module: DIMM 3, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120

Memory Module: DIMM 5, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120

Memory Module: DIMM 6, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120

Memory Module: DIMM 7, 1 GB, DDR3 ECC, 1066 MHz, 0x802C, 0x394A53463132383732415A2D314734473120

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x8E), Broadcom BCM43xx 1.0 (5.106.98.100.22)

Bluetooth: Version 4.2.7f3 14616, 3 services, 23 devices, 1 incoming serial ports

Network Service: Ethernet 2, Ethernet, en1

Network Service: Wi-Fi, AirPort, en2

PCI Card: ATI Radeon HD 5770, Display Controller, Slot-1

PCI Card: pci1095,3132, SATA Controller, Slot-2

Serial ATA Device: HL-DT-ST DVD-RW GH41N, 4.29 GB

Serial ATA Device: WDC WD1001FALS-41Y6A0, 1 TB

USB Device: Hub

USB Device: Keyboard Hub

USB Device: iLok

USB Device: eLicenser

USB Device: Apple Keyboard

USB Device: Apple Cinema Display

USB Device: BRCM2046 Hub

USB Device: Bluetooth USB Host Controller

FireWire Device: built-in_hub, Up to 800 Mb/sec

Thunderbolt Bus:

Thanks again,

Fred,

Reply

Answer 3

Linc Davis

Level 10

209,541 points

Sep 24, 2014 5:39 AM in response to fred_a

A.

You installed the "Genieo" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.)

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.

Step 1

In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent. If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state.

There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer.

This step does not completely inactivate Genieo.

Step 2

Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions.

Triple-click anywhere in the line below on this page to select it:

/Library/Frameworks/GenieoExtra.framework

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password.

Move each of these items to the Trash in the same way:

/Applications/Reset Search.app
/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
~/Library/Application Support/com.genieoinnovation.Installer
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist

If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

Restart and empty the Trash. Don't try to empty the Trash until you have restarted.

Step 3

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results.

Make sure you don't repeat the mistake that led you to install this trojan. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If youever download a file that isn't obviously what you expected, delete it immediately.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

Finally, be forewarned that when Genieo is mentioned on this site, the attacker sometimes shows up under the name "Genieo support." He will tell you to download a fake "uninstaller." As he intends, the uninstaller does not completely remove the malware, and is in fact malware itself.

B.

Uninstall SIMBL as follows. Back up all data before making any changes.

Triple-click anywhere in the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library

In the Finder, select

Go ▹ Go to Folder...

from the menu bar, paste into the box that opens by pressing command-V, then press return. A folder will open. From that folder, delete the items listed below (some may be absent.) You may be prompted for your administrator login password.

Application Support/SIMBL

InputManagers/SIMBL

LaunchAgents/net.culater.SIMBL.Agent.plist

LaunchAgents/net.infinite-labs.SIMBLEnablerForSandboxedApps.plist

ScriptingAdditions/SIMBL.osax

Log out and log back in.

Make sure you never reinstall SIMBL. It’s likely to come bundled with another third-party system modfication that depends on it. If you want trouble-free computing, avoid software that makes miraculous changes to other software, especially built-in applications. The only real exception to that rule is Safari extensions, which are mostly safe, and are easy to get rid of when they don’t work. SIMBL and its dependents are not Safari extensions.

Reply

Answer 4

fred_a Author

Level 1

1 points

Sep 24, 2014 6:10 AM in response to Linc Davis

Hi Linc, thanks a lot for the in depth reply....

Unfortunately I didn't find the Application in the apps folder.... what should I try?

Thanks again for all your help,

Fred,

Reply

Answer 5

Linc Davis

Level 10

209,541 points

Sep 24, 2014 6:42 AM in response to fred_a

As I wrote above, some of the components of Genieo may be absent.

Reply

Answer 6

fred_a Author

Level 1

1 points

Sep 26, 2014 3:00 AM in response to Linc Davis

Thanks- sorry didn't get back sooner....

So I followed the above instructions as closely as I could, but must have made a mistake and ended up locking the computer on startup. Reading up online it seems I'm not the only one to do this....

I've since reformatted the HD and reinstalled Mac OSX 10.9 but the problem persists!! I've searched the computer for the above files and none can be found, and I'm certain a format and reinstall will have removed Genieo?? Is there anything else it could be??

Thanks,

Fred,

Reply

Answer 7

Linc Davis

Level 10

209,541 points

Sep 27, 2014 4:16 PM in response to fred_a

I've searched the computer

I didn't suggest searching the computer. Please follow the instructions, or if they're not clear, be specific as to what you don't understand.

Reply

Answer 8

fred_a Author

Level 1

1 points

Sep 29, 2014 2:03 AM in response to Linc Davis

Hmm well you did say-

/Library/Frameworks/GenieoExtra.framework

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

So in effect I'd be searching the computer for the files you listed above.

Anyway- I've bought a new HD, formatted and re-installed 10.9 which seems to have resolved the issue.

Thanks for your help.

Reply

Answer 9

orubin

Level 1

8 points

Jan 20, 2015 10:49 AM in response to fred_a

Hey Linc,

I am having a similar problem, but so far, I do not have any Genieo components.

I am wondering if I can post one of my MANY crash logs and you can help me.

Right now, this is the excerpt that seems to be important, but I am happy to post the entire thing if this is not enough:

----------------------------

Thread 9 Crashed:

0 com.apple.securityfoundation 0x000000010dd3bf9e +[SecFoundationModVector pathForKeychain:] + 35

Thread 9 crashed with X86 Thread State (64-bit):

rax: 0xfeb883509405332b rbx: 0x0000000000000000 rcx: 0x000000010ee31000 rdx: 0x0000000000000046

rdi: 0x000000010ee31000 rsi: 0x000000010ed6e000 rbp: 0x000000010ee32ff0 rsp: 0x000000010ee32f68

r8: 0x0000000000000000 r9: 0x0000000000000000 r10: 0x0000000000000000 r11: 0x0000000000000000

r12: 0x000000010db8d420 r13: 0x0000000000000000 r14: 0x0000000000000000 r15: 0x000000010ed6e000

rip: 0x000000010dd3bf9e rfl: 0x0000000000010206 cr2: 0x00007f9c31498000

Logical CPU: 3

Error Code: 0x00000000

Trap Number: 13

-------------------------

Would appreciate your thoughts. Thanks

One note of interest: I had installed the latest Little Snitch, and it hung the boot. I was able to get it uninstalled, and believe I have all the parts out (their uninstaller ran) but ever since, I am plagued by this constant crash and restart of the Finder. So bad, that it took me an hour to get the console open! :-(

Oh, and in case this helps:

Process: Finder [441]

Path: /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

Identifier: com.apple.finder

Version: 10.9.4 (10.9.4)

Build Info: Finder_FE-885004002000000~1

Code Type: X86-64 (Native)

Parent Process: launchd [292]

Responsible: Finder [441]

User ID: 501

Date/Time: 2015-01-20 10:21:26.469 -0800

OS Version: Mac OS X 10.9.5 (13F34)

Report Version: 11

Anonymous UUID: ***********************************

Crashed Thread: 9

Exception Type: EXC_BAD_ACCESS (SIGSEGV)

Exception Codes: EXC_I386_GPFLT

Reply

Answer 10

orubin

Level 1

8 points

Jan 20, 2015 1:43 PM in response to orubin

More digging:

Removed Google Drive after reading that could cause this issue. Did not seem to change anything.

Removed Dropbox as well, as there were reports that updating icons in the Finder can cause this problem. No change.

If I let it run on and on, after a while, it finally stops and settles down. Rebooting brings back the problem for some time.

This is odd

Reply

Answer 11

Nov 24, 2015 6:47 PM in response to fred_a

Actually - this is a report from Linc Davis (thank you a million times over) - I can't find the original post...- I'd spent all day trying to figure this out and this is what worked for me:

Back up all data if you haven’t already done so. Before proceeding, you must be sure you can restore your system to the state it’s in now.

Launch the Terminal application by entering the first few letters of its name into a Spotlight search. If that doesn’t work, then in the Finder, press the key combination shift-command-U. The application is in the folder that opens.

Copy or drag – do not type – the line below into the Terminal window, then press return:

find ~ -type f -name .DS_Store -delete

The command will take a noticeable amount of time to run. When a new dollar-sign (“$”) prompt appears below what you entered, quit Terminal.

Reply