Hello everyone .. I would like to ask if the adwaremedic program is the safest way to remove adware from the mac. Lately I m having some pop up advertisements from a specific site called mac keeper. I have no idea how this ad came up since I am not downloading torrents nor visiting any suspicious site .
So is this the only way to permanently remove the adware? Is it safe , since this is a third party program? Thanks in advance everyone
~Bee wrote:
Which obsolete diagnostic program are you referring to?
I think he's referring to his own diagnostic script, nearly every version of which posted on these forums is obsolete at this point, due to the lack of any ability to go back and edit them later. It's almost as if someone were leaving hundreds of different beta copies of one specific program lying around, none of them with any kind of a version number. Nobody should be using those old scripts at this point. (I'd argue nobody should be using the recent ones, either, but that's a matter of opinion.)
I will have to agree, the method he uses just leaves obsolete advice laying around for anyone to use, quite dangerous really.
Thank you I'll give that a try.
~Bee wrote:
. . . start your own thread with a full description of the problem, not with the output of an obsolete diagnostic that nobody asked for. Believe me, you'll get much better results that way.
Which obsolete diagnostic program are you referring to?
If it's Thomas Reed's app, now called MalwareBytes, it seems to be that it gives very good information.
I realize you have written, or provided, a script that you prefer, but Thomas' app is easy to run, and provides very useful information, as well.
Knowing the ways of this particular poster my guess he is obliquely referring to Etrecheck, something he has never approved of.
Ya think?
😮
Approval from that source is a rare and splendid thing. I think it is a symptom of NMH syndrome.
My terminal results
Again, you have posted the results of an outdated test that shouldn't be posted on this site unless asked for by me, and without giving any indication of why. If the problem has to do with web ads, remove your Safari extensions and see whether the ads go away. Do the equivalent in Chrome and Firefox, if you use either of those. If those steps don't solve the problem, please start a new thread with a full description and no test results.
Your problem, hardware or software, may not be exactly the same as that of the original poster of this older thread, and it can be very confusing for everybody if we try to answer more than one question in each thread, which can also result in you applying the wrong advice to your particular problem.
In order for us to give your problem our proper attention to try to solve it, would you kindly start your own thread, describing the trouble you are having in the fullest detail, including completing your details to show what Mac or iDevice you are using, what operating system, and what version of the application in question. Please remember to post in the forum relevant to your hardware or version of OS X. A full list of all the support forums is here:
Start time: 21:48:02 09/28/15
Model Identifier: MacBookAir6,2
System Version: OS X 10.10.5 (14F27)
Kernel Version: Darwin 14.5.0
Time since boot: 10:03
FileVault: On
Diagnostic reports
2015-09-02 XPCKeychainSandboxCheck crash x2
2015-09-09 Google Chrome crash x2
2015-09-09 XPCKeychainSandboxCheck crash
2015-09-11 XPCKeychainSandboxCheck crash
2015-09-22 Google Chrome crash
2015-09-24 Google Chrome crash
Log
Sep 27 00:48:46 com.apple.iTunesHelper.67340: Service exited with abnormal code: 1
Sep 27 15:52:29 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
Sep 27 15:52:30 en0: Error configuring antenna diversity (index = -1).
Sep 27 15:52:30 en0: Error configuring transmit antenna (index = -1).
Sep 27 15:52:51 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 105
Sep 27 16:55:45 com.apple.iTunesHelper.67340: Service exited with abnormal code: 1
Sep 27 17:59:22 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
Sep 27 17:59:23 en0: Error configuring antenna diversity (index = -1).
Sep 27 17:59:23 en0: Error configuring transmit antenna (index = -1).
Sep 27 17:59:46 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 105
Sep 27 20:28:17 en0: Error configuring antenna diversity (index = -1).
Sep 27 20:28:17 en0: Error configuring transmit antenna (index = -1).
Sep 27 21:09:46 com.apple.iTunesHelper.67340: Service exited with abnormal code: 1
Sep 28 11:44:38 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
Sep 28 11:44:40 en0: Error configuring antenna diversity (index = -1).
Sep 28 11:44:40 en0: Error configuring transmit antenna (index = -1).
Sep 28 11:45:01 com.adobe.ARMDCHelper.UUID: Service exited with abnormal code: 105
Sep 28 15:50:08 en0: Error configuring antenna diversity (index = -1).
Sep 28 15:50:08 en0: Error configuring transmit antenna (index = -1).
Sep 28 17:41:41 en0: Error configuring antenna diversity (index = -1).
Sep 28 17:41:41 en0: Error configuring transmit antenna (index = -1).
Sep 28 21:23:21 en0: Error configuring antenna diversity (index = -1).
Sep 28 21:23:21 en0: Error configuring transmit antenna (index = -1).
Sep 28 21:32:49 en0: Error configuring antenna diversity (index = -1).
Sep 28 21:32:49 en0: Error configuring transmit antenna (index = -1).
Swap (MiB): 1349
Daemons
com.adobe.ARMDC.Communicator
com.apple.installer.osmessagetracing
com.oracle.java.Helper-Tool
com.adobe.ARMDC.SMJobBlessHelper
Agents
com.adobe.ARMDCHelper.UUID
com.oracle.java.Java-Updater
com.apple.FolderActions.folders
com.google.keystone.user.agent
com.apple.AirPortBaseStationAgent
com.apple.FolderActions.enabled
Bundles
/System/Library/Extensions/JMicronATA.kext
- com.jmicron.JMicronATA
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
- com.adobe.acrobat.pdfviewer
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
- com.adobe.acrobat.pdfviewerNPAPI
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
- com.oracle.java.JavaAppletPlugin
/Library/Internet Plug-Ins/Silverlight.plugin
- com.microsoft.SilverlightPlugin
/Library/PreferencePanes/JavaControlPanel.prefPane
- com.oracle.java.JavaControlPanel
Library/Caches/com.apple.Safari/Extensions/LastPass.safariextension
- com.lastpass.lpsafariextension
Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist (checksum 3012644940)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Disabled</key>
<true/>
<key>Label</key>
<string>org.apache.httpd</string>
<key>EnvironmentVariables</key>
<dict>
<key>XPC_SERVICES_UNAVAILABLE</key>
<string>1</string>
</dict>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/httpd-wrapper</string>
<string>-D</string>
<string>FOREGROUND</string>
</array>
<key>OnDemand</key>
<false/>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist (checksum 2197523146)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.adobe.ARMDCHelper.UUID</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>12600</integer>
</dict>
</plist>
Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 2504867950)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.oracle.java.Java-Updater</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>
<string>-bgcheck</string>
</array>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>13</integer>
<key>Minute</key>
<integer>17</integer>
<key>Weekday</key>
<integer>4</integer>
</dict>
</dict>
...and 1 more line(s)
Contents of /Library/LaunchDaemons/com.adobe.ARMDC.Communicator.plist (checksum 3887726299)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.adobe.ARMDC.Communicator</string>
<key>MachServices</key>
<dict>
<key>com.adobe.ARMDC.Communicator</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/Library/PrivilegedHelperTools/com.adobe.ARMDC.Communicator</string>
</array>
</dict>
</plist>
Contents of /Library/LaunchDaemons/com.adobe.ARMDC.SMJobBlessHelper.plist (checksum 930028549)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.adobe.ARMDC.SMJobBlessHelper</string>
<key>MachServices</key>
<dict>
<key>com.adobe.ARMDC.SMJobBlessHelper</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper</string >
</array>
</dict>
</plist>
Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 64342103)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.google.keystone.user.agent</string>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>ProgramArguments</key>
<array>
<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>
<string>-runMode</string>
<string>ifneeded</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>3523</integer>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
</dict>
</plist>
Firewall: On
Listeners
cupsd: ipp
User login items
iTunesHelper
- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app
SpeechSynthesisServer
- /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app
Safari extensions
LastPass
Restricted files: 13
Lockfiles: 4
Elapsed time (s): 244
-Deleted outdated diagnostic-
Hi Lync,
I executed your script on my mac and would appreciate your comments on the results of execution.
Just in case you can't open the page I put the results below:
*****
Start time: 13:00:05 01/10/16
Model Identifier: MacBookPro6,2
System Version: OS X 10.11.2 (15C50)
Kernel Version: Darwin 15.2.0
System Integrity Protection: Enabled
Time since boot: 2:53
SATA
Samsung SSD 840 EVO 250GB
Diagnostic reports
2016-01-07 Kernel panic x12
2016-01-07 Spotlight crash
2016-01-08 Kernel panic x6
2016-01-09 Kernel panic x4
2016-01-10 Kernel panic x2
Log
Jan 9 22:35:54 en1: Error configuring antenna diversity (index = -1).
Jan 10 10:04:41 en1: Error configuring antenna diversity (index = -1).
Jan 10 10:06:55 AssertMacros: tmpData (value: 0x0), file: /BuildRoot/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager/AppleCre dentialManager-83.20.2/AppleCredentialManager/AppleCredentialManager.cpp, line: 765
Jan 10 10:06:55 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x49b0cad3988b3fc3, provider is 0x49b0cad3988c37c3
Jan 10 10:06:55 jnl: b(1, 4): replay_journal: from: 18845696 to: 3631104 (joffset 0x747000)
Jan 10 10:06:55 000001.724011 IOUSBHostDevice@fa111000: IOUSBHostDevice::start: failed to get device descriptor
Jan 10 10:06:55 000001.724142 AppleUSB20HubPort@fa111000: AppleUSB20HubPort::resetAndCreateDevice: failed to start device
Jan 10 10:06:55 000001.724169 AppleUSB20HubPort@fa111000: AppleUSB20HubPort::resetAndCreateDevice: failed to create device (0xe00002e9), disabling port
Jan 10 10:06:55 jnl: b(1, 4): journal replay done.
Jan 10 10:06:57 en1: Error configuring antenna diversity (index = -1).
Jan 10 10:07:00 Can't load kext org.virtualbox.kext.VBoxUSB - failed to resolve library dependencies.
Jan 10 10:07:00 Kext org.virtualbox.kext.VBoxUSB failed to load (0xdc00800e).
Jan 10 10:07:00 Failed to load kext org.virtualbox.kext.VBoxUSB (error 0xdc00800e).
Jan 10 10:07:00 Can't load kext org.virtualbox.kext.VBoxNetFlt - failed to resolve library dependencies.
Jan 10 10:07:00 Kext org.virtualbox.kext.VBoxNetFlt failed to load (0xdc00800e).
Jan 10 10:07:00 Failed to load kext org.virtualbox.kext.VBoxNetFlt (error 0xdc00800e).
Jan 10 10:07:01 Can't load kext org.virtualbox.kext.VBoxNetAdp - failed to resolve library dependencies.
Jan 10 10:07:01 Kext org.virtualbox.kext.VBoxNetAdp failed to load (0xdc00800e).
Jan 10 10:07:01 Failed to load kext org.virtualbox.kext.VBoxNetAdp (error 0xdc00800e).
Jan 10 10:07:01 org.virtualbox.startup: Service exited with abnormal code: 1
Jan 10 10:50:45 en1: Error configuring antenna diversity (index = -1).
Jan 10 11:07:37 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1
Jan 10 11:13:03 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1
Jan 10 11:49:44 en1: Error configuring antenna diversity (index = -1).
Jan 10 13:00:08 process smcDiagnose[720] caught causing excessive wakeups. Observed wakeups rate (per sec): 52647; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 49381
kexts
tw.com.mct.Trigger5Core (1.1.9) UUID
Daemons
com.apple.installer.osmessagetracing
com.oracle.java.Helper-Tool
com.adobe.fpsaud
Agents
com.mct.USBVGASync
com.google.keystone.system.agent
com.apple.photostream-agent
com.apple.CSConfigDotMacCert-EMAIL-SharedServices
com.oracle.java.Java-Updater
com.apple.AirPortBaseStationAgent
Bundles
/System/Library/Extensions/BJUSBLoad.kext
- jp.co.canon.bj.print.BJUSBLoad
/System/Library/Extensions/EPSONUSBPrintClass.kext
- com.epson.print.kext.USBPrintClass
/System/Library/Extensions/hp_designjet_series.kext
- com.hp.print.hpio.Designjet.kext
/System/Library/Extensions/hp_Deskjet_io_enabler.kext
- com.hp.print.hpio.Deskjet.kext
/System/Library/Extensions/hp_Inkjet1_io_enabler.kext
- com.hp.print.hpio.Inkjet1.kext
/System/Library/Extensions/hp_Inkjet2_io_enabler.kext
- com.hp.print.hpio.Inkjet2.kext
/System/Library/Extensions/hp_Inkjet3_io_enabler.kext
- com.hp.print.hpio.Inkjet3.kext
/System/Library/Extensions/hp_Inkjet4_io_enabler.kext
- com.hp.print.hpio.Inkjet4.kext
/System/Library/Extensions/hp_Inkjet5_io_enabler.kext
- com.hp.print.hpio.Inkjet5.kext
/System/Library/Extensions/hp_Inkjet7_io_enabler.kext
- com.hp.print.hpio.inkjet7.kext
/System/Library/Extensions/hp_Inkjet8_io_enabler.kext
- com.hp.print.hpio.inkjet8.kext
/System/Library/Extensions/hp_Inkjet_io_enabler.kext
- com.hp.print.hpio.Inkjet.kext
/System/Library/Extensions/hp_Laserjet_io_enabler.kext
- com.hp.print.hpio.Laserjet.kext
/System/Library/Extensions/hp_Officejet_io_enabler.kext
- com.hp.print.hpio.Officejet.kext
/System/Library/Extensions/hp_Photosmart_io_enabler.kext
- com.hp.print.hpio.Photosmart.kext
/System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext
- com.hp.print.hpio.PhotosmartPro.kext
/System/Library/Extensions/hp_qc_io_enabler.kext
- com.hp.hpio.hp_psa530_630_io_enabler
/System/Library/Extensions/JMicronATA.kext
- com.jmicron.JMicronATA
/System/Library/Extensions/LexmarkUSBMerge.kext
- com.lexmark.print.usbmerge
/System/Library/Extensions/Trigger5Core.kext
- tw.com.mct.Trigger5Core
/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
- info.emagic.driver.unitor
/Library/Internet Plug-Ins/Flash Player.plugin
- N/A
/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
- com.Google.GoogleEarthPlugin.plugin
/Library/Internet Plug-Ins/iPhotoPhotocast.plugin
- com.apple.plugin.iPhotoPhotocast
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
- com.oracle.java.JavaAppletPlugin
/Library/Internet Plug-Ins/MeetingJoinPlugin.plugin
- com.microsoft.communicator.meetingjoinplugin
/Library/Internet Plug-Ins/Silverlight.plugin
- com.microsoft.SilverlightPlugin
/Library/Internet Plug-Ins (Disabled)/Flash Player.plugin
- N/A
/Library/PreferencePanes/Flash Player.prefPane
- com.adobe.flashplayerpreferences
/Library/PreferencePanes/JavaControlPanel.prefPane
- com.oracle.java.JavaControlPanel
/Library/ScriptingAdditions/MemopalAppScript.osax
- com.memopal.MemopalAppScript.osax
/Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle
- com.teamviewer.AuthorizationPlugin
/Library/Spotlight/GBSpotlightImporter.mdimporter
- com.apple.garageband.spotlightimporter
/Library/Widgets/CI Filter Browser.wdgt
- com.apple.CIFilterBrowser
Library/Address Book Plug-Ins/SkypeABCaller.bundle
- com.skype.SkypeABCaller
Library/Address Book Plug-Ins/SkypeABChatter.bundle
- com.skype.SkypeABChatter
Library/Address Book Plug-Ins/SkypeABDialer.bundle
- com.skype.skypeabdialer
Library/Address Book Plug-Ins/SkypeABSMS.bundle
- com.skype.skypeabsms
Library/Internet Plug-Ins/WebEx64.plugin
- com.cisco_webex.plugin.gpc64
dylibs
/usr/lib/libgutenprint.2.0.3.dylib
Contents of /etc/hosts (checksum 3164423663)
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
Contents of /etc/pf.conf (checksum 2891177609)
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
Contents of /etc/syslog.conf (checksum 2399118465)
install.* @127.0.0.1:32376
Contents of /etc/pam.d/authorization (checksum 1288902703)
auth optional pam_krb5.so use_first_pass use_kcminit
auth optional pam_ntlm.so use_first_pass
auth required pam_opendirectory.so use_first_pass nullok
account required pam_opendirectory.so
Contents of /etc/pam.d/checkpw (checksum 2672765862)
auth required pam_opendirectory.so use_first_pass nullok
account required pam_opendirectory.so no_check_home no_check_shell
Contents of /etc/pam.d/chkpasswd (checksum 335781771)
auth required pam_opendirectory.so
account required pam_opendirectory.so
password required pam_permit.so
session required pam_permit.so
Contents of /etc/pam.d/cups (checksum 2842188894)
auth required pam_opendirectory.so
account required pam_permit.so
password required pam_deny.so
session required pam_permit.so
Contents of /etc/pam.d/ftpd (checksum 2001169128)
auth required pam_opendirectory.so
account required pam_permit.so
password required pam_deny.so
session required pam_permit.so
Contents of /etc/pam.d/login (checksum 1242678644)
auth optional pam_krb5.so use_kcminit
auth optional pam_ntlm.so try_first_pass
auth optional pam_mount.so try_first_pass
auth required pam_opendirectory.so try_first_pass
account required pam_nologin.so
account required pam_opendirectory.so
password required pam_opendirectory.so
session required pam_launchd.so
session required pam_uwtmp.so
session optional pam_mount.so
Contents of /etc/pam.d/login.term (checksum 3930746290)
account required pam_nologin.so
account required pam_opendirectory.so
session required pam_uwtmp.so
Contents of /etc/pam.d/other (checksum 2748091512)
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
session required pam_deny.so
Contents of /etc/pam.d/passwd (checksum 1026516346)
auth required pam_permit.so
account required pam_opendirectory.so
password required pam_opendirectory.so
session required pam_permit.so
Contents of /etc/pam.d/rshd (checksum 1553764881)
auth required pam_permit.so
account required pam_nologin.so
account required pam_opendirectory.so
session required pam_launchd.so
Contents of /etc/pam.d/screensaver (checksum 3141704602)
auth optional pam_krb5.so use_first_pass use_kcminit
auth required pam_opendirectory.so use_first_pass nullok
account required pam_opendirectory.so
account sufficient pam_self.so
account required pam_group.so no_warn group=admin,wheel fail_safe
account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe
Contents of /etc/pam.d/smbd (checksum 2516643123)
account required pam_sacl.so sacl_service=smb allow_trustacct
session required pam_permit.so
Contents of /etc/pam.d/sshd (checksum 2989478361)
auth optional pam_krb5.so use_kcminit
auth optional pam_ntlm.so try_first_pass
auth optional pam_mount.so try_first_pass
auth required pam_opendirectory.so try_first_pass
account required pam_nologin.so
account required pam_sacl.so sacl_service=ssh
account required pam_opendirectory.so
password required pam_opendirectory.so
session required pam_launchd.so
session optional pam_mount.so
Contents of /etc/pam.d/su (checksum 2045483434)
auth sufficient pam_rootok.so
auth required pam_opendirectory.so
account required pam_group.so no_warn group=admin,wheel ruser root_only fail_safe
account required pam_opendirectory.so no_check_shell
password required pam_opendirectory.so
session required pam_launchd.so
Contents of /etc/pam.d/sudo (checksum 3515993703)
auth required pam_opendirectory.so
account required pam_permit.so
password required pam_deny.so
session required pam_permit.so
Contents of /etc/periodic/daily/110.clean-tmps (checksum 4099837049)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_clean_tmps_enable" in
[Yy][Ee][Ss])
if [ -z "$daily_clean_tmps_days" ]
then
echo '$daily_clean_tmps_enable is set but' \
'$daily_clean_tmps_days is not'
rc=2
else
echo ""
echo "Removing old temporary files:"
set -f noglob
args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"
args="${args} -ctime +$daily_clean_tmps_days"
dargs="-empty -mtime +$daily_clean_tmps_days"
dargs="${dargs} ! -name .vfs_rsrc_streams_*"
[ -n "$daily_clean_tmps_ignore" ] && {
args="$args "`echo " ${daily_clean_tmps_ignore% }" |
sed 's/[ ][ ]*/ ! -name /g'`
dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |
sed 's/[ ][ ]*/ ! -name /g'`
...and 21 more line(s)
Contents of /etc/periodic/daily/130.clean-msgs (checksum 4292599426)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_clean_msgs_enable" in
[Yy][Ee][Ss])
if [ ! -d /var/msgs ]
then
echo '$daily_clean_msgs_enable is set but /var/msgs' \
"doesn't exist"
rc=2
else
echo ""
echo "Cleaning out old system announcements:"
[ -n "$daily_clean_msgs_days" ] &&
arg=-${daily_clean_msgs_days#-} || arg=
msgs -c $arg && rc=0 || rc=3
fi;;
*) rc=0;;
esac
exit $rc
Contents of /etc/periodic/daily/140.clean-rwho (checksum 659374794)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_clean_rwho_enable" in
[Yy][Ee][Ss])
if [ -z "$daily_clean_rwho_days" ]
then
echo '$daily_clean_rwho_enable is enabled but' \
'$daily_clean_rwho_days is not set'
rc=2
elif [ ! -d /var/rwho ]
then
echo '$daily_clean_rwho_enable is enabled but /var/rwho' \
"doesn't exist"
rc=2
else
echo ""
echo "Removing stale files from /var/rwho:"
case "$daily_clean_rwho_verbose" in
[Yy][Ee][Ss])
print=-print;;
*)
print=;;
...and 14 more line(s)
Contents of /etc/periodic/daily/199.clean-fax (checksum 1104983357)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
if [ -d /var/spool/fax ]; then
echo ""
echo "Removing scratch fax files"
cd /var/spool/fax && \
find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;
fi
Contents of /etc/periodic/daily/310.accounting (checksum 3208203734)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_accounting_enable" in
[Yy][Ee][Ss])
if [ ! -f /var/account/acct ]
then
echo '$daily_accounting_enable is set but /var/account/acct' \
"doesn't exist"
rc=2
elif [ -z "$daily_accounting_save" ]
then
echo '$daily_accounting_enable is set but ' \
'$daily_accounting_save is not'
rc=2
else
echo ""
echo "Rotating accounting logs and gathering statistics:"
cd /var/account
rc=0
n=$daily_accounting_save
rm -f acct.$n.gz acct.$n || rc=3
m=$n
...and 18 more line(s)
Contents of /etc/periodic/daily/400.status-disks (checksum 1480768650)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_status_disks_enable" in
[Yy][Ee][Ss])
echo ""
echo "Disk status:"
df $daily_status_disks_df_flags && rc=1 || rc=3
;;
*) rc=0;;
esac
exit $rc
Contents of /etc/periodic/daily/420.status-network (checksum 2730873650)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_status_network_enable" in
[Yy][Ee][Ss])
echo ""
echo "Network interface status:"
case "$daily_status_network_usedns" in
[Yy][Ee][Ss])
netstat -i && rc=0 || rc=3;;
*)
netstat -in && rc=0 || rc=3;;
esac;;
*) rc=0;;
esac
exit $rc
Contents of /etc/periodic/daily/430.status-rwho (checksum 3455351261)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$daily_status_rwho_enable" in
[Yy][Ee][Ss])
rwho=$(echo /var/rwho/*)
if [ -f "${rwho%% *}" ]
then
echo ""
echo "Local network system status:"
prog=ruptime
else
echo ""
echo "Local system status:"
prog=uptime
fi
rc=$($prog | tee /dev/stderr | wc -l)
if [ $? -eq 0 ]
then
[ $rc -gt 1 ] && rc=1
else
rc=3
fi;;
...and 3 more line(s)
Contents of /etc/periodic/daily/999.local (checksum 2319755381)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
rc=0
for script in $daily_local
do
echo ''
case "$script" in
/*)
if [ -f "$script" ]
then
echo "Running $script:"
sh $script || rc=3
else
echo "$script: No such file"
[ $rc -lt 2 ] && rc=2
fi;;
*)
echo "$script: Not an absolute path"
[ $rc -lt 2 ] && rc=2;;
esac
done
exit $rc
Contents of /etc/periodic/monthly/199.rotate-fax (checksum 3437454680)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
echo ""
printf %s "Rotating fax log files:"
cd /var/log/fax
for i in *.log; do
if [ -f "${i}" ]; then
echo -n " $i"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
echo ""
Contents of /etc/periodic/monthly/200.accounting (checksum 3541581936)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
oldmask=$(umask)
umask 066
case "$monthly_accounting_enable" in
[Yy][Ee][Ss])
W=/var/log/wtmp
rc=0
remove=NO
if [ $rc -eq 0 ]
then
echo ""
echo "Doing login accounting:"
rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)
[ $rc -gt 0 ] && rc=1
fi
[ $remove = YES ] && rm -f $W.0;;
*) rc=0;;
esac
umask $oldmask
exit $rc
Contents of /etc/periodic/monthly/999.local (checksum 2355967272)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
rc=0
for script in $monthly_local
do
echo ''
case "$script" in
/*)
if [ -f "$script" ]
then
echo "Running $script:"
sh $script || rc=3
else
echo "$script: No such file"
[ $rc -lt 2 ] && rc=2
fi;;
*)
echo "$script: Not an absolute path"
[ $rc -lt 2 ] && rc=2;;
esac
done
exit $rc
Contents of /etc/periodic/weekly/320.whatis (checksum 922328658)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
case "$weekly_whatis_enable" in
[Yy][Ee][Ss])
echo ""
echo "Rebuilding whatis database:"
MANPATH=`/usr/bin/manpath -q`
if [ $? = 0 ]
then
if [ -z "${MANPATH}" ]
then
echo "manpath failed to find any manpage directories"
rc=3
else
rc=0
/usr/libexec/makewhatis.local "${MANPATH}" || rc=3
if [ X"${man_locales}" != X ]
then
for i in ${man_locales}
do
LC_ALL=$i /usr/libexec/makewhatis.local -a \
-L "${MANPATH}" || rc=3
...and 9 more line(s)
Contents of /etc/periodic/weekly/999.local (checksum 3078968429)
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi
rc=0
for script in $weekly_local
do
echo ''
case "$script" in
/*)
if [ -f "$script" ]
then
echo "Running $script:"
sh $script || rc=3
else
echo "$script: No such file"
[ $rc -lt 2 ] && rc=2
fi;;
*)
echo "$script: Not an absolute path"
[ $rc -lt 2 ] && rc=2;;
esac
done
exit $rc
Contents of /Library/Preferences/com.apple.security.appsandbox.plist (checksum 2599182411)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>UnrestrictSpotlightContainerScope</key>
<true/>
</dict>
</plist>
Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (checksum 1199119104)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Kernel Flags</key>
<string></string>
</dict>
</plist>
Font issues: 4
Restricted files: 58
Lockfiles: 51
Elapsed time (s): 161
*****
Deleted
Thomas....thank you...thank you...thank you! I have been attacked now and held hostage by "totiteck" for approx. 2 weeks. I just downloaded adwaremedic and within 5 minutes your software kicked totiteck's butt!!! My iMac is now running clean and lightning fast. Your software was uber easy to download, install and run. It found everything and removed in a matter of minutes. I am now a supporter and fan of adwaremedic!
Thanks so much,
Don
Atlanta, Ga
ginger --
Thanks so much for posting your great results with MalwareBytes.
I'll make sure he sees it.
🙂
Adwaremedic is it safe ?
