MusicSlave

Q: MacBook Pro is running very slow

Hi all,

 

Trying to make my MacBook Pro run faster/more smoothly.  Speed has been deteriorating in recent weeks.

Could I get your opinion regarding the following Etresoft output?

 

Thanks!

R

 

 

EtreCheck version: 2.1.5 (108)

Report generated December 19, 2014 6:52:20 PM EST

 

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Click the [Adware] links for help removing adware.

 

Hardware Information: ℹ️

    MacBook Pro (13-inch, Mid 2009) (Verified)

    MacBook Pro - model: MacBookPro5,5

    1 2.53 GHz Intel Core 2 Duo CPU: 2-core

    8 GB RAM

        BANK 0/DIMM0

            4 GB DDR3 1067 MHz ok

        BANK 1/DIMM0

            4 GB DDR3 1067 MHz ok

    Bluetooth: Old - Handoff/Airdrop2 not supported

    Wireless:  en1: 802.11 a/b/g/n

 

Video Information: ℹ️

    NVIDIA GeForce 9400M - VRAM: 256 MB

        Color LCD 1280 x 800

 

System Software: ℹ️

    Mac OS X 10.7.5 (11G63) - Uptime: 63 days 12:24:17

 

Disk Information: ℹ️

    Hitachi HTS545032B9SA02 disk0 : (320.07 GB)

        disk0s1 (disk0s1) <not mounted> : 210 MB

        Macintosh HD (disk0s2) / : 319.21 GB (25.31 GB free)

        Recovery HD (disk0s3) <not mounted>  [Recovery]: 650 MB

 

    HL-DT-ST DVDRW  GS23N 

 

USB Information: ℹ️

    Western Digital My Passport 0820 1 TB

        disk1s1 (disk1s1) <not mounted> : 210 MB

        Boot OS X (disk1s3) <not mounted> : 134 MB

    Apple Inc. Built-in iSight

    Apple Internal Memory Card Reader

    Apple Inc. Apple Internal Keyboard / Trackpad

    Apple Computer, Inc. IR Receiver

    Apple Inc. BRCM2046 Hub

        Apple Inc. Bluetooth USB Host Controller

 

Kernel Extensions: ℹ️

        /System/Library/Extensions

    [not loaded]    com.cisco.cscotun (1.0) [Support]

 

Startup Items: ℹ️

    HP IO: Path: /Library/StartupItems/HP IO

    Startup items are obsolete in OS X Yosemite

 

Launch Agents: ℹ️

    [invalid?]    com.cisco.anyconnect.gui.plist [Support]

    [loaded]    com.citrix.AuthManager_Mac.plist [Support]

    [running]    com.citrix.ReceiverHelper.plist [Support]

    [running]    com.citrix.ServiceRecords.plist [Support]

    [running]    com.oracle.java.Java-Updater.plist [Support]

 

Launch Daemons: ℹ️

    [loaded]    com.adobe.fpsaud.plist [Support]

    [running]    com.cisco.anyconnect.vpnagentd.plist [Support]

    [loaded]    com.oracle.java.Helper-Tool.plist [Support]

    [loaded]    com.oracle.java.JavaUpdateHelper.plist [Support]

 

User Launch Agents: ℹ️

    [loaded]    com.adobe.ARM.[...].plist [Support]

    [failed]    com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist

    [loaded]    com.google.keystone.agent.plist [Support]

    [running]    com.spotify.webhelper.plist [Support]

 

User Login Items: ℹ️

    GrowlHelperApp    Application (/Users/[redacted]/Library/PreferencePanes/Growl.prefPane/Contents/Resources/Gr owlHelperApp.app)

    iTunesHelper    UNKNOWNHidden (missing value)

    Shrook    Application (/Applications/Shrook.app)

    iTunes    Application (/Applications/iTunes.app)

    Firefox    Application (/Applications/Firefox.app)

    VLCStreamer    UNKNOWN (missing value)

    CrossOver CD Helper    Application (/Applications/CrossOver.app/Contents/Resources/CrossOver CD Helper.app)

    Dropbox    Application (/Applications/Dropbox.app)

    HP Scheduler    Application (/Library/Application Support/Hewlett-Packard/Software Update/HP Scheduler.app)

 

Internet Plug-ins: ℹ️

    JavaAppletPlugin: Version: Java 7 Update 67 Check version

    FlashPlayer-10.6: Version: 15.0.0.246 - SDK 10.6 [Support]

    QuickTime Plugin: Version: 7.7.1

    AdobePDFViewerNPAPI: Version: 11.0.09 - SDK 10.6 [Support]

    AdobePDFViewer: Version: 11.0.09 - SDK 10.6 [Support]

    Flash Player: Version: 15.0.0.246 - SDK 10.6 Mismatch! Adobe recommends 16.0.0.235

    CitrixICAClientPlugIn: Version: 11.8.0 - SDK 10.7 [Support]

    OfficeLiveBrowserPlugin: Version: 12.2.5 [Support]

    iPhotoPhotocast: Version: 7.0

 

User internet Plug-ins: ℹ️

    WebEx64: Version: 1.0 - SDK 10.6 [Support]

 

3rd Party Preference Panes: ℹ️

    Citrix ShareFile Sync  [Support]

    Flash Player  [Support]

    Growl  [Support]

    Java  [Support]

    VLC Streamer  [Support]

 

Time Machine: ℹ️

    Time Machine not configured!

 

Top Processes by CPU: ℹ️

         2%    firefox

         0%    WindowServer

         0%    Dropbox

         0%    fontd

         0%    aosnotifyd

 

Top Processes by Memory: ℹ️

    378 MB    firefox

    361 MB    iTunes

    103 MB    mds

    60 MB    iCal

    52 MB    WindowServer

 

Virtual Memory Information: ℹ️

    4.99 GB    Free RAM

    1.41 GB    Active RAM

    953 MB    Inactive RAM

    963 MB    Wired RAM

    9.27 GB    Page-ins

    1.38 GB    Page-outs

 

Diagnostics Information: ℹ️

    Dec 19, 2014, 06:41:17 PM    /Users/[redacted]/Library/Logs/DiagnosticReports/plugin-container_2014-12-19-18 4117_[redacted].crash

Posted on Dec 20, 2014 9:58 AM

Close

Q: MacBook Pro is running very slow

  • All replies
  • Helpful answers

  • by CellarDwellr,

    CellarDwellr CellarDwellr Dec 20, 2014 10:09 AM in response to MusicSlave
    Level 4 (1,212 points)
    Dec 20, 2014 10:09 AM in response to MusicSlave

    Hello! I think you should start with disabling startup items that you're not using right after startup: "Apple Menu > System Preferences > Users & Groups" and click the [login]-tab. Remove everything you don't need by clicking the [-] button. Just unchecking them won't be enough.

     

    If you're not using Citrix anymore, uninstall it.

     

    If it's still slow you can do some general permissions maintanance:

     

    It will take you about 30 minutes or less to do these, depending on how bad the problem on your Mac is.

     

    The goal here is to boot your Mac to the so-called Recovery partition where you’ll have a chance to repair the disk and the disk permissions using the Disk Utility and Password Utility. This might solve your issue and even if it doesn’t- it’s still a decent maintenance step to perform. These steps won’t erase your data or reinstall your Mac in any way if you follow instructions carefully.

     

    Here’s how:

     

    1/ Make sure your computer is completely shut down.

     

    2/ You’ll have to be quick next: Press the Mac’s power button. As soon as you either hear the loud chime, or see the display light up - usually after a second or 2 - on your keyboard press [cmd] + [r] Keep these keys on your keyboard pressed until you either see an Apple Logo with a loading bar or a spinning gear.

     

    After a few minutes, you’ll be presented with a Utilities screen. This is the Recovery partition. If this step is already giving you problems, try using a USB-keyboard. It doesn’t have to be an Apple-keyboard. If you have a Windows-tailored keyboard laying around, use the “Windows-flag” key in stead of the [cmd]-key and it should also work.

     

    3/ Choose Disk Utility and click [continue]

    Disk Utility will display your computer’s harddrive in the left column. The default name for it is “Macintosh HD” and is usually the second one from the top. Click on it and click on the [verify disk] button. This will check your “Macintosh HD” harddrive partition for errors. If found, click [repair disk]  unless you have a Fusion drive in your Mac and it says [fix] instead of [repair disk] please tell us before you continue! For a screenshot of what I mean, check this article from Apple: http://support.apple.com/en-us/HT202574

     

    4/ Once done with the verifying or repairing of your “Macintosh HD” click [repair disk permissions]

    This will check your partition for permissions errors. A common myth about this feature is that it will fix all permissions issues on your Mac, which is not true, but it will fix most systemwide issues. Also, here is a list of error messages that you can safely ignore if they pop up:

    http://support.apple.com/en-us/HT203172

     

    5/ Lastly we shall do a permissions/Access Control List repair on specifically your user’s home folder with a somewhat hidden tool in the Recovery partition. Close Disk Utility and find the menu called “utilities” in the top left corner of your computer’s display. It’s in between the menus “edit” and “window” Don’t be confused with the menu called “os x utilities” 

    Choose Terminal. A somewhat old-fashioned looking window will pop up, waiting for a text command from you. This is the Terminal.

    After the # type: resetpassword and press return. Note that there is no space between ‘reset’ and ‘password’ 

     

    What you’ll see next is an rectangular window that gives you the option to reset passwords. We are not going to that, however. Instead, click on “Macintosh HD” at the top. In the pull-down menu below that, choose your user's accountname. Skip all the rest and at the very bottom click the [reset]-button.

    A spinning gear will appear and may stay on for a second or several minutes. It’s hard to predict exactly how long.

    If you have multiple users on your Mac, I advise you to repeat this step for all your users.

     

    We’re ready to reboot your Mac now. Click on the Apple Menu and choose “startup disk” Choose to boot from “Macintosh HD” Please let us know if this solved your issue, or if the steps above did not work, or could not be performed for some reason.

  • by Linc Davis,

    Linc Davis Linc Davis Dec 20, 2014 11:01 AM in response to MusicSlave
    Level 10 (208,000 points)
    Applications
    Dec 20, 2014 11:01 AM in response to MusicSlave

    Launch the Console application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad and start typing the name.

    The title of the Console window should be All Messages. If it isn't, select

              SYSTEM LOG QUERIES ▹ All Messages

    from the log list on the left. If you don't see that list, select

              View ▹ Show Log List

    from the menu bar at the top of the screen.

    Click the Clear Display icon in the toolbar. Then take an action that isn't working the way you expect. Select any messages that appear in the Console window. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.

    The log contains a vast amount of information, almost all of which is irrelevant to solving any particular problem. When posting a log extract, be selective. A few dozen lines are almost always more than enough.

    Please don't indiscriminately dump thousands of lines from the log into this discussion.

    Please don't post screenshots of log messages—post the text.

    Some private information, such as your name or email address, may appear in the log. Anonymize before posting.

  • by Lexiepex,

    Lexiepex Lexiepex Dec 20, 2014 11:42 AM in response to MusicSlave
    Level 6 (10,497 points)
    Mac OS X
    Dec 20, 2014 11:42 AM in response to MusicSlave

    It does not look too bad:

    Indeed remove all items from the LoginItems.

    Then restart, it should be a bit better already.

    Uninstall VLC Streamer; and for all other apps check for the latest update.

    HP scheduler may take a lot of resources, I am rather certain that you do not need that software.

    The same for HP I/O.

    Then restart and see how it does.It may be a good idea to make somewhat more free space on the startup disk.

    Rethink your backup strategy.

    Lex

  • by MusicSlave,

    MusicSlave MusicSlave Dec 20, 2014 11:44 AM in response to CellarDwellr
    Level 1 (10 points)
    Dec 20, 2014 11:44 AM in response to CellarDwellr

    @Cellar Dwellr -- thanks!  I will try all that you suggested and will let you know how it went.

     

    @Linc Davis -- not sure what exactly you mean by "take an action that isn't working the way you expect".  Everything works, the computer is just generally very slow.  But to give an example, here are just a few lines from the log when I opened Chrome:

     

    12/20/14 2:38:10.000 PM kernel: Google Chrome He (map: 0xffffff8014f0c6a8) triggered DYLD shared region unnest for map: 0xffffff8014f0c6a8, region 0x7fff8f000000->0x7fff8f200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

    12/20/14 2:38:10.000 PM kernel: Google Chrome He (map: 0xffffff80264a2d00) triggered DYLD shared region unnest for map: 0xffffff80264a2d00, region 0x7fff8f000000->0x7fff8f200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

    12/20/14 2:38:10.000 PM kernel: Google Chrome He (map: 0xffffff80264a2a48) triggered DYLD shared region unnest for map: 0xffffff80264a2a48, region 0x7fff8f000000->0x7fff8f200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

    12/20/14 2:38:20.722 PM [0x0-0xf2af2a].com.google.Chrome: objc[49713]: Object 0x7faa63c91300 of class __NSCFString autoreleased with no pool in place - just leaking - break on objc_autoreleaseNoPool() to debug

  • by MusicSlave,

    MusicSlave MusicSlave Dec 20, 2014 11:46 AM in response to Lexiepex
    Level 1 (10 points)
    Dec 20, 2014 11:46 AM in response to Lexiepex

    Thanks Lex.

    Will remove login items

    Will uninstall VLC Streamer and HP scheduler

    I'm not certain why it says "Time Machine not configured" -- I am certainly backing up with Time Machine.

     

    Ramsey

  • by Lexiepex,

    Lexiepex Lexiepex Dec 20, 2014 11:53 AM in response to MusicSlave
    Level 6 (10,497 points)
    Mac OS X
    Dec 20, 2014 11:53 AM in response to MusicSlave

    Ramsey: are you sure TM works as it should? Check by going into "Ener Time Machine". I will try and ask the developer of etrecheck to join.

    Lex

  • by etresoft,

    etresoft etresoft Dec 20, 2014 12:06 PM in response to MusicSlave
    Level 7 (29,298 points)
    Mac OS X
    Dec 20, 2014 12:06 PM in response to MusicSlave

    MusicSlave wrote:

     

    I'm not certain why it says "Time Machine not configured" -- I am certainly backing up with Time Machine.

    That is because you are running Lion. EtreCheck just consolidates information from various lower-level system utilities and preference files. For some reason, one of those files is sometimes missing on Lion. That's why EtreCheck cannot print your Time Machine information.

     

    OS X is a closed system and sometimes it is very hard to figure out just what is going on internally. Sometimes, even Apple isn't sure which preference files are being used.

  • by MusicSlave,

    MusicSlave MusicSlave Dec 20, 2014 12:12 PM in response to etresoft
    Level 1 (10 points)
    Dec 20, 2014 12:12 PM in response to etresoft

    @etresoft -- thanks, appreciate it.  I double checked and time machine appears to be backing up my system properly, so no concerns there.

     

    @LexSchellings -- curiously, VLC streamer and HP scheduler have both already been uninstalled in the past, so I'm not sure why they still show up in the log?  Maybe there are other files somewhere that I need to delete?

     

    Unrelated question -- would upgrading to Yosemite make my system run faster?  or is that a lateral move in terms of speed?

     

    thanks again,

    Ramsey

  • by Lexiepex,

    Lexiepex Lexiepex Dec 20, 2014 12:33 PM in response to MusicSlave
    Level 6 (10,497 points)
    Mac OS X
    Dec 20, 2014 12:33 PM in response to MusicSlave

    Yosemite: If you have enough Ram and free disk space, Mavericks and Yosemite are much more advanced than Lion and Mountain Lion.

    But before you do upgrade you should first be sure that your issues are gone. You can however make a "clean install" and by hand add your apps and user data, which is always better than installing over the existing OS.

    You may already make some more disk space free.

    We are going for the leftovers now:

    Use the Finder,

    - in MacintoshHD->Library->StartupItems    delete   HP IO

    (if you do not find it here:  in MacintoshHD->System->Library->StartupItems    delete   HP IO).

    - in  SystemPreferences  CTL+click  VLCStreamer and choose "remove".

    personally I would do the same to  Growl.

    - update Flashplayer.

    - if you do not need Citrix uninstall it, otherwise check the current version.

    Restart: see how it does now.

    Lex

    PS the TM question solved already.

  • by Linc Davis,

    Linc Davis Linc Davis Dec 20, 2014 4:31 PM in response to MusicSlave
    Level 10 (208,000 points)
    Applications
    Dec 20, 2014 4:31 PM in response to MusicSlave

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

    Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

    There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

    3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

    You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

    In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

    You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message.

    Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

    4. Here's a summary of what you need to do, if you choose to proceed:

    ☞ Copy a line of text in this window to the Clipboard.

    ☞ Paste into the window of another application.

    ☞ Wait for the test to run. It usually takes a few minutes.

    ☞ Paste the results, which will have been copied automatically, back into a reply on this page.

    The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

    5. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

    6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

    7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

    Triple-click anywhere in the line of text below on this page to select it:

    PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*genieo\* \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB 'com.adobe.AAM.Updater-1.0 com.adobe.AAM.Updater-1.0 com.adobe.AdobeCreativeCloud com.adobe.CS4ServiceManager com.adobe.CS5ServiceManager com.adobe.fpsaud com.adobe.SwitchBoard com.adobe.SwitchBoard com.apple.aelwriter com.apple.AirPortBaseStationAgent com.apple.FolderActions.enabled com.apple.installer.osmessagetracing com.apple.mrt.uiagent com.apple.ReportCrash.Self com.apple.rpmuxd com.apple.SafariNotificationAgent com.apple.usbmuxd com.citrixonline.GoToMeeting.G2MUpdate com.google.keystone.agent com.google.keystone.daemon com.microsoft.office.licensing.helper com.oracle.java.Helper-Tool com.oracle.java.JavaUpdateHelper com.oracle.java.JavaUpdateHelper org.macosforge.xquartz.privileged_startx org.macosforge.xquartz.privileged_startx org.macosforge.xquartz.startx' '879294308 4071182229 461455494 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 3694147963 1233118628 2456546649 2806998573 2778718105 2636415542 842973933 2051385900 3301885676 891055588 998894468 695903914 1443423563 4136085286 523110921 2883943871 3873345487' 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<10) print "com.apple.";} ' ' { sub(/ :/,"");print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { split("'"${p[41]}"'",b);split("'"${p[42]}"'",c);for(i in b) print b[i]".plist\t"c[i];if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&& $3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p);if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n   "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n   [N/A]";"cksum "F|getline C;split(C, A);C="checksum "A[1];"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("PlistBuddy -c Print "F|getline g) { l++;if(l<=L) f=f"\n   "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F" ("T", "C")";else F=F" ("C")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n   ...and %s more line(s)\n",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */   /;' ' s/^.+ |\(.+\)$//g;p ' '/\.(appex|pluginkit)\/Contents\/Info\.plist$/p' ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END { if(i>1) print n;} ' ' /\.framework$/&&!/\/Contents\// { n++;print;} END { if(n<400) print "/System/";} ' ' { gsub(/[()"]/,"",$3);print $3;} ' ' s/:[^:]+$//;s/ +([0-9]+)(.+)/\2 x\1/p;' 's/Pr.+n //p' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' pluginkit scutil dtrace profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil lsof test osascript\ -e netstat mdls );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'|tr , \\\n" 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$(RefProc): \$Message' -k Sender Req 'fsev|kern|launchd' -k RefProc Rne 'Aq|WebK' -k Message Rne '08012|Goog|ksadm|probe|Roame|SMC:|smcD|sserti|suhel| VALI|ver-r|xpma' -k Message Req 'abn|bad |Beac|caug|corru|dead[^bl]|FAIL|fail|GPU |hfs: Ru|idle ex|inval|jnl:|last value [1-9]|NVDA\(|pagin|pci pa|proc: t|Roamed|rror|SL|TCON|Throttli|tim(ed? ?|ing )o|WARN' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '/S*/*/Ca*/*xpc* >&- ||echo No' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,Ex}* {/,}L*/{A*d,Ca*/*/Ex,Co{mpon,reM},Ex,In{p,ter},iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -path \\*s/Resources -prune -o -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????|wc -l' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' " -F '\$Time \$Message' -k Sender kernel -k Message CSeq 'n Cause: -' " -i '-onlyin / kMDItemContentType=com.apple.framework|sort' -name\ kMDItem${p[35]} '-F \$Message -k Sender kernel -k Message CSeq "I/O e"|sort|uniq -c' '-app Safari UserStyleSheetEnabled' );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents XPC\ cache Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors App\ extensions Lockfiles Memory\ pressure SMC Shutdowns Nets Frameworks I/O errors Stylesheet );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};A'$((7+i))'() { v=` eval sudo "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};';done;A9(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "${s[63]}"<<<"$v"`&&C1 1 $1;};for i in 1 2 7 8;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;B1&&D73 19 53 67 55;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D13 5 58 71 59;D13 5 54 72 56;D23 5 14 12 14;D22 6 36 13 15;D22 20 52 66 54;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D82 35 49 61 51;D82 11 17 17 20;for i in 0 1;do D82 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A8 18 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;B4 4 22 69;A1 24 56 32;B7 22;B2 23;A4 39 57 70 23;B2 24;B6 23 24 4;C3 58;B3 4 0 65;A3 14 6 32 0;B4 0 16 11;A1 26 50 64;B7 16;C3 52;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D73 21 0 32 19;D73 10 42 32 40;D82 29 35 46 39;};D23 14 1 62 42;D12 34 43 53 44;D12 22 20 32 25;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 21 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 38 55 68 57;D23 33 34 42 37;B1&&D83 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 10 42 32 41;D13 37 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 21 59 35 60;D12 21 48 49 49;B3 4 22 57;A1 21 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D12 4 51 32 53;D23 22 9 37 7;A9;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

    Copy the selected text to the Clipboard by pressing the key combination command-C.

    8. Launch the built-in Terminal application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad and start typing the name.

    Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

    9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

    exec bash

    and press return. Then paste the script again.

    10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return  three times at the password prompt. Again, the script will still run.

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

    11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

    [Process completed]

    to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report what happened. No harm will be done.

    12. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

    At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

    13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

    14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

    ______________________________________________________________

    Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.