Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

how to get rid of pop ups flash mall

how to get rid of pop ups flash mall pop up

MacBook Air, OS X Yosemite (10.10.1)

Posted on Jan 13, 2015 12:57 PM

Reply
Question marked as Best reply

Posted on Jan 13, 2015 10:01 PM

There is no need to download anything to solve this problem.

You may have installed the "Crossrider" trojan. Take the steps below to disable it.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with any of the following names:

com.crossrider.wss*.agent.plist

flashmall_updater.plist

flashmall_updater.sh

com.webhelper.plist

com.webtools.update.agent.plist

WebSocketServerApp

Here * stands for a variable six-digit number. Some of these files may be absent. Move any that you have to the Trash and close the Finder window. Log out or restart the computer. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.

3. Do as in Step 1 with this line:

~/Library/Application Support

A folder named "Application Support" will open. Inside it there may be a subfolder with this name:

webHelperApp

If so, move that subfolder—not the "Application Support" folder—to the Trash.

4. Finally, open this folder in the same way as above:

~/Library

Look for a subfolder with this name:

WebTools

and move it to the Trash, if present. Finally, empty the Trash.

137 replies
Question marked as Best reply

Jan 13, 2015 10:01 PM in response to wine4u

There is no need to download anything to solve this problem.

You may have installed the "Crossrider" trojan. Take the steps below to disable it.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with any of the following names:

com.crossrider.wss*.agent.plist

flashmall_updater.plist

flashmall_updater.sh

com.webhelper.plist

com.webtools.update.agent.plist

WebSocketServerApp

Here * stands for a variable six-digit number. Some of these files may be absent. Move any that you have to the Trash and close the Finder window. Log out or restart the computer. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.

3. Do as in Step 1 with this line:

~/Library/Application Support

A folder named "Application Support" will open. Inside it there may be a subfolder with this name:

webHelperApp

If so, move that subfolder—not the "Application Support" folder—to the Trash.

4. Finally, open this folder in the same way as above:

~/Library

Look for a subfolder with this name:

WebTools

and move it to the Trash, if present. Finally, empty the Trash.

Jan 19, 2015 4:43 PM in response to Linc Davis

Hi Linc,

I am running OS 10.8.5. I attempted to do the steps you outlined. First of all after triple clicking to select something, and hitting CMD C, it wouldn't copy. I went to Go go to folder and just typed it in and the file wasn't found. The same happened on all the steps. So then I tried typing it in, and again, none of the files were found. So I don't know what to try now.


I should also add that MacKeeper was somehow installed at the same time as this Flash Mall stuff. It took me a while, but I finally got it to go into the trash, restart, and it disappeared. I had not installed MacKeeper.


Is there anything else I could try to get rid of the Flash Mall? It is very annoying.

Jan 19, 2015 6:03 PM in response to Mick906

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

5. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth SerialATA Extensions Applications Frameworks PrefPane Fonts 1024 85 percent 20480 1 MB/s 25000 ports KiB/s DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH 10 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB 'com.adobe.AAM.Updater-1.0 com.adobe.AAM.Updater-1.0 com.adobe.AdobeCreativeCloud com.adobe.CS4ServiceManager com.adobe.CS5ServiceManager com.adobe.fpsaud com.adobe.SwitchBoard com.adobe.SwitchBoard com.apple.aelwriter com.apple.AirPortBaseStationAgent com.apple.FolderActions.enabled com.apple.installer.osmessagetracing com.apple.mrt.uiagent com.apple.ReportCrash.Self com.apple.rpmuxd com.apple.SafariNotificationAgent com.apple.usbmuxd com.citrixonline.GoToMeeting.G2MUpdate com.google.keystone.agent com.google.keystone.daemon com.microsoft.office.licensing.helper com.oracle.java.Helper-Tool com.oracle.java.JavaUpdateHelper com.oracle.java.JavaUpdateHelper org.macosforge.xquartz.privileged_startx org.macosforge.xquartz.privileged_startx org.macosforge.xquartz.startx' '879294308 4071182229 461455494 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 3694147963 1233118628 2456546649 2806998573 2778718105 2636415542 842973933 2051385900 3301885676 891055588 998894468 695903914 1443423563 4136085286 523110921 2883943871 3873345487' 51 5120 files 4 1000 25 5120 -\\t PlistBuddy{,' 2>&1'}' -c Print' OSBundleRequired 1166 20 ' function f() { n++;sub(/^/,"^");gsub(/\./,"\\.");gsub(/\+/,"\\+");gsub(/\-/,"\\-");gsub(/\?/,"\\?");print|"sort|uniq";};function g(N,d) { if(n<N) print d;};' Info.plist );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=(\\n%s{:\ ,\\n\\n}%s\\n '\nRAM details\n%s\n' %s\ %s '%s\n'"${p[50]}"'%s\n' '%s (UID %s) is using %s %s' '\nContents of %s\n '"${p[50]}"'mod date: %s\n '"${p[50]}"'checksum: %s\n%s\n' '\n ...and %s more line(s)\n' 'RSSI: %s\nNoise: %s\nTx rate: %s\n' {Privacy,Mode}': %s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("'"${f[5]}"'",$0,u,q,"'${p[$2]}'");} ';};s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[46]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[47]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' "${p[56]}"\ ' $0&&!/ /{f()} END{g(10,"^com\.apple\.")} ' ' { sub(/ :/,"");print|"tail -n'${p[48]}'";} ' ' NR==2&&$4<='${p[49]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p;' '/\.kext\/(Contents\/)?'${p[57]}'$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?'${p[57]}'$/p' ' NR>1&&$3!~/0x|\.([0-9]{3,}|[-0-9A-F]{36}|apple\.launchctl\.(Aqua|Background|System))$/ { print $3":"$2;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p ' '/^root$/p' "${p[56]}"\ ' /\.(bundle|component|framework|kext|mdimporter|plugin|qlgenerator|saver|wdgt)$/{f()} END{g(900,"^/System/")} ' ' /\.dylib$/!d;s/(\.|\+|\-|\?)/\\\1/g;s/^/^/p;' "${p[56]}"\ ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");f();} END { split("'"${p[41]}"'",b);split("'"${p[42]}"'",c);for(i in b) print b[i]"\.plist\t"c[i];g(500,"Launch");} ' ' /^\/(Ap|Dev|Inc|Prev)/d;/(ok.+dle|\.(component|mailbundle|mdimporter|plugin|qlgenerator|saver|wdgt))$/p;' 's/Pr.+n //p' ' BEGIN{FS=":"};{ if($1~/\.kext$/) { s=system("'"${p[51]}"'\\ :'${p[53]}' "$1"/*/I*|grep -q Sa");if(!s) $1=$1" S";if(!$2) $2="'"${p[28]}"'";printf("'"${f[4]}"'",$1,$2);} else print;} ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&& $3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' $1=="op" {m=$3};$1~"lN" {N=$2};$1~"lR" {S=$2};$1~"Tx" {T=$2};$1~/^st/ {s=$2};$1~"li"&&$3!~"wpa2" {printf("'"${f[9]}"'",toupper($3))};END { if(S*N*T&&(S-N<'${p[25]}'||T<'${p[55]}')) printf("'"${f[8]}"'",S,N,T);if(s~/^r/&&m!~/^st/) printf("'"${f[10]}"'",m);} ' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p);if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 23`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"cksum "F|getline C;split(C, A);C=A[1];"stat -f%Sm "F|getline D;"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("'"${p[51]}"' "F|getline g) { l++;if(l<=L) f=f"\n "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F"\n '"${p[50]}"'"T;printf("'"${f[6]}"'",F,D,C,f);if(l>L) printf("'"${f[7]}"'",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' { p="'"${p[52]}"'\\ :'"${p[35]}"' \""$0"\"/*/'${p[57]}'";p|getline;close(p);if($0~/ /||$0=="") $0="'"${p[28]}"'";};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?'${p[57]}'$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;' ' s/^.+ |\(.+\)$//g;p ' '/\.(appex|pluginkit)\/Contents\/'${p[57]}'$/p' ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END { if(i>1) print n;} ' ' s/:[^:]+$//;s/ +([0-9]+)(.+)/\2: \1/p;' ' { gsub(/[()"]/,"",$3);if($2!="="||!$3) $3="N/A";print $3;} ' ' /es: ./{ s/^.+://;b0'$'\n'' };/^ +C.+ted: +[NY]/H;/:$/b0'$'\n'' d;:0'$'\n'' x;/: +N/d;s/\n.+//p;' ' 1d;/:$/b0'$'\n'' $b0'$'\n'' /(D|^ *Loc.+): /{ s/^.+: //;H;};/(By|m): /H;d;:0'$'\n'' x;/[my]: [AM]|^\/Vo/d;s/(^|\n) [ -~]+//g;s/(.+)\n(.+)/\2:\1/;s/\n//g;/[ -~]/p;' 's/$/:(0|\-(4[34])?)$/p' ' BEGIN{FS=":"};{ if($2) { $2="status: "$2;printf("'"${f[4]}"'",$1,$2);} else print $1;} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab iotop top pkgutil "${p[52]}\\" whoami cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom 'mdfind -onlyin /' ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' pluginkit scutil dtrace profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil lsof test osascript\ -e netstat mdls kextfind );S1() { printf kMDItemContentTypeTree=com.apple.$1;};S2() { printf 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name '${p[57]}' -exec '"${c1[14]}"' :'$1' {} \;|uniq';};c2=(com.apple.loginwindow\ LoginHook ' /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'|tr , \\\n" "`S2 CFBundleDisplayName`" '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '-F \$Message -k Sender kernel -k Message CReq "a underr|I/O e"|sort|uniq -c' :${p[35]} :Label '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$(RefProc): \$Message' -k Sender Req 'fsev|kern|launchd' -k RefProc Rne 'Aq|WebK' -k Message Rne '08012|Goog|ksadm|probe|Roame|SMC:|smcD|sserti|suhel| VALI|ver-r|xpma' -k Message Req 'abn|bad |Beac|caug|corru|dead[^bl]|FAIL|fail|GPU |hfs: Ru|idle ex|inval|jnl:|last value [1-9]|NVDA\(|pagin|pci pa|proc: t|Roamed|rror|SL|TCON|Throttli|tim(ed? ?|ing )o|WARN' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '/S*/*/Ca*/*xpc* >&- ||echo No' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' "`S1 "{bundle,mach-o-dylib}"`" "`S2 ${p[35]}`" "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -get{dnsservers,info}\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????|wc -l' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' " -F '\$Time \$Message' -k Sender kernel -k Message CSeq 'n Cause: -' " -i '-app Safari UserStyleSheetEnabled' -name\ kMDItem${p[35]} '-nl -print' '-F \$Sender -k Level Nle 3 -k Facility CReq "apple\.(bird|i?clou)"|sort|uniq -c' );N1=${#c2[@]};for j in {0..14};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=({Restricted\ ,Lock,Pro}files POST Battery {Safari,App,{Bad,Loaded}\ kernel}\ extensions Heat System\ load boot\ args FileVault Diagnostic\ reports Log {Free\ space,Swap}' (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports User Daemons Agents XPC\ cache Startup\ items {Admin,Root}\ access Bundles {,Inserted\ }dylibs Stylesheet Font\ issues Firewall Proxies DNS TCP/IP Wi-Fi 'Elapsed time (sec)' {Root,User}\ crontab {Global,User}' login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching Nets Descriptors Bad\ plists {I/O,iCloud}\ errors SMC Shutdowns 'High file counts' Memory\ pressure );N3=${#l[@]};for i in {0..8};do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { Q=5;v[2]=1;id -G|grep -qw 80;v[1]=$?;((v[1]))||{ Q=7;sudo true;v[2]=$?;((v[2]))||Q=8;};v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';printf '[Process started]\n\n'>&4;printf 'Revision: %s\n\n' ${p[54]};};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};A'$((7+i))'() { v=` eval sudo "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};';done;A9(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=No;((v['$((i+1))']==0))&&v=;};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Ev "${v[$1]}"<<<"$v"|sort`;};C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "${s[63]}"<<<"$v"`&&C1 1 $1;};C4() { echo "Part $((++P)) of $Q done at $((`date +%s`-v[3])) sec">&4;};C5() { pbcopy<<<"$o";exit 2>&-;};for i in 1 2 7 8;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;trap C5 2;o=$({ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 22;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 $((N3+4));for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 0 $((N1+8)) 71 $((N3+3));D13 1 10 7 9;D13 1 11 8 10;B1&&D73 19 53 67 55;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;B0&&{ D13 5 5 69 53;D13 5 54 30 56;C4;D23 5 14 12 14;C4;};D22 6 36 13 15;D22 20 52 66 58;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;C4;B1&&{ D82 35 49 61 51;D82 11 17 17 20;for i in 0 1;do D82 28 $((N2+i)) 45 $((N4+i));done;C4;};D22 12 44 54 45;D22 12 39 15 21;D13 40 58 32 7;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;C4;A1 17 41 20;B7 5;C3 8;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B3 7 7 73;B1&&{ A8 18 26 23;B7 7;B4 0 0 74;C3 23;};A2 18 26 23;B7 7;B4 0 0 74;C3 24;D13 4 21 24 26;B4 4 12 26;C4;for i in {0..3};do A1 0 $((N1+10+i)) 72;B7 12;B4 0 0 31;((i))&&{ B2 14;B4 14 15 52;B6 14 15 4;};C3 $((N3+5+i));done;A1 24 22 29;B7 12;B2 14;A4 39 57 70 0;B2 15;B6 14 15 4;C3 29;C4;B3 4 13 27;A1 24 23 32;B7 13;C3 30;B3 4 0 65;A3 14 6 32 0;B4 0 16 11;A1 26 50 64;B7 16;C3 6;D13 25 37 32 31;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D73 21 0 32 19;D73 10 42 32 40;D82 29 35 46 2;};D23 14 1 62 42;D12 34 43 53 44;D12 22 20 32 25;D22 0 $((N1+14)) 51 33;D13 4 8 41 52;D12 21 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 38 55 68 50;D23 33 34 42 37;B1&&D83 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 10 42 32 41;D13 37 2 48 43;A1 4 3 60;B2 30;A1 4 24 60;B2 31;B6 30 31 4;C3 5;D12 21 56 35 32;D12 21 48 49 49;B3 4 22 57;A1 21 46 56;B7 22;B3 0 0 58;C3 47;D13 5 59 69 54;D22 4 4 50 0;D12 4 51 32 1;D23 22 9 37 57;A9;C2 39;C4;} 4>&2 2>/dev/null;);C5

Copy the selected text to the Clipboard by pressing the key combination command-C.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be a series of messages in the Terminal window like this:

[Process started]

Part 1 of 8 done at … sec

Part 8 of 8 done at … sec

[Process completed]

The messages won't be spaced equally apart in time, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

Wait for the final message "Process completed" to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step.

12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

______________________________________________________________

Copyright © 2014, 2015 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Jan 20, 2015 9:57 PM in response to Linc Davis

Start time: 21:51:13 01/20/15



Revision: 1166



Model Identifier: MacBookAir4,1

Memory: 2 GB

System Version: OS X 10.10.1 (14B25)

Kernel Version: Darwin 14.0.0

Time since boot: 12 minutes



USB



USB Keyboard (Logitech Inc.)

USB2.0 MFP(Hi-Speed) (Seiko Epson Corp.)

Targus Wireless Optical Mouse (reserved)



Diagnostic reports



2015-01-13 com.apple.security.pboxd crash



Shutdowns



Jan 19 23:28:20 cause: -60

Jan 20 13:53:14 cause: -60

Jan 20 19:36:20 cause: -60

Jan 20 21:39:28 cause: -60



Log



Jan 20 21:40:55 memorystatus_thread: idle exiting pid 411 [nsurlstoraged]

Jan 20 21:40:56 memorystatus_thread: idle exiting pid 375 [diagnosticd]

Jan 20 21:40:57 memorystatus_thread: idle exiting pid 279 [pbs]

Jan 20 21:40:58 memorystatus_thread: idle exiting pid 423 [iconservicesd]

Jan 20 21:40:58 com.apple.spindump: Service exited with abnormal code: 75

Jan 20 21:40:59 memorystatus_thread: idle exiting pid 421 [iconservicesagen]

Jan 20 21:41:00 memorystatus_thread: idle exiting pid 429 [com.apple.iTunes]

Jan 20 21:41:01 memorystatus_thread: idle exiting pid 428 [QuickLookSatelli]

Jan 20 21:41:02 memorystatus_thread: idle exiting pid 419 [QuickLookSatelli]

Jan 20 21:41:03 memorystatus_thread: idle exiting pid 222 [bird]

Jan 20 21:41:04 memorystatus_thread: idle exiting pid 446 [IMDPersistenceAg]

Jan 20 21:41:05 memorystatus_thread: idle exiting pid 445 [IMDMessageServic]

Jan 20 21:41:06 memorystatus_thread: idle exiting pid 220 [tccd]

Jan 20 21:41:07 memorystatus_thread: idle exiting pid 437 [deleted]

Jan 20 21:41:08 memorystatus_thread: idle exiting pid 468 [secinitd]

Jan 20 21:41:08 com.apple.spindump: Service exited with abnormal code: 75

Jan 20 21:41:09 memorystatus_thread: idle exiting pid 471 [DataDetectorsDyn]

Jan 20 21:41:10 memorystatus_thread: idle exiting pid 467 [soagent]

Jan 20 21:41:11 memorystatus_thread: idle exiting pid 478 [nsurlstoraged]

Jan 20 21:41:12 memorystatus_thread: idle exiting pid 486 [nsurlstoraged]

Jan 20 21:41:13 memorystatus_thread: idle exiting pid 179 [com.apple.CodeSi]

Jan 20 21:41:14 memorystatus_thread: idle exiting pid 79 [cfprefsd]

Jan 20 21:41:15 memorystatus_thread: idle exiting pid 192 [cfprefsd]

Jan 20 21:41:16 memorystatus_thread: idle exiting pid 41 [coreduetd]

Jan 20 21:41:18 com.apple.spindump: Service exited with abnormal code: 75



Memory pressure: WARN



I/O per process: coresymbolicati (UID 0) is using 4 MB/s



Daemons



com.adobe.fpsaud

com.apple.installer.osmessagetracing

com.apple.spindump

- status: 75



Agents



com.apple.AirPortBaseStationAgent

com.apple.photostream-agent

com.citrixonline.GoToMeeting.G2MUpdate

com.coupons.coupond

com.crossrider.wss002498.agent.plist

com.facebook.videochat.NAME.updater

- status: 1

com.flashmall.updater

com.genieo.completer.download

com.genieo.completer.ltvbit

com.genieo.completer.update

com.google.keystone.user.agent

com.webhelper

com.webtools.update.agent



Extensions



/System/Library/Extensions/JMicronATA.kext

- com.jmicron.JMicronATA



Applications



/Applications/Design&Print.app

- DesktopDPOUUID

/Applications/Garmin Express.app

- com.garmin.renu.client

/Applications/GoToMeeting (1350).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1440).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1468).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1555).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1558).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1669).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1694).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1767).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1796).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1831).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1848).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1865).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1960).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (1963).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (2031).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (2033).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (2128).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (2130).app

- com.citrixonline.GoToMeeting

/Applications/GoToMeeting (2152).app

- com.citrixonline.GoToMeeting

/Applications/Google Chrome.app

- com.google.Chrome

/Applications/InstallMac/Reset Search.app

- com.somoto.InstallerS

/Applications/JDownloader.app

- com.install4j.5513-1208-7298-9440.26

/Applications/Skype.app

- com.skype.skype

/Applications/Utilities/Adobe Flash Player Install Manager.app

- com.adobe.flashplayer.installmanager

/Library/Application Support/Coupons/Uninstall Coupon Printing Software.app

- com.coupons.uninstaller

/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app

- com.apple.ScriptEditor.id.cocoa-applet-template

/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app

- com.apple.ScriptEditor.id.droplet-with-settable-properties-template

/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app

- com.apple.ScriptEditor.id.file-processing-droplet-template

/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app

- com.apple.ScriptEditor.id.image-file-processing-droplet-template

/Library/Image Capture/Devices/Canon IJScanner2.app

- jp.co.canon.ijscanner2.scanner.ica

/Library/Image Capture/Devices/Canon IJScanner4.app

- jp.co.canon.ij.ica.scanner4

/Library/Image Capture/Devices/EPSON Scanner.app

- com.epson.scanner.ica

/Library/Printers/EPSON/InkjetPrinter2/AutoSetupTool/EPIJAutoSetupTool2.app

- com.epson.ijprinter.EPIJAutoSetupTool2

/Library/Printers/EPSON/InkjetPrinter2/Filter/commandtoescp.app

- com.epson.ijprinter.commandtoescp

/Library/Printers/EPSON/InkjetPrinter2/Filter/pdftopdf2.app

- com.epson.ijprinter.pdftopdf2

/Library/Printers/EPSON/InkjetPrinter2/Filter/rastertoescpII.app

- com.epson.ijprinter.rastertoescpII

/Library/Printers/EPSON/InkjetPrinter2/Utility/UT4/Epson Printer Utility 4.app

- com.epson.ijprinter.EpsonPrinterUtility4

/Library/Printers/EPSON/InkjetPrinter2/Utility/UTL/Epson Printer Utility Lite.app

- com.epson.ijprinter.EpsonPrinterUtilityLite

/Users/USER/Downloads/Citrix Online Launcher.app

- com.citrixonline.mac.WebDeploymentApp

/Users/USER/Downloads/DesignPrint-1.5.0.app

- com.bitrock.appinstaller

/Users/USER/Downloads/MagTool.app

- com.iForgotSystems.MagTool

/Users/USER/Downloads/Support-LogMeInRescue 2.app

- com.logmein.Rescue

/Users/USER/Library/Application Support/Facebook/video/3.1.0.522/FacebookVideoCalling.app

- com.Skype.FacebookVideoCalling

/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_aohghmighlieiainnegkcijnfilokake/Default aohghmighlieiainnegkcijnfilokake.app

- com.google.Chrome.app.Default-aohghmighlieiainnegkcijnfilokake-internal

/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_bepbmhgboaologfdajaanbcjmnhjmhfn/Default bepbmhgboaologfdajaanbcjmnhjmhfn.app

- com.google.Chrome.app.Default-bepbmhgboaologfdajaanbcjmnhjmhfn-internal

/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app

- com.somoto.InstallerS



Frameworks



- N/A



PrefPane



/Library/PreferencePanes/Flash Player.prefPane

- com.adobe.flashplayerpreferences



Bundles



/Library/Internet Plug-Ins/CouponPrinter-FireFox_v2.plugin

- com.coupons.plugin.mozilla-plugin

/Library/Internet Plug-Ins/Flash Player.plugin

- com.macromedia.Flash

/Library/Internet Plug-Ins/GarminGpsControl.plugin

- com.garmin.GarminGpsControl

/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkIOM.plugin

- jp.co.Canon.ij.print.iom.CIJNP

/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkPBM.plugin

- jp.co.Canon.ij.print.pbm.CIJNP

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBIOM.plugin

- jp.co.canon.bj.print.bjusbiom

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBPBM.plugin

- jp.co.canon.bj.print.pbm.USB

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver.plugin

- jp.co.canon.ij.print.CIJUSBClassDriver

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver2.plugin

- jp.co.canon.ij.print.CIJUSBClassDriver2

/Library/Printers/Canon/BJPrinter/Plugins/IJBluetooth/IJBluetoothIOM.plugin

- jp.co.canon.ij.print.ijbluetoothiom

/Library/Printers/Canon/IJScanner/Plugins/ag07_09.plugin

- jp.co.canon.scangear.ag07.09

/Library/Printers/Canon/IJScanner/Plugins/ag08_09.plugin

- jp.co.canon.scangear.ag08.09

/Library/Printers/Canon/IJScanner/Plugins/cncl09_09.plugin

- jp.co.canon.scangear.lld09.09

/Library/Printers/Canon/IJScanner/Plugins/cnq2413_09.plugin

- jp.co.canon.scanner.cnq2413.09

/Library/Printers/Canon/IJScanner/Plugins/cnq2414_09.plugin

- jp.co.canon.scanner.cnq2414.09

/Library/Printers/Canon/IJScanner/Plugins/cnq4807_09.plugin

- jp.co.canon.scanner.cnq4807.09

/Library/Printers/Canon/IJScanner/Plugins/cnq4808_09.plugin

- jp.co.canon.scanner.cnq4808.09

/Library/Printers/Canon/IJScanner/Plugins/cnq4809_09.plugin

- jp.co.canon.scanner.cnq4809.09

/Library/Printers/Canon/IJScanner/Plugins/cnq9601_09.plugin

- jp.co.canon.scanner.cnq9601.09

/Library/Printers/Canon/IJScanner/Plugins/ijfshlib_09.plugin

- jp.co.canon.scangear.ijfshlib.09

/Library/Printers/Canon/IJScanner/Plugins/mld07_09.plugin

- jp.co.canon.scangear.mld07.09

/Library/Printers/Canon/IJScanner/Plugins/mld08_09.plugin

- jp.co.canon.scangear.mld08.09

/Library/Printers/Canon/IJScanner/Plugins/mld09_09.plugin

- jp.co.canon.scangear.mld09.09

/Library/Printers/Canon/IJScanner/Plugins/mld9601_09.plugin

- jp.co.canon.scangear.mld9601.09

/Library/Printers/Canon/IJScanner/Plugins/sfusb_09.plugin

- jp.co.canon.sf.scanner.sfusb.09

/Library/Printers/Canon/IJScanner/Plugins/sgusb_09.plugin

- jp.co.canon.scangear.usb.09

/Library/Printers/Canon/IJScanner/Plugins/smac_09.plugin

- jp.co.canon.scangear.smac.09

/Library/Printers/Canon/IJScanner/Plugins/zoom_09.plugin

- jp.co.canon.scangear.zoom.09

/Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle

- com.skype.skypeabdialer

/Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle

- com.skype.skypeabsms

/Users/USER/Library/Application Support/Google/Chrome/PepperFlash/12.0.0.70/PepperFlashPlayer.plugin

- com.macromedia.PepperFlashPlayer.pepper

/Users/USER/Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin

- com.citrixonline.mac.WebDeploymentPlugin



dylibs



/Users/USER/Library/Application Support/Google/Chrome/WidevineCDM/1.4.6.703/_platform_specific/mac_x64/libwidev inecdm.dylib



Contents of /Library/LaunchAgents/com.coupons.coupond.plist

- mod date: Oct 16 13:23:40 2014

- checksum: 371175040



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.coupons.coupond</string>

<key>Debug</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Coupons/coupond</string>

<string>launchd</string>

</array>

<key>Sockets</key>

<dict>

<key>SecondaryListeningSocket</key>

<dict>

<key>SockServiceName</key>

<string>26876</string>

<key>SockNodeName</key>

<string>localhost</string>

<key>SockFamily</key>

<string>IPv4</string>

</dict>

<key>PrimaryListeningSocket</key>



...and 11 more line(s)



Contents of Library/LaunchAgents/com.crossrider.wss002498.agent.plist

- mod date: Jan 17 19:56:51 2015

- checksum: 711170777



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.crossrider.wss002498.agent.plist</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/LaunchAgents/WebSocketServerApp</string>

<string>cmpId=2498</string>

<string>ibic=UUID</string>

<string>verifier=UUID</string>

<string>extId=67619</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>



Contents of Library/LaunchAgents/com.facebook.videochat.NAME.plist

- mod date: Aug 8 21:30:37 2014

- checksum: 3225313511



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.facebook.videochat.NAME.updater</string>

<key>ProgramArguments</key>

<array>

<string>/usr/bin/java</string>

<string>-cp</string>

<string>/Users/USER/Library/Application Support/Facebook/video/3.1.0.522/FacebookUpdate.jar</string>

<string>FacebookUpdate</string>

<string>com.facebook.peep</string>

<string>3.1.0.522</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<integer>10800</integer>

<key>StandardErrorPath</key>

<string>/dev/null</string>

<key>StandardOutPath</key>

<string>/dev/null</string>

</dict>

</plist>



Contents of Library/LaunchAgents/com.genieo.completer.download.plist

- mod date: Jan 9 20:05:45 2015

- checksum: 4246280172



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.genieo.completer.download</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/InstallerS< /string>

<string>-trigger</string>

<string>download</string>

<string>-isDev</string>

<string>0</string>

<string>-installVersion</string>

<string>17046</string>

<string>-firstAppId</string>

<string>97963554</string>

</array>

<key>WatchPaths</key>

<array>

<string>/Users/USER/Downloads</string>

</array>

</dict>

</plist>



Contents of Library/LaunchAgents/com.genieo.completer.ltvbit.plist

- mod date: Jan 9 20:05:45 2015

- checksum: 190735042



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.genieo.completer.ltvbit</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/InstallerS< /string>

<string>-trigger</string>

<string>ltvbit</string>

<string>-isDev</string>

<string>0</string>

<string>-installVersion</string>

<string>17046</string>

<string>-firstAppId</string>

<string>97963554</string>

</array>

<key>StartCalendarInterval</key>

<dict>

<key>Hour</key>

<integer>4</integer>

<key>Minute</key>

<integer>47</integer>

</dict>



...and 2 more line(s)



Contents of Library/LaunchAgents/com.genieo.completer.update.plist

- mod date: Jan 9 20:05:45 2015

- checksum: 3729778754



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.genieo.completer.update</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/InstallerS< /string>

<string>-trigger</string>

<string>update</string>

<string>-isDev</string>

<string>0</string>

<string>-installVersion</string>

<string>17046</string>

<string>-firstAppId</string>

<string>97963554</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartCalendarInterval</key>

<dict>

<key>Hour</key>

<integer>20</integer>

<key>Minute</key>



...and 4 more line(s)



Contents of Library/LaunchAgents/com.google.keystone.agent.plist

- mod date: Dec 5 00:46:16 2014

- checksum: 849423004



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.google.keystone.user.agent</string>

<key>LimitLoadToSessionType</key>

<string>Aqua</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<integer>3523</integer>

<key>StandardErrorPath</key>

<string>/dev/null</string>

<key>StandardOutPath</key>

<string>/dev/null</string>

</dict>

</plist>



Contents of Library/LaunchAgents/com.webhelper.plist

- mod date: Jan 17 19:56:57 2015

- checksum: 3894936944



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.webhelper</string>

<key>EnableGlobbing</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/webHelperApp/launch</string>

<string>-guid</string>

<string>UUID</string>

<string>-source</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>OnDemand</key>

<true/>

<key>StandardErrorPath</key>

<string>/dev/null</string>

<key>StandardOutPath</key>

<string>/dev/null</string>



...and 4 more line(s)



Contents of Library/LaunchAgents/com.webtools.update.agent.plist

- mod date: Jan 17 19:56:57 2015

- checksum: 71484624



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>EnableGlobbing</key>

<true/>

<key>Label</key>

<string>com.webtools.update.agent</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/WebTools/UpdateAgent/run_update.sh</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<integer>3600</integer>

</dict>

</plist>



Contents of Library/LaunchAgents/flashmall_updater.plist

- Apple binary property list

- mod date: Jan 17 19:54:20 2015

- checksum: 1728710255



Dict {

StartInterval = 86400

ProgramArguments = Array {

bash

/Users/USER/Library/LaunchAgents/flashmall_updater.sh

}

Label = com.flashmall.updater

}



Bad plists



/Library/Preferences/com.gen.framework.plist



DNS: 75.75.75.75



User login items



Garmin Express Service

- /Applications/Garmin Express.app/Contents/Library/LoginItems/Garmin Express Service.app

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app



Safari extensions



Omnibar

- com.genieo.safari



iCloud errors



Automator: 6

bird: 288

storedownloadd: 6



Restricted files: 244



Lockfiles: 1



Elapsed time (sec): 354

Jan 24, 2015 5:58 AM in response to Linc Davis

Start time: 08:50:03 01/24/15



Revision: 1166



Model Identifier: MacBookPro9,2

System Version: OS X 10.9.4 (13E28)

Kernel Version: Darwin 13.3.0

Time since boot: 29 minutes



System load



combined level = Bad

- battery level = Bad



Diagnostic reports



2015-01-07 Mail hang



Log



Jan 24 08:45:41 com.flashmall.enabler: Throttling respawn: Will start in 7 seconds

Jan 24 08:45:51 com.flashmall.enabler: Throttling respawn: Will start in 8 seconds

Jan 24 08:46:01 com.flashmall.enabler: Throttling respawn: Will start in 8 seconds

Jan 24 08:46:11 com.flashmall.enabler: Throttling respawn: Will start in 9 seconds

Jan 24 08:46:21 com.flashmall.enabler: Throttling respawn: Will start in 9 seconds

Jan 24 08:46:31 com.flashmall.enabler: Throttling respawn: Will start in 10 seconds

Jan 24 08:46:51 com.flashmall.enabler: Throttling respawn: Will start in 1 seconds

Jan 24 08:47:01 com.flashmall.enabler: Throttling respawn: Will start in 2 seconds

Jan 24 08:47:11 com.flashmall.enabler: Throttling respawn: Will start in 3 seconds

Jan 24 08:47:21 com.flashmall.enabler: Throttling respawn: Will start in 4 seconds

Jan 24 08:47:31 com.flashmall.enabler: Throttling respawn: Will start in 4 seconds

Jan 24 08:47:41 com.flashmall.enabler: Throttling respawn: Will start in 5 seconds

Jan 24 08:47:51 com.flashmall.enabler: Throttling respawn: Will start in 6 seconds

Jan 24 08:48:01 com.flashmall.enabler: Throttling respawn: Will start in 6 seconds

Jan 24 08:48:11 com.flashmall.enabler: Throttling respawn: Will start in 7 seconds

Jan 24 08:48:21 com.flashmall.enabler: Throttling respawn: Will start in 8 seconds

Jan 24 08:48:31 com.flashmall.enabler: Throttling respawn: Will start in 9 seconds

Jan 24 08:48:41 com.flashmall.enabler: Throttling respawn: Will start in 10 seconds

Jan 24 08:49:01 com.flashmall.enabler: Throttling respawn: Will start in 1 seconds

Jan 24 08:49:11 com.flashmall.enabler: Throttling respawn: Will start in 2 seconds

Jan 24 08:49:21 com.flashmall.enabler: Throttling respawn: Will start in 3 seconds

Jan 24 08:49:31 com.flashmall.enabler: Throttling respawn: Will start in 4 seconds

Jan 24 08:49:41 com.flashmall.enabler: Throttling respawn: Will start in 5 seconds

Jan 24 08:49:51 com.flashmall.enabler: Throttling respawn: Will start in 6 seconds

Jan 24 08:50:01 com.flashmall.enabler: Throttling respawn: Will start in 7 seconds



Activity



CPU: user 24%, system 5%



I/O per process: bash (UID 501) is using 4 MB/s



Daemons



com.adobe.fpsaud

com.apple.launchd.peruser.0

com.apple.launchd.peruser.55

com.apple.launchd.peruser.89

- status: -

com.apple.launchd.peruser.92

com.microsoft.office.licensing.helper



Agents



com.apple.AirPortBaseStationAgent

com.apple.photostream-agent

- status: -

com.crossrider.wss002499.agent.plist

- status: -

com.flashmall.enabler

- status: 5

com.flashmall.updater

com.genieo.completer.download

com.genieo.completer.ltvbit

com.genieo.completer.update

- status: -

com.jdibackup.ZipCloud.autostart

- status: 1

com.jdibackup.ZipCloud.notify

- status: 1

com.webhelper

- status: -

com.webtools.update.agent

com.zeobit.MacKeeper.Helper

- status: 2



Applications



/Applications/Microsoft Communicator.app

- com.microsoft.Communicator

/Applications/Microsoft Messenger.app

- com.microsoft.Messenger

/Applications/Microsoft Office 2011/Additional Tools/Microsoft Language Register/Microsoft Language Register.app

- com.microsoft.language_register

/Applications/Microsoft Office 2011/Microsoft Document Connection.app

- com.microsoft.DocumentConnection

/Applications/Microsoft Office 2011/Microsoft Excel.app

- com.microsoft.Excel

/Applications/Microsoft Office 2011/Microsoft Outlook.app

- com.microsoft.Outlook

/Applications/Microsoft Office 2011/Microsoft PowerPoint.app

- com.microsoft.Powerpoint

/Applications/Microsoft Office 2011/Microsoft Word.app

- com.microsoft.Word

/Applications/Microsoft Office 2011/Office/Alerts Daemon.app

- com.microsoft.AlertsDaemon

/Applications/Microsoft Office 2011/Office/Equation Editor.app

- com.microsoft.EquationEditor

/Applications/Microsoft Office 2011/Office/Microsoft Chart Converter.app

- com.microsoft.openxml.chart.app

/Applications/Microsoft Office 2011/Office/Microsoft Clip Gallery.app

- com.microsoft.ClipGallery

/Applications/Microsoft Office 2011/Office/Microsoft Database Daemon.app

- com.microsoft.outlook.database_daemon

/Applications/Microsoft Office 2011/Office/Microsoft Database Utility.app

- com.microsoft.outlook.database_utility

/Applications/Microsoft Office 2011/Office/Microsoft Graph.app

- com.microsoft.Graph

/Applications/Microsoft Office 2011/Office/Microsoft Office Reminders.app

- com.microsoft.outlook.office_reminders

/Applications/Microsoft Office 2011/Office/Microsoft Office Setup Assistant.app

- com.microsoft.office.setupassistant

/Applications/Microsoft Office 2011/Office/Microsoft Query

- N/A

/Applications/Microsoft Office 2011/Office/Microsoft Upload Center.app

- com.microsoft.office.uploadcenter

/Applications/Microsoft Office 2011/Office/My Day.app

- com.microsoft.myday

/Applications/Microsoft Office 2011/Office/Open XML for Excel.app

- com.microsoft.openxml.excel.app

/Applications/Microsoft Office 2011/Office/SyncServicesAgent.app

- com.microsoft.SyncServicesAgent

/Applications/Remote Desktop Connection.app

- com.microsoft.rdc

/Applications/Utilities/Adobe Flash Player Install Manager.app

- com.adobe.flashplayer.installmanager

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app

- com.microsoft.autoupdate2

/Library/Application Support/Microsoft/MERP2.0/Microsoft Error Reporting.app

- com.microsoft.error_reporting

/Library/Application Support/Microsoft/MERP2.0/Microsoft Ship Asserts.app

- com.microsoft.netlib.shipassertprocess

/Library/Application Support/Microsoft/Silverlight/OutOfBrowser/SLLauncher.app

- com.microsoft.silverlight.sllauncher

/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app

- com.apple.ScriptEditor.id.cocoa-applet-template

/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app

- com.apple.ScriptEditor.id.droplet-with-settable-properties-template

/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app

- com.apple.ScriptEditor.id.file-processing-droplet-template

/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app

- com.apple.ScriptEditor.id.image-file-processing-droplet-template

/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app

- com.genieoinnovation.Installer



Frameworks



- N/A



PrefPane



/Library/PreferencePanes/Flash Player.prefPane

- com.adobe.flashplayerpreferences



Bundles



/Library/Internet Plug-Ins/Flash Player.plugin

- com.macromedia.Flash

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

- com.microsoft.sharepoint.browserplugin

/Library/Internet Plug-Ins/Silverlight.plugin

- com.microsoft.SilverlightPlugin

/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkIOM.plugin

- jp.co.Canon.ij.print.iom.CIJNP

/Library/Printers/Canon/BJPrinter/Plugins/BJNP/CIJNetworkPBM.plugin

- jp.co.Canon.ij.print.pbm.CIJNP

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBIOM.plugin

- jp.co.canon.bj.print.bjusbiom

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/BJUSBPBM.plugin

- jp.co.canon.bj.print.pbm.USB

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver.plugin

- jp.co.canon.ij.print.CIJUSBClassDriver

/Library/Printers/Canon/BJPrinter/Plugins/BJUSB/CIJUSBClassDriver2.plugin

- jp.co.canon.ij.print.CIJUSBClassDriver2

/Library/Printers/Canon/BJPrinter/Plugins/IJBluetooth/IJBluetoothIOM.plugin

- jp.co.canon.ij.print.ijbluetoothiom

/Users/USER/Library/Application Support/MacKeeper Helper/NoticeEngine.plugin

- com.zeobit.MacKeeper.plugin.NoticeEngine



dylibs



/Applications/Microsoft Office 2011/Office/MicrosoftSetupUI.framework/Libraries/mbupgx.dylib

/Applications/Microsoft Office 2011/Office/OPF.framework/Versions/14/Resources/OPF_Common.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/Fm20.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/MicrosoftOLE2TypesLib.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RefEdit.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RichEdit.dylib



Contents of Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist

- mod date: Dec 24 22:02:01 2013

- checksum: 2813489753



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/System/Library/Frameworks/AddressBook.framework/Resources/AddressBookS ourceSyncScheduleHelper</string>

<string>-scheduleSync</string>

<string>UUID</string>

</array>

<key>StartInterval</key>

<integer>120000</integer>

</dict>

</plist>



Contents of Library/LaunchAgents/com.crossrider.wss002499.agent.plist

- mod date: Jan 12 17:19:32 2015

- checksum: 1857680244



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.crossrider.wss002499.agent.plist</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/LaunchAgents/WebSocketServerApp</string>

<string>cmpId=2499</string>

<string>ibic=UUID</string>

<string>verifier=UUID</string>

<string>extId=67619</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>



Contents of Library/LaunchAgents/com.genieo.completer.download.plist

- mod date: Jan 12 17:19:40 2015

- checksum: 1204726108



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.genieo.completer.download</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>

<string>-trigger</string>

<string>download</string>

<string>-isDev</string>

<string>0</string>

<string>-installVersion</string>

<string>17046</string>

<string>-firstAppId</string>

<string>544680028</string>

</array>

<key>WatchPaths</key>

<array>

<string>/Users/USER/Downloads</string>

</array>

</dict>

</plist>



Contents of Library/LaunchAgents/com.genieo.completer.ltvbit.plist

- mod date: Jan 12 17:19:40 2015

- checksum: 3467800756



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.genieo.completer.ltvbit</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>

<string>-trigger</string>

<string>ltvbit</string>

<string>-isDev</string>

<string>0</string>

<string>-installVersion</string>

<string>17046</string>

<string>-firstAppId</string>

<string>544680028</string>

</array>

<key>StartCalendarInterval</key>

<dict>

<key>Hour</key>

<integer>4</integer>

<key>Minute</key>

<integer>49</integer>

</dict>



...and 2 more line(s)



Contents of Library/LaunchAgents/com.genieo.completer.update.plist

- mod date: Jan 12 17:19:40 2015

- checksum: 3427018206



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.genieo.completer.update</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/MacOS/Installer</ string>

<string>-trigger</string>

<string>update</string>

<string>-isDev</string>

<string>0</string>

<string>-installVersion</string>

<string>17046</string>

<string>-firstAppId</string>

<string>544680028</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartCalendarInterval</key>

<dict>

<key>Hour</key>

<integer>17</integer>

<key>Minute</key>



...and 4 more line(s)



Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist

- mod date: Jan 12 19:06:15 2015

- checksum: 1743767591



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.autostart</string>

<key>ProgramArguments</key>

<array>

<string>open</string>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

<string>-n</string>

<string>--args</string>

<string>9</string>

<string>-l</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>



Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist

- mod date: Jan 12 19:06:15 2015

- checksum: 3094544410



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.notify</string>

<key>ProgramArguments</key>

<array>

<string>open</string>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

<string>--args</string>

<string>7</string>

<string>1</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>StartInterval</key>

<integer>1200</integer>

<key>RunAtLoad</key>

<false/>

</dict>

</plist>



Contents of Library/LaunchAgents/com.webhelper.plist

- mod date: Jan 12 17:19:37 2015

- checksum: 3699927138



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Label</key>

<string>com.webhelper</string>

<key>EnableGlobbing</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/webHelperApp/launch</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>OnDemand</key>

<true/>

<key>StandardErrorPath</key>

<string>/dev/null</string>

<key>StandardOutPath</key>

<string>/dev/null</string>

<key>ThrottleInterval</key>

<integer>10</integer>

</dict>



...and 1 more line(s)



Contents of Library/LaunchAgents/com.webtools.update.agent.plist

- mod date: Jan 12 17:19:37 2015

- checksum: 813197096



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>EnableGlobbing</key>

<true/>

<key>Label</key>

<string>com.webtools.update.agent</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/WebTools/UpdateAgent/run_update.sh</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<integer>3600</integer>

</dict>

</plist>



Contents of Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist

- mod date: Jan 12 17:09:20 2015

- checksum: 538894142



<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Disabled</key>

<false/>

<key>EnvironmentVariables</key>

<dict>

<key>ZBTimeStamp</key>

<string>20141211123146</string>

</dict>

<key>Label</key>

<string>com.zeobit.MacKeeper.Helper</string>

<key>LimitLoadToSessionType</key>

<string>Aqua</string>

<key>OnDemand</key>

<false/>

<key>Program</key>

<string>/Applications/MacKeeper.app/Contents/Resources/MacKeeper Helper.app/Contents/MacOS/MacKeeper Helper</string>

</dict>

</plist>



Contents of Library/LaunchAgents/flashmall_enabler.plist

- Apple binary property list

- mod date: Jan 12 17:19:27 2015

- checksum: 3262511565



Dict {

StartInterval = 10

ProgramArguments = Array {

bash

/Users/USER/Library/LaunchAgents/flashmall_enabler.sh

}

Label = com.flashmall.enabler

}



Contents of Library/LaunchAgents/flashmall_updater.plist

- Apple binary property list

- mod date: Jan 12 17:19:27 2015

- checksum: 3105339505



Dict {

StartInterval = 86400

ProgramArguments = Array {

bash

/Users/USER/Library/LaunchAgents/flashmall_updater.sh

}

Label = com.flashmall.updater

}



Font issues: 21



User login items



iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

BitTorrent

- missing value



Restricted files: 684



Lockfiles: 31



Elapsed time (sec): 226

how to get rid of pop ups flash mall

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.