What is FlashMail? How do I remove it from my Mac?

Question

raegan_reann Author

Level 1

0 points

What is FlashMail? How do I remove it from my Mac?

This ad keeps popping up in my safari. I am not sure how to make it go away. Help. PLEASE!

MacBook Air (11-inch, Early 2014), iOS 8

Posted on Jan 20, 2015 6:10 PM

Reply

Answer 1

Lanzerm1

Level 1

0 points

Mar 31, 2015 10:10 PM in response to raegan_reann

Linc, you saved my Mac... And me some $$ by not having to take it to the local computer shop as Hubby wanted to do! Thank you!! 🙂

Reply

Answer 2

kapbrown

Level 1

8 points

Apr 11, 2015 1:14 PM in response to Linc Davis

I am going crazy with this too. I've tried the steps you posted in January, but as expected it did not work... maybe too much time has passed. I have run the test you suggested above and here are the results. I could REALLY use some help. Thank you!

Start time: 13:01:02 04/11/15

Revision: 1296

Model Identifier: MacBookPro6,2

System Version: OS X 10.10.2 (14C1514)

Kernel Version: Darwin 14.1.0

Time since boot: 15 minutes

UID: 501

SerialATA

TOSHIBA MK5055GSXF

- S.M.A.R.T. status: Not Supported

USB

Fitbit Base Station (Fitbit Inc.)

I/O wait time (ms/s)

mds (UID 0): 828

System errors (per sec)

firefox (UID 501, error 35): 315

plugin-containe (UID 501, error 35): 311

Fitbit Connect (UID 501, error 3): 105

plugin-containe (UID 501, error 316): 102

Energy (lifetime)

firefox (UID 501): 16.69

kernel_task (UID 0): 13.05

plugin-container (UID 501): 8.49

Terminal (UID 501): 6.48

WindowServer (UID 88): 6.34

Energy (sampled)

kernel_task (UID 0): 12.90

plugin-container (UID 501): 6.63

firefox (UID 501): 6.18

Firewall: On

DNS: 75.75.75.75

Listeners

cupsd: ipp

kdc: kerberos

launchd: afpovertcp

launchd: microsoft-ds

Diagnostic reports

2015-03-21 Notes crash

2015-04-01 Adobe Flash Player Install Manager crash

2015-04-06 com.apple.iCal.CalendarNC crash

2015-04-08 Messages crash

2015-04-10 Google Drive crash

2015-04-10 Maps hang

2015-04-10 plugin-container crash

2015-04-11 LegacyFileVaultMessageTracer crash

2015-04-11 launch crash x20

HID errors: 35

Shutdown codes

-62 2

Kernel log

Apr 5 07:40:33 firefox (map: 0xffffff8026a88b40) triggered DYLD shared region unnest for map: 0xffffff8026a88b40, region 0x7fff8f800000->0x7fff8fa00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 5 07:47:05 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 5 08:15:57 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 7 18:47:11 IOAudioStream[0xffffff8026a61600]::clipIfNecessary() - Error: counted 1 clip more than one buffer ahead errors.

Apr 8 08:34:27 Failed to open the file

Apr 8 09:17:56 firefox (map: 0xffffff8023e0fa50) triggered DYLD shared region unnest for map: 0xffffff8023e0fa50, region 0x7fff8f800000->0x7fff8fa00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 8 09:17:59 firefox (map: 0xffffff80234df780) triggered DYLD shared region unnest for map: 0xffffff80234df780, region 0x7fff8f800000->0x7fff8fa00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 8 21:45:01 Limiting closed port RST response from 306 to 250 packets per second

Apr 8 21:49:37 PM notification timeout (pid 228, SystemUIServer)

Apr 10 11:29:47 PM notification timeout (pid 228, SystemUIServer)

Apr 10 11:30:17 PM notification timeout (pid 228, SystemUIServer)

Apr 10 12:08:15 firefox (map: 0xffffff80294f94b0) triggered DYLD shared region unnest for map: 0xffffff80294f94b0, region 0x7fff91c00000->0x7fff91e00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 14:38:39 IOAudioStream[0xffffff802cf92000]::clipIfNecessary() - Error: counted 1 clip more than one buffer ahead errors.

Apr 10 16:29:10 Failed to open swap file 30

Apr 10 16:29:10 vm_swap_create_file failed @ 25 secs

Apr 10 17:27:12 firefox (map: 0xffffff801eeb2a50) triggered DYLD shared region unnest for map: 0xffffff801eeb2a50, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 17:27:20 GGoooogglle eC hChroromem e HHee ((mmaapp:: 0x0xUUID)a 0tr)i tgrigggeerreedd D DYYLLDD sshhaarreed dr reeggiioon n uunnnneestst f foorr mamap:p: 00xGoofffxglfffff8f01e Chromff6fbe Hff580a10,e e(m8ap18: re7gi8o00xfn ff, r0xeff7ff8ffgi95o0n010 4fa002b000-x40>) 7f0xftrig7fgered DYLD ff9shf95ar52000000000ed->00x r07egf.io fn funWnehilst9 fe5 n2oor0 mt apab:n0 or00ma00xfffl . foffr Wf8014dhifaebl2**40,ggeer r se, tginhooisn 0x itnc 7fffraeab9ns50o00000->erm0xals f7fsyff95200000. While nsorot dte am ebmuegmgoerrys ,f btoonormal for debughigetrsp, rinthsis incret uasiesnc system memory frnootpretilinast e tuns tihel s tthare target exits.gye

Apr 10 18:11:23 firefox (map: 0xffffff801eeb2c30) triggered DYLD shared region unnest for map: 0xffffff801eeb2c30, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 20:24:36 OSUnserializeXML: syntax error near line 6

Apr 10 20:42:45 firefox (map: 0xffffff8014fa20f0) triggered DYLD shared region unnest for map: 0xffffff8014fa20f0, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 21:00:25 firefox (map: 0xffffff801e818c30) triggered DYLD shared region unnest for map: 0xffffff801e818c30, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 10:21:36 firefox (map: 0xffffff8012c1e780) triggered DYLD shared region unnest for map: 0xffffff8012c1e780, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 12:50:30 firefox (map: 0xffffff80328fc870) triggered DYLD shared region unnest for map: 0xffffff80328fc870, region 0x7fff91e00000->0x7fff92000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 13:01:21 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

System log

Apr 11 12:50:15 mapspushd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:15 maspushagent: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:15 fmfd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:16 com.apple.photostream-agent: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:16 mapspushd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:17 maspushagent: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:17 fmfd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:17 com.apple.photostream-agent: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:17 cloudd: Stream 0x7fd6adc00a40 is sending an event before being opened

Apr 11 12:50:17 bird: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 12:50:17 imagent: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 12:50:17 mapspushd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:18 imagent: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 12:50:18 fmfd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:18 maspushagent: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:18 mapspushd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:19 fmfd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:20 fmfd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 12:50:20 CallHistorySyncHelper: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 12:50:21 askpermissiond: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 12:50:54 WindowServer: WSGetSurfaceInWindow : Invalid surface 858112797 for window 43

Apr 11 12:50:57 WindowServer: WSGetSurfaceInWindow : Invalid surface 872742921 for window 52

Apr 11 12:58:25 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

Apr 11 12:58:27 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

launchd log

Apr 10 18:13:27 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:11:13 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:11:13 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:43:17 com.apple.xpc.launchd.user.501.100025.Aqua: Could not read path: path = /Users/USER/Library/LaunchAgents/com.webtools.uninstaller.plist, error = 2: No such file or directory

Apr 10 20:43:18 com.apple.xpc.launchd.user.501.100025.Aqua: Could not read path: path = /Library/LaunchDaemons/com.webhelper.plist, error = 2: No such file or directory

Apr 10 20:43:18 com.apple.xpc.launchd.user.501.100025.Aqua: Could not read path: path = /Users/USER/Library/LaunchAgents/com.webhelper.plist, error = 2: No such file or directory

Apr 10 20:43:18 com.apple.xpc.launchd.user.501.100025.Aqua: Could not read path: path = /Library/LaunchDaemons/com.webhelper.plist, error = 2: No such file or directory

Apr 10 20:51:01 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:51:04 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:53:22 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:53:25 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 20:54:07 com.apple.xpc.launchd.user.501.100025.Aqua: Could not read path: path = /Users/USER/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist, error = 2: No such file or directory

Apr 10 21:18:51 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:18:58 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:27:29 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:27:33 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:50:04 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:50:05 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:55:58 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:55:59 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 10 21:56:07 com.apple.xpc.launchd.domain.system: Could not read path: path = /var/root/Library/LaunchAgents/com.webhelper.plist, error = 2: No such file or directory

Apr 11 09:25:25 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 09:25:27 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 10:22:02 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 10:22:03 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

System services loaded

com.adobe.fpsaud

com.apple.Kerberos.kdc

- status: 1

com.apple.watchdogd

com.fitbit.galileod

com.google.keystone.daemon

com.microsoft.office.licensing.helper

com.v.helper

com.zeobit.MacKeeper.plugin.AntiTheft.daemon

System services disabled

org.samba.winbindd

Login services loaded

com.google.keystone.system.agent

com.memeo.Memeod

com.seagate.SeagateStorageGauge.plist

com.v.agent

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Fitbit Connect Menubar Helper

- /Applications/Fitbit Connect.app/Contents/MacOS/Fitbit Connect Menubar Helper.app

iCloud errors

bird 245

cloudd 59

CallHistorySyncHelper 3

Continuity errors

sharingd 1

Restricted files: 220

Lockfiles: 25

Contents of /Library/LaunchAgents/com.2f233e70f16400df.agent.plist

- mod date: Apr 10 16:36:20 2015

- checksum: 288392862

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.v.agent</string>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/2f233e70f16400df/Agent/agent.app/Contents/MacOS/agent</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>KeepAlive</key>

<true/>

<key>LimitLoadToSessionType</key>

<key>ThrottleInterval</key>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.seagate.SeagateStorageGauge.plist

- mod date: Mar 10 09:38:47 2010

- checksum: 3262128215

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<!--

com.seagate.SeagateStorageGauge.plist

SeagateDiagnostics

Created by John Brisbin on 3/10/10.

-->

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.seagate.SeagateStorageGauge.plist</string>

<key>LimitLoadToSessionType</key>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Seagate/Seagate Storage Gauge.app/Contents/MacOS/Seagate Storage Gauge</string>

<string>-doautolnch</string>

<string>/Library/Application Support/Seagate/Seagate Storage Gauge.app</string>

</array>

<key>RunAtLoad</key>

...and 3 more line(s)

Contents of /Library/LaunchDaemons/com.2f233e70f16400df.daemon.plist

- mod date: Apr 10 16:36:20 2015

- checksum: 2147185492

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.v.daemon</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/2f233e70f16400df/Agent/agent.app/Contents/MacOS/agent</string>

<string>-update</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>ThrottleInterval</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.2f233e70f16400df.helper.plist

- mod date: Apr 10 16:36:20 2015

- checksum: 544983346

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.v.helper</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/2f233e70f16400df/Agent/agent.app/Contents/MacOS/agent</string>

<string>-helper</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>ThrottleInterval</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.fitbit.galileod.plist

- mod date: Oct 22 04:34:04 2013

- checksum: 333804614

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Program</key>

<string>/usr/local/bin/galileod</string>

<key>ProgramArguments</key>

<array>

<string>/usr/local/bin/galileod</string>

</array>

<key>Label</key>

<string>com.fitbit.galileod</string>

<key>UserName</key>

<key>GroupName</key>

<string>daemon</string>

<key>InitGroups</key>

<true/>

<key>OnDemand</key>

<key>ServiceIPC</key>

<true/>

<key>Sockets</key>

<dict>

<key>UserClients</key>

...and 27 more line(s)

Contents of /Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

- mod date: Apr 10 17:57:51 2015

- checksum: 3798729423

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<key>Label</key>

<string>com.zeobit.MacKeeper.plugin.AntiTheft.daemon</string>

<key>Program</key>

<string>/Library/Application Support/MacKeeper/MacKeeperATd</string>

<key>OnDemand</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist

- mod date: Apr 11 22:20:03 2014

- checksum: 394026997

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.memeo.Memeod.plist

- mod date: Jan 24 12:38:54 2012

- checksum: 3934797224

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.memeo.Memeod</string>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/Memeo Backup/Memeo Backup.app/Contents/Daemons/Memeod</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>ServiceDescription</key>

<string>Memeo Backup support daemon</string>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Bad plists

Library/Preferences/com.solidstatenetworks.awkhost.plist

Bundles (new)

/Library/Application Support/2f233e70f16400df/Agent/agent.app

- com.someproduct.agent

/System/Library/Frameworks/v.framework/Versions/A/PlugIn/loader.bundle

- com.someproduct.loader

/System/Library/Frameworks/v.framework/Versions/A/PlugIn/plugIn.bundle

- com.someproduct.plugIn

/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_aomfhbjiekjcbeefclbidjgnikfbooem/Default aomfhbjiekjcbeefclbidjgnikfbooem.app

- com.google.Chrome.app.Default-aomfhbjiekjcbeefclbidjgnikfbooem-internal

/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_coobgpohoikkiipiblmjeljniedjpjpf/Default coobgpohoikkiipiblmjeljniedjpjpf.app

- com.google.Chrome.app.Default-coobgpohoikkiipiblmjeljniedjpjpf-internal

/Users/USER/Library/Application Support/Google/Chrome/Default/Web Applications/_crx_pjkljhegncpnkpknbcohdijeoejaedia/Default pjkljhegncpnkpknbcohdijeoejaedia.app

- com.google.Chrome.app.Default-pjkljhegncpnkpknbcohdijeoejaedia-internal

/Users/USER/Library/Application Support/Skype/Emoticon-Download/EmoticonCache.bundle

- com.skype.skype.emoticoncache.bundle

Library paths

/Applications/Microsoft Office 2011/Office/MicrosoftSetupUI.framework/Libraries/mbupgx.dylib

/Applications/Microsoft Office 2011/Office/OPF.framework/Versions/14/Resources/OPF_Common.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/Fm20.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/MicrosoftOLE2TypesLib.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RefEdit.dylib

/Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RichEdit.dylib

/System/Library/Frameworks/v.framework/Versions/A/Libraries/libLoader.dylib

/Users/USER/Library/Application Support/Firefox/Profiles/8lxz9350.default-1421041800081/gmp-gmpopenh264/1.1/lib gmpopenh264.dylib

/Users/USER/Library/Application Support/Firefox/Profiles/8lxz9350.default-1421041800081/gmp-gmpopenh264/1.3/lib gmpopenh264.dylib

/Users/USER/Library/Application Support/Google/Chrome/WidevineCDM/1.4.7.771/_platform_specific/mac_x64/libwidev inecdm.dylib

/usr/local/ssl/lib/libcrypto.1.0.0.dylib

/usr/local/ssl/lib/libssl.1.0.0.dylib

App extensions

com.getdropbox.dropbox.garcon

Installations

Office 2011 14.2.1 Update: 4/28/12, 12:20 AM

PlugIn: 4/18/12, 10:24 PM

PlugIn: 4/15/12, 8:30 PM

PlugIn: 4/9/12, 7:26 AM

PlugIn: 2/27/12, 10:22 PM

Bad kernel extensions

/System/Library/Extensions/BJUSBLoad.kext

Elapsed time (sec): 1192

Reply

Answer 3

Linc Davis

Level 10

210,611 points

Apr 11, 2015 2:20 PM in response to kapbrown

You installed a variant of the "VSearch" ad-injection malware. Follow Apple Support's instructions to remove it.

If you have trouble following those instructions, see below.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library/LaunchDaemons

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form

com.something.daemon.plist

and

com.something.helper.plist

Here something is a variable string of characters, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes it's a meaningless string such as "e8dec5ae7fc75c28" rather than a word. Sometimes the string is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.

If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:

/Library/LaunchAgents

In this folder, there may be a file named

com.something.agent.plist

where the string something is the same as before.

If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.

Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.

The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.

Open this folder:

/Library/Application Support

If it has a subfolder named just

something

where something is the same string you saw before, drag that subfolder to the Trash and close the window.

Don't delete the "Application Support" folder or anything else inside it.

Finally, in this folder:

/System/Library/Frameworks

there may an item named exactly

v.framework

It's actually a folder, though it has a different icon than usual. This item always has the above name; it doesn't vary. Drag it to the Trash and close the window.

Don't delete the "Frameworks" folder or anything else inside it.

If you didn't find the files or you're not sure about the identification, post what you found.

If in doubt, or if you have no backups, change nothing at all.

The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.

This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Reply

Answer 4

kapbrown

Level 1

8 points

Apr 11, 2015 5:15 PM in response to Linc Davis

Hi Linc. Thank you for your quick response. I had found the Apple Support Instructions after posting my script output above and found the

/System/Library/Frameworks/v.framework.  So, I went through those instructions (and yours).  I also upgraded my OS to Version 10.10.3.  Unfortunately, I still have the problem.  I have been using Firefox, but my son (who had downloaded the suspect game) was using Chrome... so I checked all of my browsers and sure enough I found a Flashmall extension in chrome.  So, I deleted it, restarted and still have the problem.  I went back through the Apple Support instructions as well as yours and did not find any of the files mentioned.  I'm not sure what else to do at this point.  If you have any other suggestions, I'd love to know them!  Thanks.

Reply

Answer 5

Linc Davis

Level 10

210,611 points

Apr 11, 2015 5:50 PM in response to kapbrown

Please repeat the test you ran and post the results.

Reply

Answer 6

kapbrown

Level 1

8 points

Apr 11, 2015 6:48 PM in response to Linc Davis

It did not run all the way through this time, so I ended it with a Command .

Start time: 18:25:01 04/11/15

Revision: 1296

Model Identifier: MacBookPro6,2

System Version: OS X 10.10.3 (14D131)

Kernel Version: Darwin 14.3.0

Time since boot: 45 minutes

UID: 501

SerialATA

TOSHIBA MK5055GSXF

- S.M.A.R.T. status: Not Supported

USB

Fitbit Base Station (Fitbit Inc.)

Activity

CPU: user 10%, system 5%

CPU usage (%)

firefox (UID 501): 37.8

I/O wait time (ms/s)

mds (UID 0): 403

CalendarAgent (UID 501): 194

com.apple.WebKi (UID 501): 135

Safari (UID 501): 118

nsurlstoraged (UID 501): 75

System errors (per sec)

plugin-containe (UID 501, error 316): 380

firefox (UID 501, error 35): 333

plugin-containe (UID 501, error 35): 304

Fitbit Connect (UID 501, error 3): 151

Energy (lifetime)

firefox (UID 501): 19.45

WindowServer (UID 88): 13.77

kernel_task (UID 0): 12.23

plugin-container (UID 501): 8.86

Energy (sampled)

Safari (UID 501): 15.48

plugin-container (UID 501): 14.08

kernel_task (UID 0): 11.40

firefox (UID 501): 10.90

WindowServer (UID 88): 7.19

Firewall: On

DNS: 75.75.75.75

Listeners

cupsd: ipp

kdc: kerberos

launchd: afpovertcp

launchd: microsoft-ds

Diagnostic reports

2015-03-21 Notes crash

2015-04-01 Adobe Flash Player Install Manager crash

2015-04-06 com.apple.iCal.CalendarNC crash

2015-04-08 Messages crash

2015-04-10 Google Drive crash

2015-04-10 Maps hang

2015-04-10 plugin-container crash

2015-04-11 Finder crash

2015-04-11 LegacyFileVaultMessageTracer crash

2015-04-11 launch crash x20

HID errors: 39

Shutdown codes

-62 6

Kernel log

Apr 10 16:29:10 vm_swap_create_file failed @ 25 secs

Apr 10 17:27:12 firefox (map: 0xffffff801eeb2a50) triggered DYLD shared region unnest for map: 0xffffff801eeb2a50, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 17:27:20 GGoooogglle eC hChroromem e HHee ((mmaapp:: 0x0xUUID)a 0tr)i tgrigggeerreedd D DYYLLDD sshhaarreed dr reeggiioon n uunnnneestst f foorr mamap:p: 00xGoofffxglfffff8f01e Chromff6fbe Hff580a10,e e(m8ap18: re7gi8o00xfn ff, r0xeff7ff8ffgi95o0n010 4fa002b000-x40>) 7f0xftrig7fgered DYLD ff9shf95ar52000000000ed->00x r07egf.io fn funWnehilst9 fe5 n2oor0 mt apab:n0 or00ma00xfffl . foffr Wf8014dhifaebl2**40,ggeer r se, tginhooisn 0x itnc 7fffraeab9ns50o00000->erm0xals f7fsyff95200000. While nsorot dte am ebmuegmgoerrys ,f btoonormal for debughigetrsp, rinthsis incret uasiesnc system memory frnootpretilinast e tuns tihel s tthare target exits.gye

Apr 10 18:11:23 firefox (map: 0xffffff801eeb2c30) triggered DYLD shared region unnest for map: 0xffffff801eeb2c30, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 20:24:36 OSUnserializeXML: syntax error near line 6

Apr 10 20:42:45 firefox (map: 0xffffff8014fa20f0) triggered DYLD shared region unnest for map: 0xffffff8014fa20f0, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 10 21:00:25 firefox (map: 0xffffff801e818c30) triggered DYLD shared region unnest for map: 0xffffff801e818c30, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 10:21:36 firefox (map: 0xffffff8012c1e780) triggered DYLD shared region unnest for map: 0xffffff8012c1e780, region 0x7fff92200000->0x7fff92400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 12:50:30 firefox (map: 0xffffff80328fc870) triggered DYLD shared region unnest for map: 0xffffff80328fc870, region 0x7fff91e00000->0x7fff92000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 13:01:21 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 11 13:48:18 firefox (map: 0xffffff80331915a0) triggered DYLD shared region unnest for map: 0xffffff80331915a0, region 0x7fff91e00000->0x7fff92000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 14:00:53 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 11 14:24:03 IOAudioStream[0xffffff802e4d1c00]::clipIfNecessary() - Error: counted 1 clip more than one buffer ahead errors.

Apr 11 14:45:53 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 11 14:47:02 MacAuthEvent en1 Auth result for: 44:32:c8:59:97:44 Auth timed out

Apr 11 14:54:15 firefox (map: 0xffffff801c23a000) triggered DYLD shared region unnest for map: 0xffffff801c23a000, region 0x7fff88000000->0x7fff88200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 15:37:34 firefox (map: 0xffffff8024f2d4b0) triggered DYLD shared region unnest for map: 0xffffff8024f2d4b0, region 0x7fff8b200000->0x7fff8b400000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 16:33:19 OSUnserializeXML: syntax error near line 6

Apr 11 16:34:13 OSUnserializeXML: syntax error near line 6

Apr 11 16:39:05 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 11 16:48:53 firefox (map: 0xffffff8026c0d4b0) triggered DYLD shared region unnest for map: 0xffffff8026c0d4b0, region 0x7fff93a00000->0x7fff93c00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 16:49:36 firefox (map: 0xffffff8026c0d4b0) triggered DYLD shared region unnest for map: 0xffffff8026c0d4b0, region 0x7fff93a00000->0x7fff93c00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Apr 11 16:57:02 IOAudioStream[0xffffff80198ed600]::clipIfNecessary() - Error: counted 1 clip more than one buffer ahead errors.

Apr 11 17:39:43 SerialATAPI device reconfiguration did not complete successfully. (failedCommandInfo = 0x2)

Apr 11 17:43:56 firefox (map: 0xffffff8012a510f0) triggered DYLD shared region unnest for map: 0xffffff8012a510f0, region 0x7fff92000000->0x7fff92200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

System log

Apr 11 17:47:46 cloudphotosd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 17:47:46 apsd: Failed entitlement check 'com.apple.private.aps-connection-initiate' for [356]

Apr 11 17:47:46 com.apple.photostream-agent: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:46 apsd: Failed entitlement check 'com.apple.private.aps-connection-initiate' for [356]

Apr 11 17:47:46 imagent: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:47 CallHistorySyncHelper: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:47 cloudphotosd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 17:47:48 AOSPushRelay: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:48 cloudphotosd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 17:47:49 cloudphotosd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 17:47:50 cloudphotosd: ApplePushService: Timed out making blocking call, failed to perform call via XPC connection to 'com.apple.apsd'

Apr 11 17:47:50 SocialPushAgent: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:55 mapspushd: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:56 maspushagent: ApplePushService: Connection timed out trying to communicate with apsd

Apr 11 17:47:59 apsd: Failed entitlement check 'com.apple.private.aps-connection-initiate' for [395]

Apr 11 17:48:00 apsd: Failed entitlement check 'com.apple.private.aps-connection-initiate' for [395]

Apr 11 17:48:05 com.apple.CloudPhotosConfiguration: Request UUID: New and old state identical for service com.apple.photo.icloud.cloudphoto: 0, ignoring request

Apr 11 17:48:51 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Microsoft Excel" for over 1.00 seconds. Server has re-enabled them.

Apr 11 17:57:16 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Messages" for over 1.00 seconds. Server has re-enabled them.

Apr 11 18:02:40 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "com.apple.preference.security.r" for over 1.00 seconds. Server has re-enabled them.

Apr 11 18:15:39 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "talagent" for over 1.00 seconds. Server has re-enabled them.

Apr 11 18:15:39 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

Apr 11 18:22:25 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

Apr 11 18:22:32 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

launchd log

Apr 11 09:25:25 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 09:25:27 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 10:22:02 com.apple.iCloudHelper: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 10:22:03 com.apple.internetaccounts: GUI session does not exist for service to join. It will be spawned without access to the GUI.

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc/Contents/MacOS/SandboxedServiceRunner error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc/Contents/MacOS/com.apple.S peechRecognitionCore.brokerd error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc/Contents/MacOS/DataDetectorsDynamicData error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc/Contents/MacOS/SandboxedServiceRunner error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc/Contents/MacOS/XPCTimeStampingService error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc/Contents/MacOS/com.apple.DictionaryServiceHelper error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc/Contents/MacOS/XPCKeychainSandboxCheck error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc/Contents/MacOS/IOServiceAuthorizeAgent error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc/Contents/MacOS/com.apple.S peechRecognitionCore.brokerd error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc, error = 1: Operation not permitted

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc/Contents/MacOS/SandboxedServiceRunner error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc/Contents/MacOS/com.apple.S peechRecognitionCore.brokerd error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer vices/DataDetectorsDynamicData.xpc/Contents/MacOS/DataDetectorsDynamicData error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Apr 11 17:42:50 com.apple.xpc.launchd.domain.pid.SecurityAgent.234: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/ com.apple.geod.xpc/Contents/MacOS/com.apple.geod error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/SecurityAg ent.xpc

Console log

Apr 11 16:26:37 mbloginhelper: Property list invalid for format: 200 (property lists cannot contain NULL)

System services loaded

com.adobe.fpsaud

com.apple.Kerberos.kdc

- status: 1

com.apple.watchdogd

com.fitbit.galileod

com.vix.cron

org.cups.cupsd

org.ntp.ntpd

org.postfix.master

System services disabled

org.samba.winbindd

Login services loaded

com.adobe.ARM.UUID

com.memeo.Memeod

com.seagate.SeagateStorageGauge.plist

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Fitbit Connect Menubar Helper

- /Applications/Fitbit Connect.app/Contents/MacOS/Fitbit Connect Menubar Helper.app

iCloud errors

bird 304

cloudd 62

CallHistorySyncHelper 4

comapple.CloudPhotosConfiguration 3

cloudphotosd 3

Mail 2

Spotlight 1

Finder 1

Continuity errors

sharingd 3

Restricted files: 165

Lockfiles: 25

Contents of /Library/LaunchAgents/com.seagate.SeagateStorageGauge.plist

- mod date: Mar 10 09:38:47 2010

- checksum: 3262128215

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<!--

com.seagate.SeagateStorageGauge.plist

SeagateDiagnostics

Created by John Brisbin on 3/10/10.

-->

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.seagate.SeagateStorageGauge.plist</string>

<key>LimitLoadToSessionType</key>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Seagate/Seagate Storage Gauge.app/Contents/MacOS/Seagate Storage Gauge</string>

<string>-doautolnch</string>

<string>/Library/Application Support/Seagate/Seagate Storage Gauge.app</string>

</array>

<key>RunAtLoad</key>

...and 3 more line(s)

Contents of /Library/LaunchDaemons/com.fitbit.galileod.plist

- mod date: Oct 22 04:34:04 2013

- checksum: 333804614

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Program</key>

<string>/usr/local/bin/galileod</string>

<key>ProgramArguments</key>

<array>

<string>/usr/local/bin/galileod</string>

</array>

<key>Label</key>

<string>com.fitbit.galileod</string>

<key>UserName</key>

<key>GroupName</key>

<string>daemon</string>

<key>InitGroups</key>

<true/>

<key>OnDemand</key>

<key>ServiceIPC</key>

<true/>

<key>Sockets</key>

<dict>

<key>UserClients</key>

...and 27 more line(s)

Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist

- mod date: Apr 11 16:13:16 2015

- checksum: 3012644940

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>org.apache.httpd</string>

<key>EnvironmentVariables</key>

<dict>

<key>XPC_SERVICES_UNAVAILABLE</key>

</dict>

<key>ProgramArguments</key>

<array>

<string>/usr/sbin/httpd-wrapper</string>

<string>FOREGROUND</string>

</array>

<key>OnDemand</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist

- mod date: Apr 11 22:20:03 2014

- checksum: 394026997

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.memeo.Memeod.plist

- mod date: Jan 24 12:38:54 2012

- checksum: 3934797224

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.memeo.Memeod</string>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/Memeo Backup/Memeo Backup.app/Contents/Daemons/Memeod</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>ServiceDescription</key>

<string>Memeo Backup support daemon</string>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Reply

Answer 7

kapbrown

Level 1

8 points

Apr 11, 2015 6:53 PM in response to Linc Davis