Question regarding the messages in the system log

Question

Question regarding the messages in the system log

I have a mac book pro purchased in 2008 and i am running yosemite. I would like to know what all the messages in the log mean and i should worry about them? I have been trying to clean up my mac because it has been running really slow. If i had the money i would take it in and have apple fix it.

i get a console utility error

another message is 1/28/15 3:16:45.815 AM mds[46181]: (Server.Warning:445) No stores registered for metascope "kMDQueryScopeComputer"

here is a sampling

1/28/15 3:16:50.000 AM kernel[0]: Sandbox: storeuid(14318) deny mach-lookup com.apple.dock.server

1/28/15 3:16:57.000 AM kernel[0]: Sandbox: storeuid(14318) deny mach-lookup com.apple.dock.server

1/28/15 3:17:37.458 AM WindowServer[168]: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

1/28/15 3:17:38.449 AM WindowServer[168]: common_reenable_update: UI updates were finally reenabled by application "Finder" after 1.99 seconds (server forcibly re-enabled them after 1.00 seconds)

1/28/15 3:17:40.987 AM com.apple.xpc.launchd[1]: (com.apple.quicklook[52159]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook

1/28/15 3:17:49.167 AM Console[52180]: Failed to connect (_consoleX) outlet from (NSApplication) to (ConsoleX): missing setter or instance variable

1/28/15 3:17:53.736 AM sandboxd[48976]: ([14318]) storeuid(14318) deny mach-lookup com.apple.dock.server

1/28/15 3:17:55.275 AM WindowServer[168]: disable_update_timeout: UI updates were forcibly disabled by application "Console" for over 1.00 seconds. Server has re-enabled them.

1/28/15 3:17:55.400 AM WindowServer[168]: common_reenable_update: UI updates were finally reenabled by application "Console" after 1.13 seconds (server forcibly re-enabled them after 1.00 seconds)

1/28/15 3:18:28.000 AM kernel[0]: Google Chrome He (map: 0xffffff801b2f01e0) triggered DYLD shared region unnest for map: 0xffffff801b2f01e0, region 0x7fff8e000000->0x7fff8e200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

1/28/15 3:21:03.995 AM CalendarAgent[252]: [com.apple.calendar.store.log.caldav.queue] [Account refresh failed with error: Error Domain=CoreDAVHTTPStatusErrorDomain Code=401 "The operation couldn’t be completed. (CoreDAVHTTPStatusErrorDomain error 401.)" UserInfo=0x7fe5a8d20cc0 {AccountName=Gmail, CalDAVErrFromRefresh=YES, CoreDAVHTTPHeaders=<CFBasicHash 0x7fe5aa096480 [0x7fff7d4b5cf0]>{type = immutable dict, count = 14,

entries =>

0 : Content-Type = <CFString 0x7fe5a8d1f2e0 [0x7fff7d4b5cf0]>{contents = "application/vnd.google.gdata.error+xml; charset=UTF-8"}

1 : Www-Authenticate = <CFString 0x7fe5a8cce160 [0x7fff7d4b5cf0]>{contents = "basic realm="Google APIs""}

4 : alternate-protocol = <CFString 0x7fe5a8cf8200 [0x7fff7d4b5cf0]>{contents = "443:quic,p=0.02"}

5 : Content-Encoding = gzip

6 : Server = GSE

7 : x-clienttoken-request = true

8 : Expires = <CFString 0x7fe5a8deb9b0 [0x7fff7d4b5cf0]>{contents = "Wed, 28 Jan 2015 08:21:03 GMT"}

9 : x-xss-protection = <CFString 0x7fe5a8dd4650 [0x7fff7d4b5cf0]>{contents = "1; mode=block"}

12 : Cache-Control = <CFString 0x7fe5a8cf6840 [0x7fff7d4b5cf0]>{contents = "private, max-age=0"}

13 : Date = <CFString 0x7fe5a8e19ae0 [0x7fff7d4b5cf0]>{contents = "Wed, 28 Jan 2015 08:21:03 GMT"}

15 : Content-Length = 200

19 : x-content-type-options = nosniff

21 : x-frame-options = <CFString 0x7fe5aa40c9c0 [0x7fff7d4b5cf0]>{contents = "SAMEORIGIN"}

22 : Vary = <CFString 0x7fe5aa0bb300 [0x7fff7d4b5cf0]>{contents = "Origin, X-Origin"}

}

}]

1/28/15 3:21:04.008 AM CalendarAgent[252]: [com.apple.calendar.store.log.caldav.queue] [Coalescing failed operation [<CalDAVAccountRefreshQueueableOperation: 0x7fe5a8fc2bb0; Sequence: 0>]]

1/28/15 3:21:38.630 AM mds[46181]: (Server.Warning:445) No stores registered for metascope "kMDQueryScopeComputer"

1/28/15 3:21:38.632 AM mds[46181]: (Server.Warning:445) No stores registered for metascope "kMDQueryScopeComputer"

1/28/15 3:21:38.830 AM mds[46181]: (Server.Warning:445) No stores registered for metascope "kMDQueryScopeComputer"

1/28/15 3:24:37.192 AM SubmitDiagInfo[456]: The connection to https://radarsubmissions.apple.com/submit could not be created

1/28/15 3:24:37.192 AM SubmitDiagInfo[456]: Request object for https://radarsubmissions.apple.com/submit couldn't be created

1/28/15 3:24:37.192 AM SubmitDiagInfo[456]: Error while bootstrapping the main Config File

1/28/15 3:24:37.193 AM diagnostics_agent[303]: Submission failed

Posted on Jan 28, 2015 12:28 AM

Reply

Answer 1

ansi6622

Level 1

8 points

Jun 6, 2017 3:32 PM in response to Linc Davis

If you've got some time to go through mine, I just got back from the Apple Store, and this MacBook Pro, from my perspective, should be totally clean as it was wiped and installed in the store. I haven't downloaded any apps other than Malwarebytes. But saw some weird things in the report and am by no means a OS Xpert.

Start time: 15:18:25 06/06/17

Revision: 1184

Model Identifier: MacBookPro11,5

System Version: macOS 10.12.5 (16F73)

Kernel Version: Darwin 16.6.0

System Integrity Protection: Enabled

Time since boot: 2:59

FileVault: On

DNS: 157.56.74.180 (static)

Wi-Fi

Privacy: NONE

Log

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc/Contents/MacOS/XPCKeychainSandboxCheck error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc/Contents/MacOS/IOServiceAuthorizeAgent error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc/Contents/MacOS/com.apple.S peechRecognitionCore.brokerd error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc, error = 1: Operation not permitted

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc, error = 1: Operation not permitted

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ HIServices.framework/Versions/A/XPCServices/com.apple.hiservices-xpcservice.xpc, error = 1: Operation not permitted

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc, error = 1: Operation not permitted

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc, error = 1: Operation not permitted

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc, error = 1: Operation not permitted

Jun 6 12:16:59 com.apple.xpc.launchd.domain.pid.SecurityAgent.223: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/FamilyControls.framework/Versions/A/XPCServic es/com.apple.FCiCloudPrefUpdater.xpc/Contents/MacOS/com.apple.FCiCloudPrefUpdate r error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc/Contents/MacOS/SandboxedServiceRunner error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc/Contents/MacOS/XPCTimeStampingService error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc/Contents/MacOS/com.apple.DictionaryServiceHelper error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ HIServices.framework/Versions/A/XPCServices/com.apple.hiservices-xpcservice.xpc/ Contents/MacOS/com.apple.hiservices-xpcservice error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc/Contents/MacOS/XPCKeychainSandboxCheck error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc/Contents/MacOS/IOServiceAuthorizeAgent error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc/Contents/MacOS/com.apple.S peechRecognitionCore.brokerd error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityA gent.bundle

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCTimeSta mpingService.xpc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/XP CServices/com.apple.SpeechRecognitionCore.brokerd.xpc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ HIServices.framework/Versions/A/XPCServices/com.apple.hiservices-xpcservice.xpc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedSer viceRunner.xpc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Diction aryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.x pc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/Frameworks/IOKit.framework/Versions/A/XPCServices/IOServiceAuth orizeAgent.xpc, error = 1: Operation not permitted

Jun 6 12:19:37 com.apple.xpc.launchd.domain.pid.SecurityAgent.228: Failed to bootstrap path: path = /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/XPCKeychai nSandboxCheck.xpc, error = 1: Operation not permitted

Daemons

com.apple.Kerberos.digest-service

- status: -9

com.apple.NetBootClientHelper

com.apple.mobile.keybagd

- status: 78

com.apple.watchdogd

- status: 255

com.malwarebytes.HelperTool

Agents

com.apple.AirPortBaseStationAgent

com.apple.iBooksX.CacheDelete

Restricted files: 2

Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist

- mod date: Jul 30 12:30:57 2016

- checksum: 1199119104

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Kernel Flags</key>

</dict>

</plist>

Contents of /Library/Preferences/com.apple.security.appsandbox.plist

- mod date: Jan 31 18:23:47 2017

- checksum: 2599182411

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>UnrestrictSpotlightContainerScope</key>

<true/>

</dict>

</plist>

Contents of /etc/hosts

- mod date: Feb 20 19:37:55 2017

- checksum: 3099933916

127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

Contents of /etc/pam.d/authorization

- mod date: Apr 20 17:30:34 2017

- checksum: 1288902703

auth optional pam_krb5.so use_first_pass use_kcminit

auth optional pam_ntlm.so use_first_pass

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so

Contents of /etc/pam.d/authorization_aks

- mod date: Apr 20 17:20:48 2017

- checksum: 841932527

auth required pam_aks.so

account required pam_opendirectory.so

Contents of /etc/pam.d/authorization_ctk

- mod date: Apr 20 17:21:58 2017

- checksum: 2418984201

auth required pam_smartcard.so use_first_pass pkinit

account required pam_opendirectory.so

Contents of /etc/pam.d/authorization_la

- mod date: Apr 20 17:21:14 2017

- checksum: 2713564393

auth required pam_localauthentication.so

auth required pam_aks.so

account required pam_opendirectory.so

Contents of /etc/pam.d/checkpw

- mod date: Apr 20 16:53:15 2017

- checksum: 2672765862

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so no_check_home no_check_shell

Contents of /etc/pam.d/chkpasswd

- mod date: Apr 14 16:23:49 2017

- checksum: 335781771

auth required pam_opendirectory.so

account required pam_opendirectory.so

password required pam_permit.so

session required pam_permit.so

Contents of /etc/pam.d/cups

- mod date: Apr 20 17:14:40 2017

- checksum: 2842188894

auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so

Contents of /etc/pam.d/ftpd

- mod date: Oct 14 15:28:57 2016

- checksum: 2001169128

auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so

Contents of /etc/pam.d/login

- mod date: Apr 14 16:23:39 2017

- checksum: 1242678644

auth optional pam_krb5.so use_kcminit

auth optional pam_ntlm.so try_first_pass

auth optional pam_mount.so try_first_pass

auth required pam_opendirectory.so try_first_pass

account required pam_nologin.so

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_launchd.so

session required pam_uwtmp.so

session optional pam_mount.so

Contents of /etc/pam.d/login.term

- mod date: Apr 14 16:23:39 2017

- checksum: 3930746290

account required pam_nologin.so

account required pam_opendirectory.so

session required pam_uwtmp.so

Contents of /etc/pam.d/other

- mod date: Oct 14 14:15:02 2016

- checksum: 2748091512

auth required pam_deny.so

account required pam_deny.so

password required pam_deny.so

session required pam_deny.so

Contents of /etc/pam.d/passwd

- mod date: Apr 14 16:23:35 2017

- checksum: 1026516346

auth required pam_permit.so

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_permit.so

Contents of /etc/pam.d/screensaver

- mod date: Apr 20 17:31:35 2017

- checksum: 3141704602

auth optional pam_krb5.so use_first_pass use_kcminit

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe

Contents of /etc/pam.d/screensaver_aks

- mod date: Apr 20 17:20:48 2017

- checksum: 3209544573

auth required pam_aks.so

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe

Contents of /etc/pam.d/screensaver_ctk

- mod date: Apr 20 17:21:58 2017

- checksum: 367670211

auth required pam_smartcard.so use_first_pass

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe

Contents of /etc/pam.d/screensaver_la

- mod date: Apr 20 17:21:14 2017

- checksum: 589164084

auth required pam_localauthentication.so

auth required pam_aks.so

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe

Contents of /etc/pam.d/smbd

- mod date: Oct 14 15:58:55 2016

- checksum: 2516643123

account required pam_sacl.so sacl_service=smb allow_trustacct

session required pam_permit.so

Contents of /etc/pam.d/sshd

- mod date: Jan 23 18:44:38 2017

- checksum: 2989478361

auth optional pam_krb5.so use_kcminit

auth optional pam_ntlm.so try_first_pass

auth optional pam_mount.so try_first_pass

auth required pam_opendirectory.so try_first_pass

account required pam_nologin.so

account required pam_sacl.so sacl_service=ssh

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_launchd.so

session optional pam_mount.so

Contents of /etc/pam.d/su

- mod date: Oct 14 14:29:09 2016

- checksum: 2045483434

auth sufficient pam_rootok.so

auth required pam_opendirectory.so

account required pam_group.so no_warn group=admin,wheel ruser root_only fail_safe

account required pam_opendirectory.so no_check_shell

password required pam_opendirectory.so

session required pam_launchd.so

Contents of /etc/pam.d/sudo

- mod date: Dec 10 16:23:13 2016

- checksum: 3515993703

auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so

Contents of /etc/periodic/daily/110.clean-tmps

- mod date: Oct 14 14:14:45 2016

- checksum: 4099837049

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_tmps_enable" in

[Yy][Ee][Ss])

if [ -z "$daily_clean_tmps_days" ]

then

echo '$daily_clean_tmps_enable is set but' \

'$daily_clean_tmps_days is not'

rc=2

else

echo ""

echo "Removing old temporary files:"

set -f noglob

args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"

args="${args} -ctime +$daily_clean_tmps_days"

dargs="-empty -mtime +$daily_clean_tmps_days"

dargs="${dargs} ! -name .vfs_rsrc_streams_*"

[ -n "$daily_clean_tmps_ignore" ] && {

args="$args "`echo " ${daily_clean_tmps_ignore% }" |

sed 's/[ ][ ]*/ ! -name /g'`

dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |

sed 's/[ ][ ]*/ ! -name /g'`

...and 21 more line(s)

Contents of /etc/periodic/daily/130.clean-msgs

- mod date: Oct 14 14:14:45 2016

- checksum: 4292599426

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_msgs_enable" in

[Yy][Ee][Ss])

if [ ! -d /var/msgs ]

then

echo '$daily_clean_msgs_enable is set but /var/msgs' \

"doesn't exist"

rc=2

else

echo ""

echo "Cleaning out old system announcements:"

[ -n "$daily_clean_msgs_days" ] &&

arg=-${daily_clean_msgs_days#-} || arg=

msgs -c $arg && rc=0 || rc=3

fi;;

*) rc=0;;

esac

exit $rc

Contents of /etc/periodic/daily/140.clean-rwho

- mod date: Oct 14 14:14:45 2016

- checksum: 659374794

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_rwho_enable" in

[Yy][Ee][Ss])

if [ -z "$daily_clean_rwho_days" ]

then

echo '$daily_clean_rwho_enable is enabled but' \

'$daily_clean_rwho_days is not set'

rc=2

elif [ ! -d /var/rwho ]

then

echo '$daily_clean_rwho_enable is enabled but /var/rwho' \

"doesn't exist"

rc=2

else

echo ""

echo "Removing stale files from /var/rwho:"

case "$daily_clean_rwho_verbose" in

[Yy][Ee][Ss])

print=-print;;

*)

print=;;

...and 14 more line(s)

Contents of /etc/periodic/daily/199.clean-fax

- mod date: Oct 14 14:14:45 2016

- checksum: 1104983357

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

if [ -d /var/spool/fax ]; then

echo ""

echo "Removing scratch fax files"

cd /var/spool/fax && \

find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;

fi

Contents of /etc/periodic/daily/310.accounting

- mod date: Oct 14 14:14:45 2016

- checksum: 3208203734

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_accounting_enable" in

[Yy][Ee][Ss])

if [ ! -f /var/account/acct ]

then

echo '$daily_accounting_enable is set but /var/account/acct' \

"doesn't exist"

rc=2

elif [ -z "$daily_accounting_save" ]

then

echo '$daily_accounting_enable is set but ' \

'$daily_accounting_save is not'

rc=2

else

echo ""

echo "Rotating accounting logs and gathering statistics:"

cd /var/account

rc=0

n=$daily_accounting_save

rm -f acct.$n.gz acct.$n || rc=3

m=$n

...and 18 more line(s)

Contents of /etc/periodic/daily/400.status-disks

- mod date: Oct 14 14:14:45 2016

- checksum: 1480768650

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_disks_enable" in

[Yy][Ee][Ss])

echo ""

echo "Disk status:"

df $daily_status_disks_df_flags && rc=1 || rc=3

;;

*) rc=0;;

esac

exit $rc

Contents of /etc/periodic/daily/420.status-network

- mod date: Oct 14 14:14:45 2016

- checksum: 2730873650

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_network_enable" in

[Yy][Ee][Ss])

echo ""

echo "Network interface status:"

case "$daily_status_network_usedns" in

[Yy][Ee][Ss])

netstat -i && rc=0 || rc=3;;

*)

netstat -in && rc=0 || rc=3;;

esac;;

*) rc=0;;

esac

exit $rc

Contents of /etc/periodic/daily/430.status-rwho

- mod date: Oct 14 14:14:45 2016

- checksum: 3455351261

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_rwho_enable" in

[Yy][Ee][Ss])

rwho=$(echo /var/rwho/*)

if [ -f "${rwho%% *}" ]

then

echo ""

echo "Local network system status:"

prog=ruptime

else

echo ""

echo "Local system status:"

prog=uptime

fi

rc=$($prog | tee /dev/stderr | wc -l)

if [ $? -eq 0 ]

then

[ $rc -gt 1 ] && rc=1

else

rc=3

fi;;

...and 3 more line(s)

Contents of /etc/periodic/daily/999.local

- mod date: Oct 14 14:14:45 2016

- checksum: 2319755381

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $daily_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc

Contents of /etc/periodic/monthly/199.rotate-fax

- mod date: Oct 14 14:14:45 2016

- checksum: 3437454680

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

echo ""

printf %s "Rotating fax log files:"

cd /var/log/fax

for i in *.log; do

if [ -f "${i}" ]; then

echo -n " $i"

if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi

if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi

if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi

if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi

if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi

if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi

touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"

fi

done

echo ""

Contents of /etc/periodic/monthly/200.accounting

- mod date: Oct 14 14:14:45 2016

- checksum: 3541581936

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

oldmask=$(umask)

umask 066

case "$monthly_accounting_enable" in

[Yy][Ee][Ss])

W=/var/log/wtmp

rc=0

remove=NO

if [ $rc -eq 0 ]

then

echo ""

echo "Doing login accounting:"

rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)

[ $rc -gt 0 ] && rc=1

fi

[ $remove = YES ] && rm -f $W.0;;

*) rc=0;;

esac

umask $oldmask

exit $rc

Contents of /etc/periodic/monthly/999.local

- mod date: Oct 14 14:14:45 2016

- checksum: 2355967272

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $monthly_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc

Contents of /etc/periodic/weekly/320.whatis

- mod date: Oct 14 14:14:45 2016

- checksum: 922328658

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$weekly_whatis_enable" in

[Yy][Ee][Ss])

echo ""

echo "Rebuilding whatis database:"

MANPATH=`/usr/bin/manpath -q`

if [ $? = 0 ]

then

if [ -z "${MANPATH}" ]

then

echo "manpath failed to find any manpage directories"

rc=3

else

rc=0

/usr/libexec/makewhatis.local "${MANPATH}" || rc=3

if [ X"${man_locales}" != X ]

then

for i in ${man_locales}

do

LC_ALL=$i /usr/libexec/makewhatis.local -a \

-L "${MANPATH}" || rc=3

...and 9 more line(s)

Contents of /etc/periodic/weekly/999.local

- mod date: Oct 14 14:14:45 2016

- checksum: 3078968429

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $weekly_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc

Contents of /etc/pf.conf

- mod date: Oct 14 15:15:01 2016

- checksum: 2891177609

scrub-anchor "com.apple/*"

nat-anchor "com.apple/*"

rdr-anchor "com.apple/*"

dummynet-anchor "com.apple/*"

anchor "com.apple/*"

load anchor "com.apple" from "/etc/pf.anchors/com.apple"

Contents of /etc/syslog.conf

- mod date: Nov 9 15:31:29 2016

- checksum: 2399118465

install.* @127.0.0.1:32376

Applications

/Applications/Malwarebytes Anti-Malware.app

- com.malwarebytes.antimalware

/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app

- com.apple.ScriptEditor.id.cocoa-applet-template

/Library/Image Capture/Devices/Canon IJScanner2.app

- jp.co.canon.ijscanner2.scanner.ica

/Library/Image Capture/Devices/Canon IJScanner4.app

- jp.co.canon.ij.ica.scanner4

/Library/Image Capture/Devices/Canon IJScanner6.app

- jp.co.canon.ij.ica.scanner6

/Library/Image Capture/Devices/EPSON Scanner.app

- com.epson.scanner.ica

/Library/Printers/EPSON/Fax/AutoSetupTool/EPFaxAutoSetupTool.app

- com.epson.ijfax.app.EPFaxAutoSetupTool

/Library/Printers/EPSON/Fax/FaxIOSupport/epsonfax.app

- com.epson.ijfax.app.epsonfax

/Library/Printers/EPSON/Fax/Filter/commandFilter.app

- com.epson.ijfax.filter.commandFilter

/Library/Printers/EPSON/Fax/Filter/rastertoepfax.app

- com.epson.ijfax.filter.rastertoepfax

/Library/Printers/EPSON/Fax/Utility/FAX Utility.app

- com.epson.ijfax.utility.FAXUtility

/Library/Printers/EPSON/Fax/Utility/Fax Receive Monitor.app

- com.epson.ijfax.app.FaxReceiveMonitor

Bad kernel extensions

/System/Library/Extensions/AppleOSXUSBNCM.kext

Elapsed time (sec): 160

Reply

Answer 2

BobHarris

Level 9

56,819 points

Jun 7, 2017 6:24 AM in response to ansi6622

Linc no longer participates in the fourm.

I would suggest you start a brand new "Post" (see "Post" link at the top of this page)

Please post the EtreCheck output in your new "Post". Please put your new post in the correct forum for your version of macOS

<https://discussions.apple.com/docs/DOC-6174> or <https://etrecheck.com>

If, when trying to post the output, you get the error:

"The message contains invalid characters"

then try posting to PasteBin.com, and give us a pointer.

<http://pastebin.com/>

.

EtreCheck is a tool that helps Apple Support Community volunteers debug problems without any access to the troubled computers. Debugging problems can be a difficult task even when the machine is in front of you. Attempting it via a discussion forum is extremely difficult. EtreCheck has been a great help.

Reply

Answer 3

dgerman

Level 1

28 points

Jan 31, 2017 3:10 PM in response to Linc Davis

Can the development group PLEASE change the priority of messages that are "not a problem" do that they are not "CRITICAL".

For example:

softwareupdated[263]: SUScan: Scan ....

SpeechDataInstallerd[4266]: 1 recommended products match ...

softwareupdate_notify_agent[736]: Waiting 60 seconds...

storeassetd[5193]: Query for available updates: FINISHED

installd[304]: PackageKit: ----- Begin install -----

softwareupdate_download_service[873]: Creating download session...

storedownloadd[306]: Query for available updates: FINISHED

Reply

Answer 4

Jun 5, 2017 11:11 PM in response to sunflowerfibers

Hey know this is years later but I noticed Splash Top streamer in the output of that script you ran. Did you install that yourself? I'm pretty sure that it's a really insecure program and I was using it for a little while and suddenly got all of this malware and microsoft like behavior on my computers. Did you ever get this all sorted out or is your computer still a zombie? And lol you angered that great and powerful linc davis so I'll assume you no longer are able to access the internet.

Reply

Answer 5

Linc Davis

Level 10

209,739 points

Jan 28, 2015 9:06 AM in response to sunflowerfibers

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes slow, but not all the time, run the test during a slowdown.

You may have started up in "safe" mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth SerialATA Extensions Applications Frameworks PrefPane Fonts Displays 85 percent 20480 1 MB/s 25000 ports KiB/s DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH 10 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A '|sort|uniq'{,\ -c} 102400 25600 Label 1024 CFBundleIdentifier 25 25 25 1000 MB 10 per\ second 51 5120 files 4 1000 25 5120 -\\t PlistBuddy{,' 2>&1'}' -c Print' OSBundleRequired 1184 20 ' function f() { n++;sub(/^/,"^");gsub(/\./,"\\.");gsub(/\+/,"\\+");gsub(/\-/,"\\-");gsub(/\?/,"\\?");print|"sort|uniq";};function g(N,d) { if(n<N) print d;};' {{,'\.'{kext,xpc,'(appex|pluginkit)'}'\/(Contents\/)?'}Info,'Launch[AD].+'}'\.plist' 'com\.apple\.' );N0=${#p[@]};p[N0]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^$[0-9]+$ /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s'{': ','\n\n'}'%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n'"${p[50]}"'%s\n' '%s (UID %s) %s %s' '\nContents of %s\n '"${p[50]}"'mod date: %s\n '"${p[50]}"'checksum: %s\n%s\n' '\n ...and %s more line(s)\n' 'RSSI: %s\nNoise: %s\nTx rate: %s\n' {Privacy,Mode}': %s\n' );b=(com.adobe.{AAM.Updater-1.0{,},AdobeCreativeCloud,CS{4,5}ServiceManager,fpsaud,SwitchBoard{,}} ${p[62]}{aelwriter,{AirPortBaseSt,SafariNotific}ationAgent,FolderActions.enabled,installer.osmessagetracing,mrt.uiagent,ReportCrash.Self,{rp,usb}muxd} com.citrixonline.GoToMeeting.G2MUpdate com.google.keystone.daemon com.microsoft.office.licensing.helper com.oracle.java.{Helper-Tool,JavaUpdateHelper{,}} org.macosforge.xquartz.{privileged_{,},}startx );c=(879294308 4071182229 461455494 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 2636415542 3694147963 1233118628 2456546649 2806998573 2778718105 842973933 2051385900 3301885676 891055588 695903914 1443423563 4136085286 523110921 2883943871 3873345487 );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("'"${f[5]}"'",$0,u,q,"'${p[$2]}'");} ';};S4() { echo "${p[56]}"\ ' /'${p[$1]}'$/ { p="'"${p[52]}"'\\ :'${p[$2]}' \""$0"\"";p|getline;close(p);if($0!~/ /) f();};END{g('$3',"^'"${p[62]}"'")} ';};s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[46]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[47]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' BEGIN { FS=":";if(system("sw_vers -productVersion|grep -q ^10\.1")) d="^'"${p[62]}"'launch(d\.peruser\.[0-9]+|ctl\.(Aqua|Background|System))$";} { if($2~/[1-9]/) { $2="status: "$2;printf("'"${f[4]}"'",$1,$2);} else if(!d||$1!~d) print $1;} ' ' { sub(/ :/,"");print|"tail -n'${p[48]}'";} ' ' NR==2&&$4<='${p[49]}' { print $4;} ' ' END { $2/=256;if($2>='${p[34]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p;' "`S4 58 35 80`" 's/^.{52}(.+) <.+/\1/p' "`S4 61 33 80`" "`S4 59 35 80`" ' NR>1&&$3!~/0x|\.([0-9]{3,}|[-0-9A-F]{36})$/ { print $3":"$2;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p ' '/^root$/p' "${p[56]}"\ ' /\.(bundle|component|framework|kext|mdimporter|plugin|qlgenerator|saver|wdgt)$/{f()} END{g(900,"^/System/")} ' ' /\.dylib$/!d;s/(\.|\+|\-|\?)/\\\1/g;s/^/^/p;' "${p[56]}"\ ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");f();} END { split("'"${b[*]}"'",b);split("'"${c[*]}"'",c);for(i in b) print b[i]"\.plist\t"c[i];g(500,"Launch");} ' ' /^\/(Ap|Dev|Inc|Prev)/d;/((iTu|ok).+dle|\.(component|mailbundle|mdimporter|plugin|qlgenerator|saver|wdgt))$/p;' ' { gsub(/[()"]/,"",$3);if($2!="="||!$3) $3="N/A";print $3;} ' ' /^\// { sub("/dev/","",$1);printf("%s: %s\n",$1,$9);} ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&& $3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' $1=="op" {m=$3};$1~"lN" {N=$2};$1~"lR" {S=$2};$1~"Tx" {T=$2};$1~/^st/ {s=$2};$1~"li"&&$3!~"wpa2" {printf("'"${f[9]}"'",toupper($3))};END { if(S*N*T&&(S-N<'${p[25]}'||T<'${p[55]}')) printf("'"${f[8]}"'",S,N,T);if(s~/^r/&&m!~/^st/) printf("'"${f[10]}"'",m);} ' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\$[0-9]+\$\$.+\$/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p);if(b) print("\n\t* Code injection");} ' ' BEGIN{FS=":"} { $3/=10240;if($3>='${p[27]}') printf("'"${f[5]}"'",$1,$2,$3,"'"${p[23]}"'");} ' ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"cksum "F|getline C;split(C, A);C=A[1];"stat -f%Sm "F|getline D;"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("'"${p[51]}"' "F|getline g) { l++;if(l<=L) f=f"\n "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F"\n '"${p[50]}"'"T;printf("'"${f[6]}"'",F,D,C,f);if(l>L) printf("'"${f[7]}"'",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' /kext:/ { split($0,a,":");s=system("'"${p[51]}"'\\ :'${p[53]}' \""a[1]"\"/*/I*|grep -q Sa");if(!s) a[1]=a[1]" S";if(!a[2]) a[2]="'"${p[28]}"'";printf("'"${f[4]}"'",a[1],a[2]);next;} !/^ *$/ { p="'"${p[52]}"'\\ :'"${p[35]}"' \""$0"\"/*/'${p[57]}'";p|getline b;close(p);if(b~/ /||b=="") b="'"${p[28]}"'";printf("'"${f[4]}"'",$0,b);} ' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/$L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?'${p[57]}'$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;' ' s/^.+ |\(.+$$//g;p ' "`S4 60 35 20`" ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END { if(i>1) print n;} ' s/{':[^:]+$','Pr.+n '}'//;s/ +([0-9]+)(.+)/\2: \1/p;' ' /es: ./{ s/^.+://;b0'$'\n'' };/^ +C.+ted: +[NY]/H;/:$/b0'$'\n'' d;:0'$'\n'' x;/: +N/d;s/\n.+//p;' ' 1d;/:$/b0'$'\n'' $b0'$'\n'' /(D|^ *Loc.+): /{ s/^.+: //;H;};/(By|m): /H;d;:0'$'\n'' x;/[my]: [AM]|^\/Vo/d;s/(^|\n) [ -~]+//g;s/(.+)\n(.+)/\2:\1/;s/\n//g;/[ -~]/p;' 's/$/:(0|-(4[34])?)$/p' ' /^ {6}[^ ]/d;s/:$//;/([^ey]|[^n]e):/d;/e: Y/d;s/: Y.+//g;H;${ g;s/ \n (\n)/\1/g;s/\n +(M[^ ]+)[ -~]+/ (\1)/;s/\n$//;/( {8}[^ ].*){2,}/p;} ' ' BEGIN{FS=":"} { $3/=10;if($3>='${p[41]}') printf("'"${f[5]}"'",$1,$2,$3,"'"${p[42]}"'");} ' ' BEGIN{FS=":"} $1>1 { if(!$4) $4="kernel_task";else { p="ps -c -ocomm -p"$4"|sed 1d";p|getline n;close(p);if(n) $4=n;};print $4" -> "$2" (UID "$3") x"$1;} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab iotop top pkgutil "${p[52]}\\" whoami cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom 'mdfind -onlyin /' ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' pluginkit scutil 'dtrace -q -n' profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil lsof test osascript\ -e netstat mdls kextfind );S1() { printf kMDItemContentTypeTree=${p[62]}$1;};S2() { printf 'L*/Ca*/'${p[62]}'Saf*/E*/* -d 1 -name '${p[57]}' -exec '"${c1[14]}"' :'$1' {} \;|uniq';};c2=(${p[62]}loginwindow\ LoginHook ' /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'|tr , \\\n" "`S2 CFBundleDisplayName`" '~ $TMPDIR.. $ -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 $' -i '-nl -print' '-F \$Sender -k Level Nle 3 -k Facility CReq "apple\.(bird|i?clou)"'"${p[30]}" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$(RefProc): \$Message' -k Sender Req 'fsev|kern|launchd' -k RefProc Rne 'Aq|WebK' -k Message Rne '08012|Goog|ksadm|probe|Roame|SMC:|smcD|sserti|suhel| VALI|ver-r|xpma' -k Message Req 'abn|bad |Beac|caug|corru|dead[^bl]|FAIL|fail|GPU |hfs: Ru|idle ex|inval|jnl:|last value [1-9]|lv_c|NVDA$|pagin|pci pa|proc: t|Roamed|rror|SL|TCON|Throttli|tim(ed? ?|ing )o|WARN' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/'${p[62]}'*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true $ -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '/S*/*/Ca*/*xpc* >&- ||echo No' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' "`S1 "{bundle,mach-o-dylib}"`" "`S2 ${p[35]}`" "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/${p[62]}alf\ globalstate --proxy '-n get default' -I --dns -get{dnsservers,info}\ "${p[N0]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --files '${p[62]}'pkg.*'"${p[29]}" -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' ${p[62]}dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'${p[30]}|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????|wc -l' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' '-F \$Message -k Sender kernel -k Message CReq "'{'n Cause: -','a underr|I/O e'}'"'"${p[30]}" '-app Safari UserStyleSheetEnabled' -name\ kMDItem${p[35]} -T\ hfs '-F "" -k Sender hidd -k Nle 3|wc -l' {\ "' syscall:::return /errno != 0/ {@o[execname,uid]=count()} "\ ,\ "' syscall::"{recvfrom,sendto}":return {@o[execname,uid]=sum(arg0)} "\ }\ " tick-10sec { trunc(@o,1);printa(\"%s:%d:%@d\",@o);exit(0);} '" "' syscall::execve:return, syscall::posix_spawn:return { printf(\"%s:%d:%d\n\",execname,uid,ppid);} tick-10sec { exit(0);} '""${p[30]}""|sed -E 's/ +([0-9]+) /\1:/'" );N1=${#c2[@]};for j in {0..15};do c2[N1+j]=SP${p[j]}DataType;done;l=({Restricted\ ,Lock,Pro}files POST Battery {Safari,App,{Bad,Loaded}\ kernel}\ extensions Heat System\ load boot\ args FileVault Diagnostic\ reports Log {Free\ space,Swap}' (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports User Daemons Agents XPC\ cache Startup\ items {Admin,Root}\ access Bundles {,Inserted\ }dylibs Stylesheet Font\ issues Firewall Proxies DNS TCP/IP Wi-Fi 'Elapsed time (sec)' {Root,User}\ crontab {Global,User}' login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching Nets Descriptors Bad\ plists {I/O,iCloud,HID,System}\ errors 'High file counts' Memory\ pressure Volumes SMC Current\ {down,up}stream\ data Shutdowns Forks );N3=${#l[@]};for i in {0..8};do l[N3+i]=${p[5+i]};done;A0() { Q=5;v[2]=1;id -G|grep -qw 80;v[1]=$?;((v[1]))||{ Q=7;sudo -v;v[2]=$?;((v[2]))||Q=8;};v[3]=`date +%s`;date '+Start time: %T %D%n';printf '\n[Process started]\n\n'>&4;printf 'Revision: %s\n\n' ${p[54]};};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};A'$((7+i))'() { v=` eval sudo "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};';done;A9(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=No;((v['$((i+1))']==0))&&v=;};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Ev "${v[$1]}"<<<"$v"|sort`;};C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "${s[63]}"<<<"$v"`&&C1 1 $1;};C4() { echo $'\t'"Part $((++P)) of $Q done at $((`date +%s`-v[3])) sec">&4;};C5() { sudo -k;pbcopy<<<"$o";exit 2>&-;};for i in 1 2 7 8;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;trap C5 2;o=$({ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 22;A1 0 $((N1+2)) 3;C0;A1 0 $((N1+15)) 74;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 $((N3+4));for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 0 $((N1+8)) 71 $((N3+3));D13 1 10 7 9;D13 1 11 8 10;B1&&D73 19 53 67 60;D22 2 12 9 11;D12 3 13 10 12;D22 6 36 13 15;D22 20 52 66 58;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;C4;B1&&{ D82 35 49 61 51;D82 11 17 17 20;D82 28 60 45 61;C4;D82 28 61 45 62;D82 28 62 75 56;D83 28 63 76 64;};D22 12 44 54 45;D22 12 39 15 21;D13 25 37 32 31;B1&&{ D73 21 0 32 19;D73 10 42 32 40;D82 29 35 46 2;};D12 34 43 53 44;D12 22 20 32 25;D22 0 $((N1+14)) 51 33;D12 21 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 38 5 68 50;D23 33 34 42 37;B1&&D83 35 45 55 46;D23 32 31 43 38;D23 4 19 44 13;B0&&{ C4;D13 5 55 69 53&&D23 6 58 31 59;D12 5 59 32 55;D13 5 54 70 63;D23 5 14 12 14;C4;};A1 13 40 18;B2 4;B4 4 5 19;A1 17 41 20;C4;B7 5;C3 8;B4 4 6 21;B4 4 7 22;B5 6 7;B3 6 6 73;B1&&{ A8 18 26 23;B7 6;B4 0 0 11;C3 23;};A2 18 26 23;B7 6;B4 0 0 11;C3 24;D13 4 21 24 26;D23 14 1 62 42;D13 37 2 48 43;D13 10 42 32 41;D12 36 47 32 48;A1 4 3 60;B2 30;A1 4 24 60;B2 31;B6 30 31 4;C3 5;D12 21 56 35 32;D12 21 48 49 49;B3 4 22 57;A1 21 46 56;B7 22;B3 0 0 58;C3 47;D13 5 7 69 54;D22 4 4 50 0;D12 4 51 32 1;D23 22 9 37 57;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;D13 4 8 41 52;C4;B4 4 12 26;for i in {0..3};do A1 0 $((N1+10+i)) 72;B7 12;B4 0 0 52;C3 $((N3+5+i));((i==2))&&C4;done;A1 24 22 29;B7 12;B2 14;A4 39 57 30 0;B2 15;B6 14 15 4;C3 29;B3 4 13 27;A1 24 23 32;B7 13;C3 30;B4 4 16 65;A1 26 50 64;B7 16;C3 6;D13 40 6 32 7;A9;C2 39;C4;} 4>&2 2>/dev/null;);C5

Copy the selected text to the Clipboard by pressing the key combination command-C.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be a series of messages in the Terminal window like this:

[Process started]

Part 1 of 8 done at … sec
…
Part 8 of 8 done at … sec

[Process completed]

The messages won't be spaced equally apart in time, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

Wait for the final message "Process completed" to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step.

12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I may not agree with them.

______________________________________________________________

Copyright © 2014, 2015 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 6

Jan 29, 2015 12:28 PM in response to sunflowerfibers

Hi,

Most of the time those items in the Console Log tend not to be very useful and are only used by engineers and support staff.

That is not to say they don't give clues sometimes.

The top third do seem to be about the OS not running that smoothly - the finder having issues, the Console app itself.

Then there are some about Chrome and CalendarAgent and your Gmail account which is probably having issues with syncing across your Mac, Google and any other device you have set up to sync using this info.

The very end is about MDS which is the Spotlight indexing (background) app.

As that is also about how th system runs then Linc's advice is probably best to follow first.

NOTE.

Tagging the post with "Messages" is about the app of that name not any place the OS or an app produces an alert of some kind.

It is very confusing as a lot of the documentation about the Mail app refers to emails as "messages"

8:28 pm Thursday; January 29, 2015

 iMac 2.5Ghz i5 2011 (Mavericks 10.9)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
 Couple of iPhones and an iPad

Reply

Answer 7

Jan 29, 2015 1:42 PM in response to Ralph-Johns-UK

here is the link http://pastebin.com/U5539zfF

Reply

Answer 8

Jan 30, 2015 1:38 AM in response to Linc Davis

new messages - http://pastebin.com/PngjseqV

Start time: 03:45:22 01/30/15

Revision: 1184

Model Identifier: MacBookPro5,1

System Version: OS X 10.10.1 (14B25)

Kernel Version: Darwin 14.0.0

Time since boot: 45 minutes

SerialATA

Hitachi HTS543232L9SA02

USB

FreeAgent GoFlex (Seagate LLC)

USB Receiver (Logitech Inc.)

FileVault: FileVault master keychain appears to be installed

Activity

CPU: user 66%, system 31%

CPU per process: syslog (UID 501) 66.4 percent

Forks

bash -> date (UID 501) x18

launchd -> launch (UID 501) x14

launch -> osascript (UID 501) x14

bash -> sleep (UID 501) x9

Font issues: 7

Firewall: On

DNS: 209.18.47.61 (static)

Listeners

kdc: kerberos

launchd: afpovertcp

launchd: microsoft-ds

launchd: printer

launchd: ssh

Diagnostic reports

2015-01-29 com.apple.appkit.xpc.openAndSavePanelService crash

2015-01-29 mds crash

I/O errors

disk3s0: 1

Volumes

disk0s2: /

disk1s3: /Volumes/FreeAgent

Shutdowns

cause: -128: 1

Log

Jan 30 03:50:00 memorystatus_thread: idle exiting pid 226 [com.apple.audio.]

Jan 30 03:50:01 memorystatus_thread: idle exiting pid 150 [nsurlsessiond]

Jan 30 03:50:02 memorystatus_thread: idle exiting pid 294 [sandboxd]

Jan 30 03:50:03 memorystatus_thread: idle exiting pid 312 [cloudd]

Jan 30 03:50:04 memorystatus_thread: idle exiting pid 56 [awdd]

Jan 30 03:50:06 memorystatus_thread: idle exiting pid 314 [nsurlsessiond]

Jan 30 03:50:06 memorystatus_thread: idle exiting pid 311 [fmfd]

Jan 30 03:50:07 memorystatus_thread: idle exiting pid 286 [accountsd]

Jan 30 03:50:09 memorystatus_thread: idle exiting pid 346 [AppleIDAuthAgent]

Jan 30 03:50:09 memorystatus_thread: idle exiting pid 258 [softwareupdated]

Jan 30 03:50:10 memorystatus_thread: idle exiting pid 405 [com.apple.InputM]

Jan 30 03:50:11 memorystatus_thread: idle exiting pid 414 [com.apple.notifi]

Jan 30 03:50:12 memorystatus_thread: idle exiting pid 282 [pkd]

Jan 30 03:50:13 memorystatus_thread: idle exiting pid 416 [CloudKeychainPro]

Jan 30 03:50:14 memorystatus_thread: idle exiting pid 237 [secinitd]

Jan 30 03:50:15 memorystatus_thread: idle exiting pid 489 [com.apple.BKAgen]

Jan 30 03:50:16 memorystatus_thread: idle exiting pid 780 [CallHistoryPlugi]

Jan 30 03:50:17 memorystatus_thread: idle exiting pid 86 [amfid]

Jan 30 03:50:18 memorystatus_thread: idle exiting pid 248 [iconservicesagen]

Jan 30 03:50:19 memorystatus_thread: idle exiting pid 47 [iconservicesd]

Jan 30 03:50:20 memorystatus_thread: idle exiting pid 98 [diagnosticd]

Jan 30 03:50:21 memorystatus_thread: idle exiting pid 52 [backupd-helper]

Jan 30 03:50:22 memorystatus_thread: idle exiting pid 205 [tccd]

Jan 30 03:50:23 memorystatus_thread: idle exiting pid 245 [CoreServicesUIAg]

Jan 30 03:50:24 memorystatus_thread: idle exiting pid 334 [spindump_agent]

Loaded kernel extensions

com.Cycling74.driver.Soundflower (1.6.6)

com.jft.driver.PdaNetDrv (1.0.64)

Daemons

com.adobe.fpsaud

com.aladdin.aksusbd

com.apple.Kerberos.kdc

- status: 1

com.apple.installer.osmessagetracing

com.iobit.AMCDaemon

com.macpaw.CleanMyMac2.Agent

com.memeo.Memeod

com.microsoft.office.licensing.helper

com.oracle.java.Helper-Tool

com.oracle.java.JavaUpdateHelper

com.period.searchprotectd

com.prosofteng.DriveGenius.locum

com.splashtop.streamer-daemon

com.splashtop.streamer-srioframebuffer

com.wdc.WDRAIDDriveService

com.westerndigital.WD-Drive-Manager-Installer

com.zeobit.MacKeeper.AntiVirus

com.zeobit.MacKeeper.plugin.AntiTheft.daemon

net.sourceforge.MonolingualHelper

org.macosforge.xquartz.privileged_startx

Agents

com.akamai.single-user-client

com.amazon.cloud-player

com.apple.AirPortBaseStationAgent

com.apple.FolderActions.enabled

com.apple.FolderActions.folders

com.crossrider.wss002497.agent.plist

com.epson.epw.agent4

com.evernote.EvernoteHelper

com.flashmall.updater

com.jdibackup.JustCloud.autostart

com.jdibackup.JustCloud.backupstart

com.jdibackup.MyPCBackup.autostart

- status: 78

com.jdibackup.ZipCloud.autostart

- status: 78

com.jdibackup.ZipCloud.notify

- status: 78

com.oracle.java.Java-Updater

com.rosettastone.rosettastonedaemon

com.seagate.SeagateStorageGauge.plist

com.splashtop.streamer-for-user

com.wdc.drivemanagerstatusmenu

com.webhelper

com.webtools.update.agent

com.zeobit.MacKeeper.Helper

org.macosforge.xquartz.startx

Startup items

/Library/StartupItems/FanControlDaemon/FanControlDaemon

/Library/StartupItems/FanControlDaemon/StartupParameters.plist

/Library/StartupItems/ParallelsDesktopTransporter/llipd

/Library/StartupItems/ParallelsDesktopTransporter/ParallelsTransporter

/Library/StartupItems/ParallelsDesktopTransporter/StartupParameters.plist

/Library/StartupItems/udmarket/MacOS/udmarket

/Library/StartupItems/udmarket/StartupParameters.plist

/Library/StartupItems/udmarket/udmarket

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Google Drive

- /Applications/Google Drive.app

TuneupMyMac

- missing value

WDQuickView

- missing value

Safari extensions

Amazon Shopping Assistant

- com.spigot.safari.amazonshopassist

Ebay Shopping Assistant

- com.spigot.safari.ebayshopassist

Omnibar

- com.genieo.safari

Searchme

- com.spigot.safari.searchme

Slick Savings

- com.spigot.safari.slicksavings

Widgets

iCal

iCloud errors

CallHistorySyncHelper: 1

bird: 31

Restricted files: 711

Lockfiles: 8

High file counts

Desktop: 57

Contents of /Library/LaunchAgents/com.epson.epw.agent.4.plist

- mod date: Nov 16 00:00:00 2009

- checksum: 558597248

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>KeepAlive</key>

<dict>

<key>PathState</key>

<dict>

<key>/Library/Printers/EPSON/InkjetPrinter2/Utility/UT4/IJEPWAgent4.app</key>

<true/>

</dict>

<key>Label</key>

<string>com.epson.epw.agent4</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Printers/EPSON/InkjetPrinter2/Utility/UT4/IJEPWAgent4.app/Cont ents/MacOS/IJEPWAgent4</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

- mod date: Mar 13 08:28:32 2013

- checksum: 1309176252

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.oracle.java.Java-Updater</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>

<string>-bgcheck</string>

</array>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

<key>Weekday</key>

</dict>

...and 1 more line(s)

Contents of /Library/LaunchAgents/com.rosettastone.rosettastonedaemon.plist

- mod date: Jun 24 04:55:31 2011

- checksum: 49023104

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.rosettastone.rosettastonedaemon</string>

<key>TimeOut</key>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/RosettaStoneDaemon/bin/RosettaStoneDaemon</string>

<string>--config</string>

<string>/Library/Application Support/RosettaStoneDaemon/bin/RosettaStoneDaemonConfiguration.txt</string>

</array>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.seagate.SeagateStorageGauge.plist

- mod date: Mar 10 11:38:47 2010

- checksum: 3262128215

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<!--

com.seagate.SeagateStorageGauge.plist

SeagateDiagnostics

Created by John Brisbin on 3/10/10.

-->

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.seagate.SeagateStorageGauge.plist</string>

<key>LimitLoadToSessionType</key>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Seagate/Seagate Storage Gauge.app/Contents/MacOS/Seagate Storage Gauge</string>

<string>-doautolnch</string>

<string>/Library/Application Support/Seagate/Seagate Storage Gauge.app</string>

</array>

<key>RunAtLoad</key>

...and 3 more line(s)

Contents of /Library/LaunchAgents/com.splashtop.streamer-for-root.plist

- mod date: Dec 7 22:23:31 2014

- checksum: 2759554987

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.splashtop.streamer-for-root</string>

<key>LimitLoadToSessionType</key>

<array>

<string>LoginWindow</string>

</array>

<key>KeepAlive</key>

<dict>

<key>SuccessfulExit</key>

<key>AfterInitialDemand</key>

</dict>

<key>RunAtLoad</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Applications/Splashtop Streamer.app/Contents/MacOS/Splashtop Streamer</string>

<string>RunAtPreLogin</string>

</array>

</dict>

...and 1 more line(s)

Contents of /Library/LaunchAgents/com.splashtop.streamer-for-user.plist

- mod date: Dec 7 22:23:31 2014

- checksum: 522106556

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.splashtop.streamer-for-user</string>

<key>LimitLoadToSessionType</key>

<array>

</array>

<key>KeepAlive</key>

<dict>

<key>SuccessfulExit</key>

<key>AfterInitialDemand</key>

</dict>

<key>RunAtLoad</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Applications/Splashtop Streamer.app/Contents/MacOS/Splashtop Streamer</string>

<string>RunAtLogin</string>

</array>

</dict>

...and 1 more line(s)

Contents of /Library/LaunchAgents/com.wdc.raidmanagerstatusmenu.plist

- mod date: Nov 11 17:53:29 2013

- checksum: 4114134447

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.wdc.drivemanagerstatusmenu</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/WDDriveManager/WDDriveManagerStatusMenu.app/Contents/MacOS/WDDriveManag erStatusMenu</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StandardErrorPath</key>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.yourcompany.RemoveAlert.plist

- mod date: Oct 19 22:56:37 2012

- checksum: 3361174727

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>EnvironmentVariables</key>

<dict>

<key>RUN_WITH_LAUNCHD</key>

</dict>

<key>Label</key>

<string>com.yourcompany.RemoveAlert</string>

<key>KeepAlive</key>

<dict>

<key>SuccessfulExit</key>

<true/>

</dict>

<key>LimitLoadToSessionType</key>

<array>

<string>LoginWindow</string>

</array>

<key>ThrottleInterval</key>

<key>Program</key>

<string>/Applications/Presto! PageManager 9.08/Presto! PageManager 9 XE.app/Contents/MacOS/Utilities/RemoveAlert.app/Contents/MacOS/RemoveAlert</str ing>

...and 4 more line(s)

Contents of /Library/LaunchAgents/org.macosforge.xquartz.startx.plist

- mod date: May 17 02:34:13 2014

- checksum: 2451978492

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>org.macosforge.xquartz.startx</string>

<key>ProgramArguments</key>

<array>

<string>/opt/X11/lib/X11/xinit/launchd_startx</string>

<string>/opt/X11/bin/startx</string>

<string>/opt/X11/bin/Xquartz</string>

</array>

<key>Sockets</key>

<dict>

<key>org.macosforge.xquartz:0</key>

<dict>

<key>SecureSocketWithKey</key>

<string>DISPLAY</string>

</dict>

<key>ServiceIPC</key>

<true/>

<key>EnableTransactions</key>

<true/>

...and 2 more line(s)

Contents of /Library/LaunchDaemons/com.aladdin.aksusbd.plist

- mod date: Feb 21 21:24:26 2014

- checksum: 2687272378

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.aladdin.aksusbd</string>

<key>ProgramArguments</key>

<array>

<string>/usr/libexec/aksusbd</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>OnDemand</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.iobit.AMCDaemon.plist

- mod date: Jun 23 17:06:46 2014

- checksum: 3248374927

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.iobit.AMCDaemon</string>

<key>UserName</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/AMC/AMCDaemon</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.macpaw.CleanMyMac2.Agent.plist

- mod date: Aug 2 22:43:17 2014

- checksum: 2214847194

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.macpaw.CleanMyMac2.Agent</string>

<key>MachServices</key>

<dict>

<key>com.macpaw.CleanMyMac2.Agent</key>

<true/>

</dict>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/com.macpaw.CleanMyMac2.Agent</string>

</array>

<key>ServiceIPC</key>

<true/>

<key>Sockets</key>

<dict>

<key>MasterSocket</key>

<dict>

<key>SockFamily</key>

<key>SockPathMode</key>

...and 8 more line(s)

Contents of /Library/LaunchDaemons/com.memeo.Memeod.plist

- mod date: Apr 20 11:20:40 2010

- checksum: 1306968288

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>GroupName</key>

<string>wheel</string>

<key>Label</key>

<string>com.memeo.Memeod</string>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Memeo/Memeo Backup/Daemons/Memeod</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>ServiceDescription</key>

<string>Memeo Backup support daemon</string>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

<key>UserName</key>

</dict>

...and 1 more line(s)

Contents of /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

- mod date: Apr 2 03:00:00 2012

- checksum: 998894468

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>MachServices</key>

<dict>

<key>com.microsoft.office.licensing.helper.port</key>

<true/>

</dict>

<key>Label</key>

<string>com.microsoft.office.licensing.helper</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper</s tring>

</array>

<key>ServiceIPC</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.perion.searchprotectd.plist

- mod date: Jan 16 23:08:05 2015

- checksum: 1209345832

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>AbandonProcessGroup</key>

<true/>

<key>EnableTransactions</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/SearchProtect/SearchProtect.app/Contents/MacOS/SearchProt ect</string>

<string>-execv_instance</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>Label</key>

<string>com.period.searchprotectd</string>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.prosofteng.DriveGenius.locum.plist

- mod date: Jun 29 07:53:37 2014

- checksum: 757526819

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>EnvironmentVariables</key>

<dict/>

<key>GroupName</key>

<string>wheel</string>

<key>KeepAlive</key>

<key>Label</key>

<string>com.prosofteng.DriveGenius.locum</string>

<key>MachServices</key>

<dict>

<key>com.prosofteng.DriveGenius.locum</key>

<true/>

</dict>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/com.prosofteng.DriveGenius.locum</string >

</array>

<key>RunAtLoad</key>

<key>UserName</key>

...and 2 more line(s)

Contents of /Library/LaunchDaemons/com.splashtop.streamer-daemon.plist

- mod date: Dec 7 22:23:31 2014

- checksum: 2644417781

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.splashtop.streamer-daemon</string>

<key>KeepAlive</key>

<true/>

<key>Program</key>

<string>/Applications/Splashtop Streamer.app/Contents/MacOS/SRStreamerDaemon</string>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.splashtop.streamer-srioframebuffer.plist

- mod date: Dec 7 22:23:30 2014

- checksum: 358314194

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.splashtop.streamer-srioframebuffer</string>

<key>KeepAlive</key>

<dict>

<key>SuccessfulExit</key>

<key>AfterInitialDemand</key>

</dict>

<key>RunAtLoad</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Applications/Splashtop Streamer.app/Contents/MacOS/SRIOFrameBuffer.app/Contents/MacOS/SRIOFrameBuffer< /string>

</array>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.wdc.WDRAIDDriveService.plist

- mod date: Nov 11 17:53:42 2013

- checksum: 769753352

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.wdc.WDRAIDDriveService</string>

<key>Program</key>

<string>/Library/Application Support/WDDriveManager/WDRAIDDriveService</string>

<key>RunAtLoad</key>

<true/>

<key>StandardErrorPath</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.westerndigital.WD-Drive-Manager-Installer.plist

- mod date: Jul 9 22:20:09 2014

- checksum: 3476412743

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.westerndigital.WD-Drive-Manager-Installer</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/com.westerndigital.WD-Drive-Manager-Inst aller</string>

</array>

<key>ServiceIPC</key>

<true/>

<key>Sockets</key>

<dict>

<key>MasterSocket</key>

<dict>

<key>SockFamily</key>

<key>SockPathMode</key>

<key>SockPathName</key>

...and 7 more line(s)

Contents of /Library/LaunchDaemons/com.zeobit.MacKeeper.AntiVirus.plist

- mod date: Jun 29 19:32:58 2012

- checksum: 4244331265

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<key>Label</key>

<string>com.zeobit.MacKeeper.AntiVirus</string>

<key>Program</key>

<string>/Library/Application Support/MacKeeper/AntiVirus.app/Contents/MacOS/AntiVirus</string>

<key>OnDemand</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

- mod date: Jun 29 18:42:28 2012

- checksum: 3798729423

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<key>Label</key>

<string>com.zeobit.MacKeeper.plugin.AntiTheft.daemon</string>

<key>Program</key>

<string>/Library/Application Support/MacKeeper/MacKeeperATd</string>

<key>OnDemand</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/net.sourceforge.MonolingualHelper.plist

- mod date: Feb 7 20:52:22 2014

- checksum: 4229206510

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>net.sourceforge.MonolingualHelper</string>

<key>MachServices</key>

<dict>

<key>net.sourceforge.MonolingualHelper</key>

<true/>

</dict>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/net.sourceforge.MonolingualHelper</strin g>

</array>

</dict>

</plist>

Contents of /etc/pam.d/prl_disp_service

- mod date: Jan 12 10:47:25 2010

- checksum: 1160556194

auth required pam_nologin.so

auth optional pam_afpmount.so

auth sufficient pam_securityserver.so nullok

auth sufficient pam_unix.so nullok

auth required pam_deny.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so

session optional pam_afpmount.so

Contents of /etc/pam.d/prl_disp_service.snow_leopard

- mod date: Jan 12 10:47:25 2010

- checksum: 2633576920

auth optional pam_krb5.so

auth optional pam_mount.so

auth sufficient pam_serialnumber.so serverinstall legacy

auth required pam_opendirectory.so

account required pam_nologin.so

account required pam_opendirectory.so

password required pam_deny.so

session required pam_launchd.so

session required pam_uwtmp.so

session optional pam_mount.so

auth optional pam_krb5.so

auth optional pam_mount.so

auth sufficient pam_serialnumber.so serverinstall legacy

auth required pam_opendirectory.so

account required pam_nologin.so

account required pam_opendirectory.so

password required pam_deny.so

session required pam_launchd.so

session required pam_uwtmp.so

session optional pam_mount.so

Contents of /etc/ssh_config

- mod date: Aug 8 17:50:38 2014

- checksum: 2841432291

Host *

SendEnv LANG LC_*

Host *

XAuthLocation /opt/X11/bin/xauth

Contents of /etc/sysctl.conf

- mod date: Jun 28 14:23:00 2010

- checksum: 1363423861

kern.sysv.shmall=65536

kern.sysv.shmmax=16777216

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist

- mod date: Aug 9 15:33:06 2012

- checksum: 2930943039

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Reader 9_/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.akamai.single-user-client.plist

- mod date: Nov 14 01:09:07 2014

- checksum: 125866552

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.akamai.single-user-client</string>

<key>KeepAlive</key>

<dict>

<key>SuccessfulExit</key>

</dict>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Applications/Akamai/netsession_mac</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>AbandonProcessGroup</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.amazon.cloud-player.plist

- mod date: Nov 17 20:58:55 2013

- checksum: 1833760484

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>EnableTransactions</key>

<key>Hidden</key>

<true/>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.amazon.cloud-player</string>

<key>Program</key>

<string>/Applications/Amazon Cloud Player.app/Contents/MacOS/Amazon Music Helper</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.apple.FolderActions.folders.plist

- mod date: Jan 30 03:04:36 2015

- checksum: 1189540302

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.apple.FolderActions.folders</string>

<key>Program</key>

<string>/usr/bin/osascript</string>

<key>ProgramArguments</key>

<array>

<string>osascript</string>

<string>tell application "Folder Actions Dispatcher" to tick</string>

</array>

<key>WatchPaths</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.crossrider.wss002497.agent.plist

- mod date: Jan 18 15:33:09 2015

- checksum: 2718398512

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.crossrider.wss002497.agent.plist</string>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/LaunchAgents/WebSocketServerApp</string>

<string>cmpId=2497</string>

<string>verifier=UUID</string>

<string>extId=67619</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.google.keystone.agent.plist

- mod date: Jan 23 18:29:46 2015

- checksum: 598896281

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.user.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.** ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.JustCloud.autostart.plist

- mod date: Jan 26 10:26:43 2015

- checksum: 1667347535

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.JustCloud.autostart</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/JustCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Applications/JustCloud.app/Contents/Resources/lib/python2.7/logs/launc hagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Applications/JustCloud.app/Contents/Resources/lib/python2.7/logs/launc hagent_err.log</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.JustCloud.backupstart.plist

- mod date: Jan 26 10:27:47 2015

- checksum: 587391257

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.JustCloud.backupstart</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/JustCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Applications/JustCloud.app/Contents/Resources/lib/python2.7/logs/launc hagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Applications/JustCloud.app/Contents/Resources/lib/python2.7/logs/launc hagent_err.log</string>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

...and 5 more line(s)

Contents of Library/LaunchAgents/com.jdibackup.MyPCBackup.autostart.plist

- mod date: Jan 7 15:54:34 2015

- checksum: 2135591238

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.MyPCBackup.autostart</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/MyPCBackup.app</string>

</array>

<key>StandardOutPath</key>

<string>/Applications/MyPCBackup.app/Contents/Resources/lib/python2.7/logs/laun chagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Applications/MyPCBackup.app/Contents/Resources/lib/python2.7/logs/laun chagent_err.log</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist

- mod date: Jan 23 18:31:20 2015

- checksum: 1930975077

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.autostart</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist

- mod date: Jan 23 18:31:20 2015

- checksum: 3980178305

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.notify</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>StartInterval</key>

<key>RunAtLoad</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.user.UninstallAD.plist

- mod date: Jun 23 18:21:45 2014

- checksum: 158010517

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<key>KeepAlive</key>

<key>Label</key>

<string>com.user.UninstallAD</string>

<key>LaunchOnlyOnce</key>

<true/>

<key>OnDemand</key>

<key>Program</key>

<string>/Users/USER/Library/Application Support/ErrorReporter/UninstallAD.app/Contents/MacOS/UninstallAD</string>

</dict>

</plist>

Contents of Library/LaunchAgents/com.webhelper.plist

- mod date: Jan 29 18:30:14 2015

- checksum: 4009907090

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.webhelper</string>

<key>EnableGlobbing</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Application Support/webHelperApp/launch</string>

<string>-source</string>

<string>-brand</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>OnDemand</key>

<true/>

<key>StandardErrorPath</key>

...and 6 more line(s)

Contents of Library/LaunchAgents/com.webtools.update.agent.plist

- mod date: Jan 18 15:33:18 2015

- checksum: 1882055082

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>EnableGlobbing</key>

<true/>

<key>KeepAlive</key>

<true/>

<key>Label</key>

<string>com.webtools.update.agent</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/WebTools/UpdateAgent/scheduler.sh</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

<key>ThrottleInterval</key>

</dict>

...and 1 more line(s)

Contents of Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist

- mod date: Jan 18 15:35:37 2015

- checksum: 799560669

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<key>EnvironmentVariables</key>

<dict>

<key>ZBTimeStamp</key>

</dict>

<key>Label</key>

<string>com.zeobit.MacKeeper.Helper</string>

<key>LimitLoadToSessionType</key>

<key>OnDemand</key>

<key>Program</key>

<string>/Applications/MacKeeper.app/Contents/Resources/MacKeeper Helper.app/Contents/MacOS/MacKeeper Helper</string>

</dict>

</plist>

Contents of Library/LaunchAgents/flashmall_updater.plist

- Apple binary property list

- mod date: Jan 18 15:33:01 2015

- checksum: 713717384

Dict {

StartInterval = 86400

ProgramArguments = Array {

bash

/Users/USER/Library/LaunchAgents/flashmall_updater.sh

}

Label = com.flashmall.updater

}

Bad plists

/Library/Preferences/com.gen.framework.plist

App extensions

com.getdropbox.dropbox.garcon

com.readitlater.PocketMac.AddToPocketShareExtension

Bad kernel extensions

/System/Library/Extensions/BJUSBLoad.kext

/System/Library/Extensions/ConexantCX2388X.kext

/System/Library/Extensions/MMInputFamily.kext

/System/Library/Extensions/PhilipsSAA7146.kext

/System/Library/Extensions/PrincipalMMInputs.kext

/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns/SeagateDriveIcons.kext

/System/Library/Extensions/TypicalDVBFrontends.kext

/System/Library/Extensions/UDMUtils.kext

/System/Library/Extensions/WD1394HPDriver.kext

/System/Library/Extensions/WDUSBHPDriver.kext

Elapsed time (sec): 2566