Slow Macbook with Kaspersky

I unistalled Kaspersky. Below is a new EtreCheck after the uninstall. What's next?


EtreCheck version: 2.1.8 (121)

Report generated February 15, 2015 at 5:26:20 PM GMT+7

Download EtreCheck from http://etresoft.com/etrecheck


Click the [Click for support] links for help with non-Apple products.

Click the [Click for details] links for more information about that line.


Hardware Information: ℹ️

MacBook Pro (13-inch, Mid 2012) (Technical Specifications)

MacBook Pro - model: MacBookPro9,2

1 2.5 GHz Intel Core i5 CPU: 2-core

4 GB RAM Upgradeable

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en1: 802.11 a/b/g/n

Battery Health: Normal - Cycle count 478


Video Information: ℹ️

Intel HD Graphics 4000

Color LCD 1280 x 800


System Software: ℹ️

OS X 10.9.5 (13F34) - Time since boot: 2:38:18


Disk Information: ℹ️

APPLE HDD TOSHIBA MK5065GSXF disk0 : (500.11 GB)

EFI (disk0s1) <not mounted> : 210 MB

Macintosh HD (disk0s2) / : 499.25 GB (221.76 GB free)

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB


MATSHITADVD-R UJ-8A8


USB Information: ℹ️

Apple Inc. FaceTime HD Camera (Built-in)

Apple Computer, Inc. IR Receiver

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Apple Inc. Apple Internal Keyboard / Trackpad


Thunderbolt Information: ℹ️

Apple Inc. thunderbolt_bus


Configuration files: ℹ️

/etc/hosts - Count: 2


Gatekeeper: ℹ️

Mac App Store and identified developers


Kernel Extensions: ℹ️

/System/Library/Extensions

[not loaded] com.XXYYZZ.driver.USBModemCDCACMData (1.1.7) [Click for support]

[not loaded] com.XXYYZZ.driver.USBModemMassStorageFilter (1.1.7) [Click for support]

[not loaded] com.ZTE.driver.ZTEUSBCDCACMData (1.3.7) [Click for support]

[not loaded] com.ZTE.driver.ZTEUSBMassStorageFilter (1.3.7) [Click for support]

[not loaded] com.devguru.driver.SamsungComposite (1.4.20 - SDK 10.6) [Click for support]

[loaded] com.eltima.SyncMate.kext (0.2.5b15) [Click for support]


/System/Library/Extensions/ssuddrv.kext/Contents/PlugIns

[not loaded] com.devguru.driver.SamsungACMControl (1.4.20 - SDK 10.6) [Click for support]

[not loaded] com.devguru.driver.SamsungACMData (1.4.20 - SDK 10.6) [Click for support]

[not loaded] com.devguru.driver.SamsungMTP (1.4.20 - SDK 10.5) [Click for support]

[not loaded] com.devguru.driver.SamsungSerial (1.4.20 - SDK 10.6) [Click for support]


Launch Agents: ℹ️

[running] cn.com.air.usbswapper.plist [Click for support]

[running] cn.com.zte.usbswapper.plist [Click for support]

[loaded] com.google.keystone.agent.plist [Click for support]

[running] syncmateStarter.plist [Click for support]


Launch Daemons: ℹ️

[running] cn.com.air.PPPMonitor.plist [Click for support]

[running] cn.com.zte.PPPMonitor.plist [Click for support]

[loaded] com.adobe.fpsaud.plist [Click for support]

[loaded] com.google.keystone.daemon.plist [Click for support]

[loaded] com.microsoft.office.licensing.helper.plist [Click for support]

[running] net.openvpn.client.plist [Click for support]

[running] rapiback.plist [Click for support]


User Launch Agents: ℹ️

[failed] com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist [Click for details]


User Login Items: ℹ️

iTunesHelper Application Hidden (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

OpenVPN Connect Application (/Applications/OpenVPN/OpenVPN Connect.app)

Wondershare Helper Compact Application (/Users/[redacted]/Library/Application Support/Helper/Wondershare Helper Compact.app)

SpeechSynthesisServer Application (/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks /SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app)

KiesAgent Application Hidden (/Applications/Kies.app/Contents/MacOS/KiesAgent.app)

fuspredownloader Application Hidden (/Users/[redacted]/Library/Application Support/.FUS/fuspredownloader.app)


Internet Plug-ins: ℹ️

Flip4Mac WMV Plugin: Version: 2.4.4.2 [Click for support]

FlashPlayer-10.6: Version: 16.0.0.305 - SDK 10.6 [Click for support]

Default Browser: Version: 537 - SDK 10.9

Flash Player: Version: 16.0.0.305 - SDK 10.6 Cannot contact Adobe

QuickTime Plugin: Version: 7.7.3

o1dbrowserplugin: Version: 5.40.2.0 - SDK 10.8 [Click for support]

SharePointBrowserPlugin: Version: 14.4.2 - SDK 10.6 [Click for support]

googletalkbrowserplugin: Version: 5.40.2.0 - SDK 10.8 [Click for support]

DirectorShockwave: Version: 12.1.3r153 - SDK 10.6 [Click for support]


User internet Plug-ins: ℹ️

UPEditor: Version: 1.0.0.3 - SDK 10.7 [Click for support]


Safari Extensions: ℹ️

Video Converter


3rd Party Preference Panes: ℹ️

Flash Player [Click for support]

Flip4Mac WMV [Click for support]

MacFUSE (Tuxera) [Click for support]


Time Machine: ℹ️

Skip System Files: NO

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 499.25 GB Disk used: 277.49 GB

Destinations:

Seagate Backup Plus Drive [Local]

Total size: 999.86 GB

Total number of backups: 6

Oldest backup: 2013-06-01 11:30:44 +0000

Last backup: 2015-01-28 12:27:07 +0000

Size of backup disk: Adequate

Backup size 999.86 GB > (Disk used 277.49 GB X 3)


Top Processes by CPU: ℹ️

4% WindowServer

0% ocspd

0% apsd

0% AppleSpell

0% Mac_SwapperDemon


Top Processes by Memory: ℹ️

189 MB mds_stores

112 MB Finder

82 MB com.apple.IconServicesAgent

56 MB OpenVPNConnect

56 MB openvpn-service


Virtual Memory Information: ℹ️

1.86 GB Free RAM

1.39 GB Active RAM

312 MB Inactive RAM

725 MB Wired RAM

446 MB Page-ins

0 B Page-outs


Diagnostics Information: ℹ️

Feb 15, 2015, 02:23:01 PM Self test - passed

Feb 15, 2015, 12:05:02 AM /Library/Logs/DiagnosticReports/Kernel_2015-02-15-000502_[redacted].panic [Click for details]

Feb 14, 2015, 11:46:34 PM /Library/Logs/DiagnosticReports/kav_2015-02-14-234634_[redacted].crash

MacBook Pro, OS X Mavericks (10.9.5)

Posted on Feb 15, 2015 2:39 AM

Reply
31 replies

Feb 18, 2015 4:51 AM in response to joshuaoneseven

Very good. Some leftovers:

In MacintoshHD->Library->LaunchAgents delete syncmate.starter plist

In MacintoshHD->Library->LaunchDaemons delete rapiback plist

In MacintoshHD->Library->InternetPlugins delete DirectorSchockwave plugin

I am not sure what the videoconverter extension does in Safari, perhaps uninstall it temporarily.

restart.

The question what caused the added lines in the hosts file is not answered.

If you don't mind you could post the hosts file text here:

in Finder click the GO menu while holding the Alt(option) key and choose "Go to Folder" in the field copy/paste /private/etc/ and search the "Hosts" file (just that no other hosts.. file), do nothing else as Copy that file and paste it to the Desktop; rename the hosts copy on the desktop to hostscopy , then open this file with Textedit, select all text and copy/paste it here in your answer post.

Lex

Feb 18, 2015 5:49 AM in response to Lexiepex

THANKS!

In MacintoshHD->Library->LaunchAgents delete syncmate.starter plist I DON'T SEE ANYTHING IN THAT FILE.

In MacintoshHD->Library->LaunchDaemons delete rapiback plist DELETED

In MacintoshHD->Library->InternetPlugins delete DirectorSchockwave plugin THERE ARE ONLY TWO THINGS IN THIS FOLDER, THAT'S NOT ONE OF THEM.

I am not sure what the videoconverter extension does in Safari, perhaps uninstall it temporarily. I DON'T SEE THAT EXTENSION.

HOSTS FILE TEXT: IT JUST HAS THE IP ADDRESS INFORMATION FOR MY ORGANIZATION'S VPN.

I'M RESTARTING NOW. IT'LL TAKE A WHILE IF NOTHING HAS CHANGES.

Feb 18, 2015 6:34 AM in response to joshuaoneseven

-- Syncmate: instead of /Library look if you find it in

MacintoshHD->System->Library->LaunchAgents

-- DirectorSchockwave: are you sure that there are only two items ? because etrecheck list (see the list) gives 8 files! check the InternetPlug-ins folder again. The DirectorSchockwave plugin is often causing issues.

-- videoconverter: Safari->Preferences->Extensions

Hosts file: very good, Like you predicted. Leave alone.

Feb 18, 2015 7:43 AM in response to Lexiepex

-- Syncmate: instead of /Library look if you find it in

MacintoshHD->System->Library->LaunchAgents FOUND IT. DELETED. I WAS LOOKINGS IN SYSTEM, BUT IT WAS JUST IN /LIBRARY/.

-- DirectorSchockwave: are you sure that there are only two items ? because etrecheck list (see the list) gives 8 files! check the InternetPlug-ins folder again. The DirectorSchockwave plugin is often causing issues. FOUND IT TOO. DELETED.

-- videoconverter: Safari->Preferences->Extensions CAN'T FIND IT. THE ONLY SAFARI FOLDER I SEE IS THE ONE WITH BOOKMARKS AND HISTORY.


RESTART WAS FASTER THIS TIME (3 MINUTES RATHER THAN 6). I'M STILL GETTING THE SPINNING BEACH BALL, BUT POSSIBLY LESS FREQUENTLY. HERE ARE THE LINES FROM THE CONSOLE FOR THE FIRST TIME I SAW THE SPINNING BEACH BALL AFTER STARTING UP. SEE ANYTHING INTERESTING?


2/18/15 10:36:03.056 PM findNames[265]: dispatch_semaphore_wait() time out: -[IMKUserDictionary reloadWithCompletionHandler:]

2/18/15 10:36:03.058 PM findNames[265]: findNames reload user dictionary error Error Domain=NSCocoaErrorDomain Code=4099 "Couldn’t communicate with a helper application." (The connection was invalidated from this process.) UserInfo=0x7fccd1f32dd0 {NSDebugDescription=The connection was invalidated from this process.}

2/18/15 10:36:03.861 PM com.apple.InputMethodKit.UserDictionary[268]: -[PFUbiquitySwitchboardEntryMetadata setUseLocalStorage:](760): CoreData: Ubiquity: bthompson~857FB5D7-AFDC-5D11-A2F6-C356112AAE5A:UserDictionary

Using local storage: 1

2/18/15 10:36:06.104 PM com.apple.InputMethodKit.UserDictionary[268]: -[PFUbiquitySwitchboardEntryMetadata setUseLocalStorage:](760): CoreData: Ubiquity: bthompson~857FB5D7-AFDC-5D11-A2F6-C356112AAE5A:UserDictionary

Using local storage: 0

2/18/15 10:36:47.887 PM fontd[181]: ATSFindFolder timeout. (domain:-32763, dirType:'font', createFolder:false, ATSServer pid:181)

2/18/15 10:37:05.787 PM mds[34]: (Normal) Volume: volume:0x7ffe69074c00 ********** Bootstrapped Creating a default store:0 SpotLoc:(null) SpotVerLoc:(null) occlude:0 /Volumes/firmwaresyncd.cjmqXj

2/18/15 10:37:18.376 PM Console[276]: setPresentationOptions called with NSApplicationPresentationFullScreen when there is no visible fullscreen window; this call will be ignored.

2/18/15 10:37:37.023 PM com.apple.IconServicesAgent[214]: main Failed to composit image for binding VariantBinding [0x285] flags: 0x8 binding: FileInfoBinding [0x187] - extension: gif, UTI: com.compuserve.gif, fileType: ????.

2/18/15 10:37:37.024 PM quicklookd[243]: Warning: Cache image returned by the server has size range covering all valid image sizes. Binding: VariantBinding [0x203] flags: 0x8 binding: FileInfoBinding [0x103] - extension: gif, UTI: com.compuserve.gif, fileType: ???? request size:16 scale: 1

2/18/15 10:37:37.055 PM com.apple.IconServicesAgent[214]: main Failed to composit image for binding VariantBinding [0x189] flags: 0x8 binding: FileInfoBinding [0x287] - extension: png, UTI: public.png, fileType: ????.

2/18/15 10:37:37.056 PM quicklookd[243]: Warning: Cache image returned by the server has size range covering all valid image sizes. Binding: VariantBinding [0x403] flags: 0x8 binding: FileInfoBinding [0x303] - extension: png, UTI: public.png, fileType: ???? request size:16 scale: 1

2/18/15 10:38:03.440 PM com.apple.IconServicesAgent[214]: main Failed to composit image for binding VariantBinding [0x289] flags: 0x8 binding: FileInfoBinding [0x18b] - extension: png, UTI: public.png, fileType: PNGf.

2/18/15 10:38:03.440 PM quicklookd[243]: Warning: Cache image returned by the server has size range covering all valid image sizes. Binding: VariantBinding [0x603] flags: 0x8 binding: FileInfoBinding [0x503] - extension: png, UTI: public.png, fileType: PNGf request size:16 scale: 1

2/18/15 10:38:08.840 PM com.apple.IconServicesAgent[214]: main Failed to composit image for binding VariantBinding [0x18d] flags: 0x8 binding: FileInfoBinding [0x28b] - extension: mp3, UTI: public.mp3, fileType: ????.

2/18/15 10:38:08.840 PM quicklookd[243]: Warning: Cache image returned by the server has size range covering all valid image sizes. Binding: VariantBinding [0x803] flags: 0x8 binding: FileInfoBinding [0x703] - extension: mp3, UTI: public.mp3, fileType: ???? request size:16 scale: 1

Feb 18, 2015 8:44 AM in response to joshuaoneseven

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a summary of what you need to do, if you choose to proceed:

☞ Copy a line of text in this window to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.

You may have started up in "safe" mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

Triple-click anywhere in the line of text below on this page to select it:

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(1247 ' 0.5 0.25 10 1000 15 5120 1000 25000 1 1 0 100 ' 51 25600 4 10 25 5120 102400 1000 25 1000 150 40 500 300 85 25 20480 262144 20 2000 524288 604800 5 );k=({Soft,Hard}ware Memory Diagnostics Power FireWire Thunderbolt USB Bluetooth SerialATA Extensions Applications Frameworks PrefPane Fonts Displays PCI UniversalAccess InstallHistory ConfigurationProfile AirPort 'com\.apple\.' -\\t N\\/A 'AES|atr|udit|msa|dnse|ax|ensh|fami|FileS|fing|ft[pw]|gedC|kdu|etS|is\.|alk|ODSA|otp|htt|pcas|ps-lp|rexe|rlo|rsh|smb|snm|teln|upd-[aw]|uuc|vix|webf' OSBundle{Require,AllowUserLoa}d 'Mb/s:per sec:ms/s:KiB/s:%:total:MB:total' 'Net in:Net out:I/O wait time:I/O requests:CPU usage:Open files:Memory:Mach ports:File opens:Forks:Failed forks:System errors' 'tsA|[ST]M[HL]' PlistBuddy{,' 2>&1'}' -c Print' 'Info\.plist' CFBundleIdentifier );f=('\n%s'{': ','\n\n'}'%s\n' '\nRAM details\n%s\n' %s{' ','\n'{"${k[22]}",}}'%s\n' '%d MB: %s\n' '\n ...and %s more line(s)\n' '\nContents of %s\n '"${k[22]}"'mod date: %s\n '"${k[22]}"'checksum: %s\n%s\n' );c=(879294308 4071182229 461455494 3627668074 1083382502 1274181950 1855907737 2758863019 1848501757 464843899 2636415542 3694147963 1233118628 2456546649 2806998573 2778718105 842973933 2051385900 3301885676 891055588 998894468 695903914 1443423563 4136085286 3374894509 1051159591 892310726 1707497389 523110921 2883943871 3873345487 );s=(' s/[0-9A-Za-z._]+@[0-9A-Za-z.]+\.[0-9A-Za-z]{2,4}/EMAIL/g;/faceb/s/(at\.)[^.]+/\1NAME/g;/\/Shared/!s/(\/Users\/)[^ /]+/\1USER/g;s/[-0-9A-Fa-f]{22,}/UUID/g;' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[4]} ' s/:$//;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: (E[^m]|[^EO])|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[9]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' BEGIN { FS=":";if(system("sw_vers -productVersion|grep -q ^10\.1")) d="^'"${k[21]}"'launch(d\.peruser\.[0-9]+|ctl\.(Aqua|Background|System))$";} { if($2~/[1-9]/) { $2="status: "$2;printf("'"${f[4]}"'",$1,$2);} else if(!d||$1!~d) print $1;} ' ' { sub(/ :/,"");print|"tail -n'${p[10]}'";} ' ' NR==2&&$4<='${p[7]}' { print $4;} ' ' ($1~"wir"&&$2>'${p[22]}')||($1~/P.+ts:/&&$2>'${p[19]}') { print $1" "int($2);} ' '/YLD/s/=/ /p' ' { q=$1;$1="";u=$NF;$NF="";gsub(/ +$/,"");print q":"$0":"u;} ' ' /^ {6}[^ ]/d;s/:$//;/([^ey]|[^n]e):/d;/e: Y/d;s/: Y.+//g;H;${ g;s/ \n (\n)/\1/g;s/\n +(M[^ ]+)[ -~]+/ (\1)/;s/\n$//;/( {8}[^ ].*){2,}/p;} ' 's:^:/:p;' ' !/, .+:/{print};END{if(NR<'{${p[12]},${p[13]}}')printf("^'"${k[21]}"'.+")} ' '|uniq' ' 1;END { print "/L.+/Scr.+/Templ.+\.app$";print "/L.+/Pri.+\.plugin$";if(NR<'{${p[14]},${p[21]}}') print "^/[Sp].+|'${k[21]}'";} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:.+//p;' '&&echo On' '/\.(bundle|component|framework|kext|mdimporter|plugin|qlgenerator|saver|wdgt)$/p' '/\.dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".","");print $0"$";} END { split("'"${c[*]}"'",c);for(i in c) print "\t"c[i]"$";} ' ' /^\/(Ap|Dev|Inc|Prev)/d;/((iTu|ok).+dle|\.(component|mailbundle|mdimporter|plugin|qlgenerator|saver|wdgt))$/p;' ' BEGIN{ FS="= "} $2 { gsub(/[()"]/,"",$2);print $2;} ' ' /^\//!d;s/^.{5}//;s/ [^/]+\//: \//p;' '>&-||echo No' '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[2]}'{$2=$2-1;print}' ' BEGIN { M1='${p[16]}';M2='${p[18]}';M3='${p[8]}';M4='${p[3]}';} !/^A/{next};/%/ { getline;if($5<M1) o["CPU"]="CPU: user "$2"%, system "$4"%";next;} $2~/^disk/&&$4>M2 { o[$2]=$2": "$3" ops/s, "$4" blocks/s";next;} $2~/^(en[0-9]|bridg)/ { if(o[$2]) { e=$3+$4+$5+$6;if(e) o[$2]=o[$2]"; errors "e"/s";next;};if($4>M3||$6>M4) o[$2]=$2": in "int($4/1024)", out "int($6/1024)" (KiB/s)";} END { for(i in o) print o[i];} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/)||(/v6:/&&$2!~/A/) ' ' BEGIN{FS=": "} /^ {10}O/ {exit} /^ {0,12}[^ ]/ {next} $1~"Ne"&&$2!~/^In/{print} $1~"Si" { split($2,a," ");if(a[1]-a[4]<'${p[5]}') print;};$1~"T"&&$2<'${p[20]}'{print};$1~"Se"&&$2!~"2"{print};' ' BEGIN { FS=":";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1;} ' ' BEGIN { split("'"${p[1]}"'",m);FS=":";} $2<=m[$1]{next} $1<9 { o[$1]=o[$1]"\n "$3" (UID "$4"): "$2;} $1==9&&$5!~"^/dev" { o[$1]=o[$1]"\n "$3" (UID "$4") => "$5" (status "$6"): "$2;} $1==10&&$5 { p="ps -c -ocomm -p"$5"|sed 1d";p|getline n;close(p);if(n) $5=n;o[$1]=o[$1]"\n "$5" => "$3" UID ("$4"): "$2;} $1~/1[12]/ { o[$1]=o[$1]"\n "$3" (UID "$4", error "$5"): "$2;} END { n=split("'"${k[27]}"'",u,":");for(i=n+1;i<n+5;i++)u[i]=u[2];split("'"${k[28]}"'",l,":");for(i in o) print "\n"l[i]" ("u[i]")\n"o[i];} ' ' /^ {8}[^ ]/{print} ' ' BEGIN { L='${p[17]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"cksum "F|getline C;split(C, A);C=A[1];"stat -f%Sm "F|getline D;"file -b "F|getline T;if(T~/^Apple b/) { f="";l=0;while("'"${k[30]}"' "F|getline g) { l++;if(l<=L) f=f"\n "g;};};if(T!~/^(AS.+ (En.+ )?text(, with v.+)?$|(Bo|PO).+ sh.+ text ex|XM)/) F=F"\n '"${k[22]}"'"T;printf("'"${f[8]}"'",F,D,C,f);if(l>L) printf("'"${f[7]}"'",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' 's/^.{52}(.+) <.+/\1/p' ' /id: N|te: Y/{i++} END{print i} ' ' /kext:/ { split($0,a,":");p=a[1];k[S]='${k[25]}';k[U]='${k[26]}';v[S]="Safe";v[U]="true";for(i in k) { s=system("'"${k[30]}"'\\ :"k[i]" \""p"\"/*/I*|grep -qw "v[i]);if(!s) a[1]=a[1]" "i;};if(!a[2]) a[2]="'"${k[23]}"'";printf("'"${f[4]}"'",a[1],a[2]);next;} !/^ *$/ { p="'"${k[31]}"'\\ :'"${k[33]}"' \""$0"\"/*/'${k[32]}'";p|getline b;close(p);if(b~/, .+:/||b=="") b="'"${k[23]}"'";printf("'"${f[4]}"'",$0,b);} ' '/ en/!s/\.//p' ' NR>=13 { gsub(/[^0-9]/,"",$1);print;} ' ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9|"sort|uniq";} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?'${k[32]}'$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ / [VY]/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' '/^find: /!p;' ' /^p/{ s/.//g;x;s/\nu/:/;s/(\n)c/\1:/;s/\n\n//;p;};H;' ' BEGIN{FS="= "} /Path/{print $2} ' ' /^ *$/d;s/^ */ /;p;' ' s/^.+ |\(.+\)$//g;p;' '1;END{if(NR<'${p[15]}')printf("^/(S|usr/(X|li))")}' ' /2/{print "WARN"};/4/{print "CRITICAL"};' ' /EVHF|MACR|^s/d;s/^.+: //p;' ' $3~/^[1-9][0-9]{0,2}(\.[1-9][0-9]{0,2}){2}$/ { i++;n=n"\n"$1"\t"$3;} END{ if(i>1)print n} ' s/{'\.|jnl: ','P.+:'}'//;s/ +([0-9]+)(.+)/\2 \1/p' ' /es: ./{ s/^.+://;b0'$'\n'' };/^ +C.+ted: +[NY]/H;/:$/b0'$'\n'' d;:0'$'\n'' x;/: +N/d;s/\n.+//p;' ' 1d;/:$/b0'$'\n'' $b0'$'\n'' /(D|^ *Loc.+): /{ s/^.+: //;H;};/(B2|[my]): /H;d;:0'$'\n'' x;/[my]: [AM]|m: I.+p$|^\/Vo/d;s/(^|\n) [ -~]+//g;s/(.+)\n(.+)/\2:\1/;s/\n//g;/[ -~]/p;' 's/$/:(0|-(4[34])?)$/p' '|sort'{'|uniq'{,\ -c},\ -nr} ' s/^/'{5,6,7,8}':/;s/ *: */:/g;p;' '/e:/{print $2}' ' /^[(]/{ s/....//;s/$/:/;N;/: [)]$/d;s/\n.+ ([^ ]+).$/\1/;H;};${ g;p;} ' 's/:.+$//p' '|wc -l' /{\\.{kext,xpc,'(appex|pluginkit)'}'\/(Contents\/)?'Info,'Launch[AD].+'}'\.plist$/p' 's/([-+.?])/\\\1/g;p' 's/, /\'$'\n/g;p' ' BEGIN{FS=":"} { printf("'"${f[6]}"'",$1/1048576,$2);} ' ' /= D/&&$1!~/'{${k[24]},${k[29]}}'/ { getline d;if(d~"t") D=D"\n"$1;} END { print D;} ' ' NR>1&&$3!~/0x|\.([0-9]{3,}|[-0-9A-F]{36})$/ { print $3":"$2;} ' '|tail -n'${p[6]} ' $1>1 { $NF=$NF" x"$1;} /\*/ { if(!f) f="\n\t* Code injection";} { $1="";} 1;END { print f;} ' ' s/.+bus /Bus: /;s/,.+[(]/ /;s/,.+//p;' ' { $NF=$NF" Errors: "$1;$1="";} 1 ' ' 1s/^/\'$'\n''/;/^ +(([MNPRSV]|De|Li).+|Bus): .|d: Y/d;s/:$//;$d;p;' ' BEGIN { RS=",";FS=":";} $1~"name" { gsub("\"","",$2);print $2;} ' '|grep -q e:/' '/[^ .]/p' '{ print $1}' ' /^ +N.+: [1-9]/ { i++;} END { if(i) print "system: "i;} ' ' NF { print "'{admin,user}' "$NF;exit;} ' ' /se.+ =/,/[\}]/!d;/[=\}]/!p ' ' 3,4d;/^ +D|Of|Fu| [0B]/d;s/^ |:$//g;$!H;${ x;/:/p;} ' ' BEGIN { FS=": ";} NR==1 { sub(":","");h="\n"$1"\n";} /:$/ { l=$1;next;} $1~"S"&&$2!~3 { getline;next;} /^ {6}I/ { i++;L[i]=l" "$2;if(i=='${p[24]}') nextfile;} END { if(i) print h;for(j=0;j<i;j++) print L[i-j];} ' ' /./H;${ x;s/\n//;s/\n/, /g;/,/p;} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps crontab kextfind top pkgutil "${k[30]}\\" echo cksum kextstat launchctl smcDiagnose sysctl\ -n defaults\ read stat lsbom 'mdfind -onlyin' env pluginkit scutil 'dtrace -q -x aggsortrev -n' security sed\ -En awk 'dscl . -read' networksetup mdutil lsof test osascript\ -e netstat mdls route cat );c2=(${k[21]}loginwindow\ LoginHook ' /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'" 'L*/Ca*/'${k[21]}'Saf*/E* -d 2 -name '${k[32]} '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' -i '-nl -print' '-F \$Sender -k Level Nle 3 -k Facility Req "'${k[21]}'('{'bird|.*i?clou','lsu|sha'}')"' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message CRne '0xdc008012|(allow|call)ing|(mplet|nabl)ed|ry HD|safe b|xpm' -k Message CReq 'bad |Can.t l|corru|dead|fail|GPU |hfs: Ru|inval|Limiti|v_c|NVDA[(]|pagin|Purg(ed|in)|error|Refus|TCON|tim(ed? ?|ing )o|trig|WARN' " '-** -n DEV -n EDEV 1 10' 'acrx -o%cpu,comm,ruid' "' syscall::recvfrom:return {@a[execname,uid]=sum(arg0)} syscall::sendto:return {@b[execname,uid]=sum(arg0)} syscall::open*:entry {@c[execname,uid,copyinstr(arg0),errno]=count()} syscall::execve:return, syscall::posix_spawn:return {@d[execname,uid,ppid]=count()} syscall::fork:return, syscall::vfork:return, syscall::posix_spawn:return /arg0<0/ {@e[execname,uid,arg0]=count()} syscall:::return /errno!=0/ {@f[execname,uid,errno]=count()} io:::wait-start {self->t=timestamp} io:::wait-done /self->t/ { this->T=timestamp - self->t;@g[execname,uid]=sum(this->T);self->t=0;} io:::start {@h[execname,uid]=sum(args[0]->b_bcount)} tick-10sec { normalize(@a,2560000);normalize(@b,2560000);normalize(@c,10);normalize(@d,10);normalize(@e,10);normalize(@f,10);normalize(@g,10000000);normalize(@h,10240);printa(\"1:%@d:%s:%d\n\",@a);printa(\"2:%@d:%s:%d\n\",@b);printa(\"9:%@d:%s:%d:%s:%d\n\",@c);printa(\"10:%@d:%s:%d:%d\n\",@d);printa(\"11:%@d:%s:%d:%d\n\",@e);printa(\"12:%@d:%s:%d:%d\n\",@f);printa(\"3:%@d:%s:%d\n\",@g);printa(\"4:%@d:%s:%d\n\",@h);exit(0);} '" '-f -pfc /var/db/r*/'${k[21]}'*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cght] ! -name .?\* ! -name \*ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;' '/S*/*/Ca*/*xpc*' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' /\ kMDItemContentTypeTree=${k[21]}{bundle,mach-o-dylib} :Label "/p*/e*/{aut*,{cron,fs}tab,hosts,{[lp],sy}*.conf,mach_i*/*,pam.d/*,ssh{,d}_config,*.local} {/p*,/usr/local}/e*/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t {/S*/,/,}L*/{Lau,Sec}*/*t .launchd.conf" list '-F "" -k Sender hidd -k Nle 3' /Library/Preferences/${k[21]}alf\ globalstate --proxy '-n get default' print\ system --dns -get{dnsservers,info} dump-trust-settings\ {-s,-d,} -n1 '-R -ce -l1 -n5 -o'{'prt -stats prt','mem -stats mem'}',command,uid' -kl -l -s\ / '--regexp --files '${k[21]}'pkg.*' '+c0 -i4TCP:0-1023' ${k[21]}dashboard\ layer-gadgets '-d /L*/Mana*/$USER' '-app Safari WebKitDNSPrefetchingEnabled' '-Fcu +c0 -l' -m 'L*/{Con*/*/Data/L*/,}Pref* -type f -size 0c -name *.plist.???????' kern.memorystatus_vm_pressure_level '3>&1 >&- 2>&3' '-F \$Message -k Sender kernel -k Message CReq "'{'n Cause: -','(a und|I/O |jnl_io.+)err','USBF:.+bus'}'"' -name\ kMDItem${k[33]} -T\ hfs '-n get default' -listnetworkserviceorder :${k[33]} :CFBundleDisplayName $EUID {,'/{S*/,}'}'L*/{,Co*/*/*/L*/}{Cache,Log}s $TMPDIR../C -type f -size +'${p[11]}'M -exec stat -f'%z:%N' {} \;' \ /v*/d*/*/*l*d{,.*.$UID}/* '-app Safari UserStyleSheetEnabled' 'L*/A*/Fi*/P*/*/a*.json' users/$USER\ HomeDirectory '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' ' -F "\$Time \$(Sender): \$Message" -k Level Nle 3 -k Facility R'{'ne "user|','eq "'}'console" -k Message CRne "[{}<>]|commit - no t|deprec|Goog|realp|sandbox ex|/root" ' getenv '/ "kMDItemDateAdded>=\$time.now(-'${p[23]}')&&kMDItem'${k[33]}'=*"' -m\ / '' );N1=${#c2[@]};for j in {0..20};do c2[N1+j]=SP${k[j]}DataType;done;l=({Restricted\ ,Lock,Pro}files POST Battery {Safari,App,{Bad,Loaded}\ kernel,Firefox}\ extensions System\ load boot\ args FileVault\ {2,1} {Kernel,System,Console}\ log Activity SMC Login\ hook 'I/O per process' 'High file counts' UID Daemons Agents XPC\ cache Startup\ items {Admin,Root}\ access Stylesheet Library\ paths{,' ('{shell,launchd}\)} Font\ issues Firewall Proxies DNS TCP/IP Wi-Fi 'Elapsed time (sec)' {Root,User}\ crontab {Global,User}' login items' Spotlight Memory\ pressure Listeners Widgets Parental\ Controls Prefetching Nets Volumes {Continuity,I/O,iCloud,HID,HCI}\ errors {User,System}\ {caches/logs,overrides} Shutdown\ codes Heat Diagnostic\ reports Bad\ plists Free\ space VM Bundles{,' (new)'} Trust\ settings );N3=${#l[@]};for i in {0..8};do l[N3+i]=${k[5+i]};done;F() { local x="${s[$1]}";[[ "$x" =~ ^([\&\|\<\>]|$) ]]&&{ printf "$x";return;};:|${c1[30]} "$x" 2>&-;printf "%s \'%s\'" "|${c1[30+$?]}" "$x";};A0() { Q=6;v[2]=1;id -G|grep -qw 80;v[1]=$?;((v[1]))||{ Q=7;sudo -v;v[2]=$?;((v[2]))||Q=8;};v[3]=`date +%s`;date '+Start time: %T %D%n';printf '\n[Process started]\n\n'>&4;printf 'Revision: %s\n\n' ${p[0]};};A1() { local c="${c1[$1]} ${c2[$2]}";shift 2;c="$c ` while [[ "$1" ]];do F $1;shift;done`";((P2))&&{ c="sudo $c";P2=;};v=`eval "$c"`;[[ "$v" ]];};A2() { local c="${c1[$1]}";[[ "$c" =~ ^(awk|sed ) ]]&&c="$c '${s[$2]}'"||c="$c ${c2[$2]}";shift 2;local d=` while [[ "$1" ]];do F $1;shift;done`;((P2))&&{ c="sudo $c";P2=;};local a;v=` while read a;do eval "$c '$a' $d";done<<<"$v";`;[[ "$v" ]];};A3(){ v=$((`date +%s`-v[3]));};B1() { v=No;! ((v[1]))&&{ v=;P1=1;};};eval "`type -a B1|sed '1d;s/1/2/'`";B3(){ v[$1]="$v";};B4() { local i=$1;local j=$2;shift 2;local c="cat` while [[ "$1" ]];do F $1;shift;done`";v[j]=`eval "{ $c;}"<<<"${v[i]}"`;};B5(){ v="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d$'\e' <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F$'\e' ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`egrep -v "${v[$1]}"<<<"$v"|sort`;};eval "`type -a B7|sed '1d;s/7/8/;s/-v //'`";C0() { [[ "$v" ]]&&sed -E "$s"<<<"$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v"|sed -E "$s";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { B4 0 0 63&&C1 1 $1;};C4() { echo $'\t'"Part $((++P)) of $Q done at $((`date +%s`-v[3])) sec">&4;};C5() { sudo -k;pbcopy<<<"$o";printf '\n\tThe test results are on the Clipboard.\n\n\tPlease close this window.\n';exit 2>&-;};for i in 1 2;do eval D$((i-1))'() { A'$i' $@;C0;};';for j in 2 3;do eval D$((i+2*j-3))'() { local x=$1;shift;A'$i' $@;C'$j' $x;};';done;done;trap C5 2;o=$({ A0;D0 0 N1+1 2;D0 0 $N1 1;B1;C2 27;B1&&! B2&&C2 28;D2 22 15 63;D0 0 N1+2 3;D0 0 N1+15 17;D4 3 0 N1+3 4;D4 4 0 N1+4 5;D4 N3+4 0 N1+9 59;D0 0 N1+16 99; for i in 0 1 2;do D4 N3+i 0 N1+5+i 6;done;D4 N3+3 0 N1+8 71;D4 62 1 10 7;D4 10 1 11 8;B2&&D4 18 19 53 67;D2 11 2 12 9;D2 12 3 13 10;D2 13 32 70 101 25;D2 65 6 76 13;D2 45 20 52 66;D4 66 7 77 14;D4 17 8 15 38;D0 9 16 16 77 45;C4;B2&&D0 35 49 61 75 76 78 45;B2&&{ D0 28 17 45;C4;};D0 12 40 54 16 79 45;D0 12 39 54 16 80 45;D4 31 25 77 15&&{ B4 0 8 103;B4 8 0;A2 18 74;B6 8 0 3;C3 32;};B2&&D4 19 21 0;B2&&D4 40 10 42;D2 2 0 N1+19 46 84;D2 44 34 43 53;D2 25 22 20 32;D2 33 0 N1+14 51;for i in {0..2};do A1 29 35+i 104+i;B3 25+i;done;B6 25 27 5;B6 0 26 5;B4 0 0 110;C2 69;D2 34 21 28 35;D4 35 27 29 36;A1 40 59 81;B3 18;A1 33 60 82;B8 18;B4 0 19 83;A1 27 32 39&&{ B3 20;B4 19 0;A2 33 33 40;B3 21;B6 20 21 3;};C2 36;D4 50 38 5 68;B4 19 0;D5 37 33 34 42;B2&&D4 46 35 45 55;D4 38 0 N1+20 43;B2&&D4 59 4 65 76 91;D4 63 4 19 44 75 95 96;B1&&{ D4 53 5 55 75 69&&D4 51 6 58 31;D4 56 5 56 97 75 98&&D0 0 N1+7 99;D2 55 5 27 84;D4 61 5 54 75 70;D4 14 5 14 12;D4 15 5 72 12;C4;};D4 16 5 73 12;A1 13 44 74 18;C4;B3 4;B4 4 0 85;A2 14 61 89;B4 0 5 19 102;A1 17 41 50;B7 5;C3 8;B4 4 0 88;A2 14 24 89;C4;B4 0 6 19 102;B4 4 0 86;A2 14 61 89;B4 0 7 19 102;B5 6 7;B4 0 11 73 102;A1 18 31 107 94 74||{ B2&&A1 18 26 94 74;}&&{ B7 11;B4 0 0 11;C3 23;};A1 18 26 94;B7 11;B4 0 0 11;C3 24;D4 60 14 66 92;D4 58 14 67 93;D4 26 4 21 24;D4 42 14 1 62;D4 43 37 2 90 48;D4 41 10 42;D2 48 36 47 25;A1 4 3 60&&{ B3 9;A2 14 61;B4 0 10 21;B4 9 0;A2 14 62;B4 0 0 21;B6 0 10 4;C3 5;};D4 9 41 69 100;D2 29 21 68 35;D2 49 21 48 49;B4 4 22 57 102;A1 21 46 56 74;B7 22;B4 0 0 58;C3 47;D4 54 5 7 75 76 69;D4 52 5 8 75 76 69;D4 57 4 64 76 91;D2 0 4 4 84;D2 1 4 51 84;D4 21 22 9 37;D0 0 N1+17 108; A1 23 18 28 89;B4 0 16 22 102;A1 16 25 33;B7 16;B4 0 0 34;D1 31 47;D4 64 4 71 41;C4;B4 4 12 26 89 23 102;for i in {0..3};do A1 0 N1+10+i 72 74;B7 12;B4 0 0 52;C3 N3+5+i;((i))||C4;done;A1 24 22 29;B7 12;B3 14;A2 39 57 30;B3 15;B6 14 15 4;C3 67;A1 24 75 74;B3 23;A2 39 57 30;B3 24;B6 23 24 4;C3 68;B4 4 13 27 89 65;A1 24 23;B7 13;C3 30;B4 4 0 87;A2 14 61 89 20;B4 0 17;A1 26 50 64;B7 17;C3 6;D0 0 N1+18 109;D4 7 11 6;A3;C2 39;C4;} 4>&2 2>/dev/null;);C5

Copy the selected text to the Clipboard by pressing the key combination command-C.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

[Process started]

Part 1 of 8 done at … sec

Part 8 of 8 done at … sec

The test results are on the Clipboard.

Please close this window.

[Process completed]

The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.

12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I may not agree with them.

______________________________________________________________

Copyright © 2014, 2015 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Feb 19, 2015 1:39 AM in response to Linc Davis

Start time: 16:25:45 02/19/15



Revision: 1247



Model Identifier: MacBookPro9,2

System Version: OS X 10.9.5 (13F34)

Kernel Version: Darwin 13.4.0

Time since boot: 17:17



UID: 501



Bluetooth



PAN Network Access Profile, Handsfree Gateway, Audio Source, AVRCP Device, MAP MAS-iOS, Wireless iAP, AVRCP Device



I/O wait time (ms/s)



find (UID 501): 933



File opens (per sec)



system_profiler (UID 501) => /System/Library/SystemProfiler/SPFontReporter.spreporter/Contents/Resources/SPP roperties.plist (status 0): 228

system_profiler (UID 501) => /System/Library/PrivateFrameworks/SPSupport.framework/Resources/SPProperties.pl ist (status 0): 228

security (UID 501) => /System/Library/Keychains/SystemTrustSettings.plist (status 0): 23



Font issues: 37



TCP/IP



Subnet mask: 255.255.255.240



Listeners



kdc: kerberos

launchd: afpovertcp

launchd: microsoft-ds



System caches/logs



1340 MB: /System/Library/Caches/com.apple.coresymbolicationd/data



Diagnostic reports



2015-01-29 iTunes hang

2015-02-11 crash

2015-02-12 Safari hang

2015-02-16 Kernel panic

2015-02-16 kav crash

2015-02-19 TextEdit hang

2015-02-19 mdworker crash x2



Shutdown codes



-60 1



Kernel log



Feb 19 15:51:51 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 15:52:17 SMC::smcReadKeyAction ERROR MACR kSMCKeyNotReadable(0x85) fKeyHashTable=0x0xffffff800d8a2000

Feb 19 15:53:56 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 15:56:13 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 15:56:52 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 15:57:25 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 15:59:35 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:00:14 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:03:15 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:05:53 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:07:53 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:08:02 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:08:41 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:11:06 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:15:53 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:16:02 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:19:57 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:20:13 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:21:33 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:21:48 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:23:11 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:23:27 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:24:53 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Suspend -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:25:01 **** [IOBluetoothHostControllerUSBTransport][SuspendDevice] -- Resume -- suspendDeviceCallResult = 0x0000 (kIOReturnSuccess) -- 0x7000 ****

Feb 19 16:26:02 SMC::smcReadKeyAction ERROR MACR kSMCKeyNotReadable(0x85) fKeyHashTable=0x0xffffff800d8a2000



System log



Feb 18 23:10:32 loginwindow: Login Window Started Security Agent

Feb 18 23:10:33 loginwindow: Login Window - Returned from Security Agent

Feb 18 23:10:38 accountsd: assertion failed: 13F34: liblaunch.dylib + 25164 [UUID]: 0x25

Feb 18 23:10:38 SocialPushAgent: ApplePushService: APSConnection being used without a delegate queue

Feb 18 23:10:40 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2

Feb 18 23:10:45 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2

Feb 18 23:10:45 _appleevents: /usr/libexec/ntpd-wrapper: scutil key State:/Network/Global/DNS not present after 30 seconds

Feb 18 23:10:48 _appleevents: Unable to resolve hostname(s)

Feb 18 23:11:52 parentalcontrolsd: StartObservingFSEvents [849:] -- *** StartObservingFSEvents started event stream

Feb 18 23:32:16 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2

Feb 18 23:37:50 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

Feb 19 00:03:10 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2

Feb 19 00:17:02 mDNSResponder: getExtendedFlags: SIOCGIFEFLAGS failed, errno = 6 (Device not configured)

Feb 19 00:17:02 mDNSResponder: getExtendedFlags: SIOCGIFEFLAGS failed, errno = 6 (Device not configured)

Feb 19 07:50:45 BezelServices 240.49: __BezelUI_ShowImageMeter_block_invoke failed to contact BezelUIServer due to error 0x10000004: (ipc/send) timed out

Feb 19 07:51:34 GoogleSoftwareUpdateDaemon: -[KSOutOfProcessFetcher(PrivateMethods) helperDidTerminate:] The Internet connection appears to be offline. [NSURLErrorDomain:-1009] (The Internet connection appears to be offline. [kCFErrorDomainCFNetwork:-1009])

Feb 19 07:51:37 GoogleSoftwareUpdateDaemon: -[KSOutOfProcessFetcher(PrivateMethods) helperDidTerminate:] The Internet connection appears to be offline. [NSURLErrorDomain:-1009] (The Internet connection appears to be offline. [kCFErrorDomainCFNetwork:-1009])

Feb 19 07:51:45 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2

Feb 19 08:05:22 GoogleSoftwareUpdateDaemon: -[KSOutOfProcessFetcher(PrivateMethods) helperDidTerminate:] The Internet connection appears to be offline. [NSURLErrorDomain:-1009] (The Internet connection appears to be offline. [kCFErrorDomainCFNetwork:-1009])

Feb 19 08:05:23 GoogleSoftwareUpdateDaemon: -[KSOutOfProcessFetcher(PrivateMethods) helperDidTerminate:] The Internet connection appears to be offline. [NSURLErrorDomain:-1009] (The Internet connection appears to be offline. [kCFErrorDomainCFNetwork:-1009])

Feb 19 15:30:49 com.apple.CrashReporter.ACRRDaemonPlugin: Submission failed with the launch daemon: (null)

Feb 19 15:36:41 fseventsd: log dir: /Volumes/GREY THUMB/.fseventsd getting new uuid: UUID

Feb 19 15:41:51 com.apple.CrashReporter.ACRRDaemonPlugin: Submission failed with the launch daemon: (null)

Feb 19 15:45:41 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2

Feb 19 16:12:08 xpcproxy: assertion failed: 13F34: xpcproxy + 3438 [UUID]: 0x2



Console log



Feb 18 16:51:06 com.apple.launchd: Exited with code: 99

Feb 18 16:51:15 com.apple.launchd: Exited with code: 99

Feb 18 16:51:25 com.apple.launchd: Exited with code: 99

Feb 18 16:51:36 com.apple.launchd: Exited with code: 99

Feb 18 17:06:15 com.apple.launchd: Exited with code: 1

Feb 18 17:06:46 com.apple.launchd.peruser.501: Exited with code: 2

Feb 18 18:11:03 com.apple.launchd: Exited with code: 210

Feb 18 19:23:03 com.apple.launchd: Could not terminate job: 3: No such process

Feb 18 19:23:03 com.apple.launchd: Exited with code: 1

Feb 18 20:57:38 com.apple.launchd: Could not terminate job: 3: No such process

Feb 18 20:57:38 com.apple.launchd: Exited with code: 1

Feb 18 21:03:14 com.apple.launchd: Exited with code: 1

Feb 18 22:30:14 com.apple.launchd: Could not terminate job: 3: No such process

Feb 18 22:30:14 com.apple.launchd: Exited with code: 1

Feb 18 22:32:47 com.apple.launchd: Exited with code: 1

Feb 18 22:44:08 com.apple.launchd: Exited with code: 1

Feb 18 23:04:07 com.apple.launchd: Exited with code: 1

Feb 18 23:04:17 com.apple.launchd: Exited with code: 1

Feb 18 23:05:35 com.apple.launchd: Exited with code: 1

Feb 18 23:10:12 com.apple.launchd: Exited with code: 1

Feb 18 23:15:18 com.apple.launchd.peruser.501: Exited with code: 1

Feb 18 23:20:15 com.apple.launchd: Exited with code: 1

Feb 18 23:33:19 com.apple.launchd.peruser.501: Exited with code: 1

Feb 19 00:04:34 com.apple.launchd: Could not terminate job: 3: No such process

Feb 19 00:04:34 com.apple.launchd: Exited with code: 1



Daemons



com.adobe.fpsaud

com.google.keystone.daemon

com.microsoft.office.licensing.helper



Agents



com.google.keystone.system.agent

Feb 19, 2015 8:12 AM in response to Linc Davis

I've tried to run it several times and the one I posted is the furthest I could get through the process without it taking hours), but I also wanted to give you some additional information:


- A couple weeks ago, a coworker (I work overseas) gave me back my USB drive (GREY THUMB in the report) with about 40 viruses caught by Kaspersky. I ended up reformatting the drive and then I used it to share some files with someone else. Copying these files over took an unusually long time. The next day is when the computer started to hang up (that was the next time I used it).

- I had to share some files with that same coworker again a couple days ago. Now I was using my wife's MacBook Air because my computer was unusable. Her Kaspersky caught another 40 viruses and I reformatted it last night using her computer.

- Today I was using her computer and it was fine for about two hours then it suddenly shut down and would not turn back on. Nothing. Just dead. I thought it might have been some water that got sprayed on the screen during those two hours, but it wasn't much and I wiped it up right away. I was thinking it may have dripped down in the vent below the screen, but then I saw GREY THUMB mentioned on your report.

- I know Mac's don't usually have virus problems, but could sharing this USB drive have taken out both computers?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Slow Macbook with Kaspersky

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.