vEiSaLgIa
Level 1 (1 points)

Q: Kernel Task, 100%CPU, Fans high, machine hot, software issue. How do I track down cause?

Hi,

I have a 17 inch i7 MBP. About two months ago I installed a new hybrid drive and restored from original (sick) drive. Soon afterward my CPU usage started spiking because of a kernel task. It slows my machine to a crawl, overheats and the fans go out of control. It is pretty much unusable. It is a software issue because I made a new user and none of the problems could be duplicated on it. How can I figure out what software on my main user is responsible for the task and what kext or other files are responsible for it? How can I get more info on this kernel task being run? It's got to be in my user folder...

 

PS: I had Webroot security on the machine and the unusual uninstall process may have had errors. It can't be run again. I attempted to uninstall it around the same time I changed the drive.

OS X Mavericks (10.9.2)

Posted on May 2, 2015 1:18 PM

by cdhw,Apple recommended
cdhw cdhw
Level 4 (2,628 points)
Servers Enterprise
A:

Start by running EtreCheck and posting the results here:

 

     http://www.etresoft.com/etrecheck

 

C.

Posted on May 3, 2015 10:55 AM

Close
vEiSaLgIa

Q: Kernel Task, 100%CPU, Fans high, machine hot, software issue. How do I track down cause?

  • All replies
  • Helpful answers

Previous Page 2 of 3 last Next

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 6, 2015 2:43 PM in response to vEiSaLgIa
    Level 1 (1 points)
    May 6, 2015 2:43 PM in response to vEiSaLgIa

    What I would REALLY love to do is somehow find out what this kernel task is exactly and what caused it.


    This machine has been running flawlessly for many years until last month. I really want to know what changed things so abruptly.

     

    Thank You

    V

  • by thomas_r.,

    thomas_r. thomas_r. May 6, 2015 4:26 PM in response to vEiSaLgIa
    Level 7 (30,889 points)
    Mac OS X
    May 6, 2015 4:26 PM in response to vEiSaLgIa

    vEiSaLgIa wrote:

     

    Can I start by executing this command to list all third party kernel extensions: kextstat | grep -v com.apple ?

     

    If you like, but that information is already present in your EtreCheck report, broken down by where those kernel extensions are located.

  • by Linc Davis,

    Linc Davis Linc Davis May 6, 2015 6:49 PM in response to vEiSaLgIa
    Level 10 (207,931 points)
    Applications
    May 6, 2015 6:49 PM in response to vEiSaLgIa

    Does that sound like a solid plan?

    No. You could be screwing around for weeks that way and only make things worse.

    Can you add to or improve my plan?

    I've told you what I think you should do. If you want to remove system modifications piecemeal, the only way to do it is to follow the developers' instructions. Hunting for files to delete will not work.

  • by Eric Root,

    Eric Root Eric Root May 7, 2015 2:46 PM in response to vEiSaLgIa
    Level 9 (70,183 points)
    iTunes
    May 7, 2015 2:46 PM in response to vEiSaLgIa

    /etc/hosts file - Fixing a hacked

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 7, 2015 5:30 PM in response to Linc Davis
    Level 1 (1 points)
    May 7, 2015 5:30 PM in response to Linc Davis

    Linc,

    Please keep in mind, In most cases I'd recommend the same. I am a tech (mostly audio) and I am trying to learn more about this side of things.

    I ordered another drive to create a fresh work drive but I really love this stuff and I like to act as if I cannot start over for the learning experience. You gave me great advice for a normal user. Thank you for that. I flirt with danger often (instal anything I'm curious about) just to learn how to fix the ensuing problem. This issue stumped me so I'm reaching out for some "next level" knowledge to find the problem and correct it.

     

    I am going to try to track down the apps responsible for the extensions and remove them as per the manufacturers recommendations.

     

    Is there any way that you know of that I can see what the kernel task is actually doing? I am incredibly curious about it. I watched console but it was inconclusive so far. I'll have to do it for a longer time.

     

    Thanks for your help!

    V

  • by cdhw,

    cdhw cdhw May 7, 2015 5:38 PM in response to vEiSaLgIa
    Level 4 (2,628 points)
    Servers Enterprise
    May 7, 2015 5:38 PM in response to vEiSaLgIa

    This is what you need to do:

     

         https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelPr ogramming/build/build.html

     

    This explains how to build a debug kernel, which you can then use standard instruments (or your own custom hooks) to investigate.

     

    C.

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 7, 2015 6:03 PM in response to Eric Root
    Level 1 (1 points)
    May 7, 2015 6:03 PM in response to Eric Root

    Eric!

    I'm on it!!

     

    Thank you so much!

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 7, 2015 6:06 PM in response to cdhw
    Level 1 (1 points)
    May 7, 2015 6:06 PM in response to cdhw

    Cdhw,

    That sounds like something I'd love to learn to do. I'll investigate that link.

     

     

    Thank You!

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 7, 2015 6:50 PM in response to Eric Root
    Level 1 (1 points)
    May 7, 2015 6:50 PM in response to Eric Root

    Eric,

    I replaced my hosts file. It didn't help but I'm glad I did it. There has been no need for that mod for quite some time .

     

    Thank You

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 7, 2015 7:31 PM in response to vEiSaLgIa
    Level 1 (1 points)
    May 7, 2015 7:31 PM in response to vEiSaLgIa

    I am seeing QUITE a bit of this:

    5/7/15 10:21:04.122 PM nsurlstoraged[322]: Error: stepSQLStatement:toCompletionWithRetry - stepping returned unhandled result=11, DB=/Users/studiogeek/Library/Caches/com.apple.Safari/Cache.db

     

    And a bit of this:

    5/7/15 10:21:02.654 PM com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

     

    I had Spigot and Conduit. I removed them manually and then ran Adware Medic but perhaps there is something left of them.

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 7, 2015 7:57 PM in response to vEiSaLgIa
    Level 1 (1 points)
    May 7, 2015 7:57 PM in response to vEiSaLgIa

    I'm pretty sure this is my problem:

     

    5/7/15 10:41:52.383 PM nsurlstoraged[322]: Error: stepSQLStatement:toCompletionWithRetry - stepping returned unhandled result=11, DB=/Users/studiogeek/Library/Caches/com.apple.Safari/Cache.db

     

    Every time I start Safari I see it constantly. I deleted the cache files and the kernel task CPU is down dramatically (so far). The console has quieted down as well.

     

    Thanks

  • by vEiSaLgIa,

    vEiSaLgIa vEiSaLgIa May 8, 2015 10:24 AM in response to vEiSaLgIa
    Level 1 (1 points)
    May 8, 2015 10:24 AM in response to vEiSaLgIa

    Looks like it is fixed. Kernel task averages 2% of CPU now. It was as high as 950% before.

     

    Watching the console, researching the out of control processes and finding out what is responsible and how to uninstall it did the trick.

     

    Thanks to everyone that put time and energy into this.

  • by grufnmuf,

    grufnmuf grufnmuf Jul 2, 2015 2:53 AM in response to Linc Davis
    Level 1 (0 points)
    Jul 2, 2015 2:53 AM in response to Linc Davis

    I keep trying to post the results of my terminal diagnostic test here - but the reply doesn't seem to be "taking".
    and, strangely enough, when I open a reply window, it tells me that "Your content was last auto-saved at 2:52 AM"

    - when I didn't start typing until about 10:30 am this morning.

  • by JDACHE,

    JDACHE JDACHE Nov 11, 2015 8:39 PM in response to cdhw
    Level 1 (0 points)
    Nov 11, 2015 8:39 PM in response to cdhw

    EtreCheck version: 2.6.3 (223)

    Report generated 11/11/15, 10:34 PM

    Runtime 1:49

    Download EtreCheck from http://etresoft.com/etrecheck

     

    Click the [Click for support] links for help with non-Apple products.

    Click the [Click for details] links for more information about that line.

     

    Hardware Information: (What does this mean?)

        MacBook Air (13-inch, Mid 2013)

        [Click for Technical Specifications]

        [Click for User Guide]

        MacBook Air - model: MacBookAir6,2

        1 1.3 GHz Intel Core i5 CPU: 2-core

        4 GB RAM Not upgradeable

                BANK 0/DIMM0

                2 GB DDR3 1600 MHz ok

            BANK 1/DIMM0

                2 GB DDR3 1600 MHz ok

        Bluetooth: Good - Handoff/Airdrop2 supported

        Battery: Health = Normal - Cycle count = 296 - SN = D8633170A48F90KA6

     

    Video Information: (What does this mean?)

        Intel HD Graphics 5000

            Color LCD 1440 x 900

     

    System Software: (What does this mean?)

        OS X Yosemite 10.10.5 (14F27) - Time since boot: about one hour

     

    Disk Information: (What does this mean?)

        APPLE SSD SD0128F disk0 : (121.33 GB) (Solid State - TRIM: Yes)

            EFI (disk0s1) <not mounted> : 210 MB

            Macintosh HD  (disk0s2) / : 120.47 GB (36.40 GB free)

            Recovery HD (disk0s3) <not mounted>  [Recovery]: 650 MB

     

    USB Information: (What does this mean?)

        Apple Internal Memory Card Reader

        Apple Inc. iPhone

     

    Thunderbolt Information: (What does this mean?)

        Apple Inc. thunderbolt_bus

     

    Gatekeeper: (What does this mean?)

        Mac App Store and identified developers

     

    Launch Agents: (What does this mean?)

        [loaded]    com.adobe.AAM.Updater-1.0.plist [Click for support]

     

    Launch Daemons: (What does this mean?)

        [loaded]    com.adobe.SwitchBoard.plist [Click for support]

     

    User Launch Agents: (What does this mean?)

        [loaded]    Feelbegin.download.plist [Click for support]

        [loaded]    Feelbegin.ltvbit.plist [Click for support]

        [running]    Feelbegin.update.plist [Click for support]

        [running]    Manroling.update.plist [Click for support]

        [running]    com.google.keystone.agent.plist [Click for support]

     

    User Login Items: (What does this mean?)

        iTunesHelper    Application  (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

        SpeechSynthesisServer    Application  (/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks /SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app)

     

    Other Apps: (What does this mean?)

        [running]    com.apple.xpc.launchd.oneshot.0x1000000c.EtreCheck

        [running]    com.google.Chrome.74440

     

    Internet Plug-ins: (What does this mean?)

        Default Browser: Version: 600 - SDK 10.10

        QuickTime Plugin: Version: 7.7.3

     

    Safari Extensions: (What does this mean?)

        AdBlock

        Adblock Plus

        Save to Pocket

        Feelbegin

        Pin It Button

     

    3rd Party Preference Panes: (What does this mean?)

        None

     

    Time Machine: (What does this mean?)

        Auto backup: YES

        Volumes being backed up:

            Macintosh HD : Disk size: 120.47 GB Disk used: 84.07 GB

        Destinations:

            G-DRIVE USB [Local]

            Total size: 4.00 TB

            Total number of backups: 9

            Oldest backup: 8/9/15, 6:29 PM

            Last backup: 11/3/15, 11:30 AM

            Size of backup disk: Excellent

                Backup size 4.00 TB > (Disk size 120.47 GB X 3)

     

    Top Processes by CPU: (What does this mean?)

             6%    ksfetch

             5%    WindowServer

             3%    GoogleSoftwareUpdateAgent

             3%    fontd

             1%    launchd

     

    Top Processes by Memory: (What does this mean?)

        602 MB    Google Chrome Helper(5)

        422 MB    kernel_task

        270 MB    iTunes

        160 MB    Google Chrome

        98 MB    Finder

     

    Virtual Memory Information: (What does this mean?)

        94 MB    Free RAM

        3.91 GB    Used RAM (1.20 GB Cached)

        0 B    Swap Used

     

    Diagnostics Information: (What does this mean?)

        Nov 11, 2015, 10:31:37 PM    ~/Library/Logs/DiagnosticReports/AppSO_2015-11-11-223137_[redacted].crash

        Nov 11, 2015, 10:03:43 PM    ~/Library/Logs/DiagnosticReports/AppSO_2015-11-11-220343_[redacted].crash

        Nov 11, 2015, 10:02:50 PM    ~/Library/Logs/DiagnosticReports/AppSO_2015-11-11-220250_[redacted].crash

        Nov 11, 2015, 09:30:59 PM    Self test - passed

     

  • by DanielJesse,

    DanielJesse DanielJesse Jun 30, 2016 8:38 PM in response to Linc Davis
    Level 1 (4 points)
    Jun 30, 2016 8:38 PM in response to Linc Davis

    Hey Linc

     

    I ran most of the test but thought it froze up or something so I ended it early. My fan has been running non-stop now for over two hours (both while awake/asleep, plugged into power and on battery power, with all apps closed and with some open).

     

    here are the results I have:

     

       1  Start time: 23:12:40 06/30/16

       2 

       3  Revision: 1620

       4 

       5  Model Identifier: MacBookAir5,2

       6  Boot ROM Version: MBA51.00EF.B04

       7  System Version: OS X 10.10.5 (14F1808)

       8  Kernel Version: Darwin 14.5.0

       9  Time since boot: 12 days 4:36

      10 

      11  Activity

      12 

      13      CPU: user 15%, system 27%

      14 

      15  CPU usage (%)

      16 

      17      plugin-container (UID 501): 52.2

      18      cwdaemon (UID 0): 47.7

      19 

      20  System errors (/s)

      21 

      22      sysmond (UID 0, error 3): 271

      23      plugin-containe (UID 501, error 316): 164

      24 

      25  Energy impact, lifetime (relative)

      26 

      27      plugin-container (UID 501): 35.32

      28      Terminal (UID 501): 20.59

      29      bash (UID 501): 19.01

      30 

      31  Energy impact, sampled (relative)

      32 

      33      plugin-container (UID 501): 52.71

      34      kernel_task (UID 0): 50.68

      35      cwdaemon (UID 0): 47.01

      36 

      37  CPU usage, lifetime (ms/s)

      38 

      39      plugin-container (UID 501): 356.11

      40      Terminal (UID 501): 205.92

      41      bash (UID 501): 190.13

      42 

      43  CPU usage, sampled (ms/s)

      44 

      45      plugin-container (UID 501): 535.25

      46      kernel_task (UID 0): 506.80

      47      cwdaemon (UID 0): 470.17

      48 

      49  Global prefs (system)

      50 

      51      MultipleSessionEnabled = 1

      52 

      53  Trust settings: admin 1, user 4

      54 

      55  Tunnel: Yes

      56 

      57  System caches/logs

      58 

      59      5.2 GiB: /System/Library/Caches/com.apple.coresymbolicationd/data

      60 

      61  Kernel log

      62 

      63      Jun 30 06:59:14 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      64      Jun 30 06:59:15 ARPT: 47730.568404: MacAuthEvent en0   Auth result for: 28:c6:8e:75:2c:52 Auth timed out

      65      Jun 30 07:59:59 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      66      Jun 30 09:00:44 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      67      Jun 30 10:01:29 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      68      Jun 30 11:02:35 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      69      Jun 30 12:03:20 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      70      Jun 30 13:04:05 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      71      Jun 30 14:04:50 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      72      Jun 30 14:12:54 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      73      Jun 30 15:23:03 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      74      Jun 30 16:36:44 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      75      Jun 30 17:51:41 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      76      Jun 30 21:26:30 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized

      77      Jun 30 21:42:29 ARPT: 49464.525930: wl0: 802.11 driver reinitializing, total count of reinit's[1], @'wlc_dpc':472

      78      Jun 30 21:42:29 ARPT: 49464.542250: wl0: 802.11 driver DPC, reinit reason[5], count[1]

      79      Jun 30 21:42:29 ARPT: 49464.542254: wl0: 802.11 driver reinitializing, total count of reinit's[2], @'wlc_dpc':493

      80      Jun 30 21:59:16 proc 4431: load code signature error 4 for file "RdrCEF Helper"

      81      Jun 30 21:59:16 proc 4432: load code signature error 4 for file "RdrCEF Helper"

      82      Jun 30 21:59:17 proc 4433: load code signature error 4 for file "RdrCEF Helper"

      83      Jun 30 21:59:50 proc 4439: load code signature error 4 for file "RdrCEF Helper"

      84      Jun 30 22:00:44 proc 4440: load code signature error 4 for file "RdrCEF Helper"

      85      Jun 30 22:00:55 proc 4452: load code signature error 4 for file "RdrCEF Helper"

      86      Jun 30 22:15:15 proc 4469: load code signature error 4 for file "RdrCEF Helper"

      87      Jun 30 23:09:59 Limiting closed port RST response from 279 to 250 packets per second

      88 

      89  System log

      90 

      91      Jun 30 21:54:26 firefox: CGAffineTransformInvert: singular matrix.

      92      Jun 30 21:54:26 firefox: CGAffineTransformInvert: singular matrix.

      93      Jun 30 21:59:16 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

      94      Jun 30 21:59:16 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

      95      Jun 30 21:59:17 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

      96      Jun 30 21:59:50 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

      97      Jun 30 22:00:44 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

      98      Jun 30 22:00:55 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

      99      Jun 30 22:15:15 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

    100      Jun 30 22:18:26 Microsoft Excel: clip: empty path.

    101      Jun 30 22:18:26 Microsoft Excel: clip: empty path.

    102      Jun 30 22:18:26 Microsoft Excel: clip: empty path.

    103      Jun 30 22:18:26 Microsoft Excel: clip: empty path.

    104      Jun 30 22:39:28 Microsoft Excel: CGBitmapContextCreate: invalid data bytes/row: should be at least 5760 for 8 integer bits/component, 3 components, kCGImageAlphaNoneSkipFirst.

    105      Jun 30 22:39:28 Microsoft Excel: CGBitmapContextCreate: invalid data bytes/row: should be at least 5760 for 8 integer bits/component, 3 components, kCGImageAlphaNoneSkipFirst.

    106      Jun 30 22:39:28 Microsoft Excel: CGBitmapContextCreate: invalid data bytes/row: should be at least 5760 for 8 integer bits/component, 3 components, kCGImageAlphaNoneSkipFirst.

    107      Jun 30 22:39:46 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

    108      Jun 30 22:53:10 icbaccountsd:  SOSCCThisDeviceIsInCircle SOSCCThisDeviceIsInCircle!! 7

    109      Jun 30 22:53:11 icbaccountsd:  SOSCCThisDeviceIsInCircle SOSCCThisDeviceIsInCircle!! 8

    110      Jun 30 22:53:11 icbaccountsd:  SOSCCThisDeviceIsInCircle SOSCCThisDeviceIsInCircle!! 9

    111      Jun 30 23:01:16 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

    112      Jun 30 23:02:27 com.apple.backupd: Error -35 while resolving alias to backup target

    113      Jun 30 23:02:27 com.apple.backupd: Backup failed with error 18: The backup disk could not be found.

    114      Jun 30 23:02:48 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

    115      Jun 30 23:05:10 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

    116 

    117  Loaded kernel extensions

    118 

    119      com.contentwatch.ghoti.NARCPacketInterceptor (1.1)

    120 

    121  System services loaded

    122 

    123      com.adobe.ARMDC.Communicator

    124      com.adobe.ARMDC.SMJobBlessHelper

    125      com.adobe.fpsaud

    126      com.apple.watchdogd

    127      com.cisco.anyconnect.vpnagentd

    128      com.contentwatch.ghoti.Daemon

    129      com.contentwatch.ghoti.Updater

    130      com.contentwatch.ghoti.Updater.WaitForIPC

    131      com.google.keystone.daemon

    132      com.microsoft.office.licensing.helper

    133      com.oracle.java.Helper-Tool

    134 

    135  Login services loaded

    136 

    137      com.adobe.ARMDCHelper.UUID

    138      -    status: 111

    139      com.cisco.anyconnect.gui

    140      com.contentwatch.ghoti.Agent

    141      com.contentwatch.ghoti.Registration

    142      com.contentwatch.ghoti.UpdaterAgent

    143      com.google.keystone.system.agent

    144      com.oracle.java.Java-Updater

    145 

    146  Login services disabled

    147 

    148      com.apple.FolderActions.folders

    149      com.apple.FolderActions.enabled

    150 

    151  User services disabled

    152 

    153      com.apple.FolderActions.folders

    154      com.apple.FolderActions.enabled

    155 

    156  Contents of /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist

    157      -    mod date: May 13 14:45:04 2016

    158      -    size (B): 577

    159      -    checksum: 2197523146

    160 

    161      <?xml version="1.0" encoding="UTF-8"?>

    162      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    163      <plist version="1.0">

    164      <dict>

    165          <key>Label</key>

    166          <string>com.adobe.ARMDCHelper.UUID</string>

    167          <key>ProgramArguments</key>

    168          <array>

    169              <string>/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper</string>

    170          </array>

    171          <key>RunAtLoad</key>

    172          <true/>

    173          <key>StartInterval</key>

    174          <integer>12600</integer>

    175      </dict>

    176      </plist>

    177 

    178  Contents of /Library/LaunchAgents/com.cisco.anyconnect.gui.plist

    179      -    mod date: Oct 16 02:04:25 2014

    180      -    size (B): 635

    181      -    checksum: 1087717482

    182 

    183      <?xml version="1.0" encoding="UTF-8"?>

    184      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    185      <plist version="1.0">

    186      <dict>

    187          <key>KeepAlive</key>

    188          <dict>

    189              <key>PathState</key>

    190              <dict>

    191                  <key>/opt/cisco/anyconnect/gui_keepalive</key>

    192                  <true/>

    193              </dict>

    194          </dict>

    195          <key>Label</key>

    196          <string>com.cisco.anyconnect.gui</string>

    197          <key>LimitLoadToSessionType</key>

    198          <string>Aqua</string>

    199          <key>ProgramArguments</key>

    200          <array>

    201              <string>open</string>

    202              <string>--wait-apps</string>

    203              <string>/Applications/Cisco/Cisco AnyConnect Secure Mobility Client.app</string>

    204          </array>

    205      </dict>

    206      </plist>

    207 

    208  Contents of /Library/LaunchAgents/com.contentwatch.ghoti.Agent.plist

    209      -    mod date: Oct  6 10:34:29 2015

    210      -    size (B): 665

    211      -    checksum: 2369051592

    212 

    213      <?xml version="1.0" encoding="UTF-8"?>

    214      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    215      <plist version="1.0">

    216      <dict>

    217          <key>KeepAlive</key>

    218          <false/>

    219          <key>Label</key>

    220          <string>com.contentwatch.ghoti.Agent</string>

    221          <key>ProgramArguments</key>

    222          <array>

    223              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwagent</string>

    224          </array>

    225          <key>RunAtLoad</key>

    226          <true/>

    227          <key>WatchPaths</key>

    228          <array>

    229              <string>/Library/Application Support/ContentWatch/lock/CWDaemon.pid</string>

    230          </array>

    231          <key>WorkingDirectory</key>

    232          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    233      </dict>

    234      </plist>

    235 

    236  Contents of /Library/LaunchAgents/com.contentwatch.ghoti.Registration.plist

    237      -    mod date: Oct  6 10:28:13 2015

    238      -    size (B): 666

    239      -    checksum: 398402859

    240 

    241      <?xml version="1.0" encoding="UTF-8"?>

    242      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    243      <plist version="1.0">

    244      <dict>

    245          <key>KeepAlive</key>

    246          <false/>

    247          <key>Label</key>

    248          <string>com.contentwatch.ghoti.Registration</string>

    249          <key>ProgramArguments</key>

    250          <array>

    251              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwregistration</string>

    252          </array>

    253          <key>WatchPaths</key>

    254          <array>

    255              <string>/Library/Application Support/ContentWatch/lock/ContentWatchLaunchRegistration</string>

    256          </array>

    257          <key>WorkingDirectory</key>

    258          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    259      </dict>

    260      </plist>

    261 

    262  Contents of /Library/LaunchAgents/com.contentwatch.ghoti.UpdaterAgent.plist

    263      -    mod date: Oct  6 10:34:29 2015

    264      -    size (B): 698

    265      -    checksum: 2479461622

    266 

    267      <?xml version="1.0" encoding="UTF-8"?>

    268      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    269      <plist version="1.0">

    270      <dict>

    271          <key>KeepAlive</key>

    272          <false/>

    273          <key>Label</key>

    274          <string>com.contentwatch.ghoti.UpdaterAgent</string>

    275          <key>ProgramArguments</key>

    276          <array>

    277              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwupdateragent</string>

    278              <string>--check-only</string>

    279          </array>

    280          <key>WatchPaths</key>

    281          <array>

    282              <string>/Library/Application Support/ContentWatch/lock/ContentWatchLaunchUpdaterAgent</string>

    283          </array>

    284          <key>WorkingDirectory</key>

    285          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    286      </dict>

    287      </plist>

    288 

    289  Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

    290      -    mod date: May 27 08:49:12 2015

    291      -    size (B): 104

    292      -    checksum: 2237498219

    293 

    294      <?xml version="1.0" encoding="UTF-8"?>

    295      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    296      <plist version="1.0">

    297      <dict>

    298          <key>Label</key>

    299          <string>com.oracle.java.Java-Updater</string>

    300          <key>ProgramArguments</key>

    301          <array>

    302              <string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>

    303              <string>-bgcheck</string>

    304          </array>

    305          <key>StandardErrorPath</key>

    306          <string>/dev/null</string>

    307          <key>StandardOutPath</key>

    308          <string>/dev/null</string>

    309          <key>StartCalendarInterval</key>

    310          <dict>

    311              <key>Hour</key>

    312              <integer>15</integer>

    313              <key>Minute</key>

    314              <integer>7</integer>

    315              <key>Weekday</key>

    316              <integer>4</integer>

    317          </dict>

    318      </dict>

    319 

    320      ...and 1 more line(s)

    321 

    322  Contents of /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist

    323      -    mod date: Oct 16 02:04:25 2014

    324      -    size (B): 611

    325      -    checksum: 2630047092

    326 

    327      <?xml version="1.0" encoding="UTF-8"?>

    328      <!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN

    329      http://www.apple.com/DTDs/PropertyList-1.0.dtd >

    330      <plist version="1.0">

    331      <dict>

    332           <key>Label</key>

    333           <string>com.cisco.anyconnect.vpnagentd</string>

    334           <key>ProgramArguments</key>

    335           <array>

    336                <string>/opt/cisco/anyconnect/bin/vpnagentd</string>

    337                <string>-execv_instance</string>

    338           </array>

    339           <key>KeepAlive</key>

    340           <true/>

    341           <key>RunAtLoad</key>

    342           <true/>

    343           <key>AbandonProcessGroup</key>

    344           <true/>

    345           <key>EnableTransactions</key>

    346           <false/>

    347      </dict>

    348      </plist>

    349 

    350  Contents of /Library/LaunchDaemons/com.contentwatch.ghoti.Daemon.plist

    351      -    mod date: Oct  6 10:34:29 2015

    352      -    size (B): 686

    353      -    checksum: 170802534

    354 

    355      <?xml version="1.0" encoding="UTF-8"?>

    356      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    357      <plist version="1.0">

    358      <dict>

    359          <key>ExitTimeout</key>

    360          <integer>20</integer>

    361          <key>KeepAlive</key>

    362          <dict>

    363              <key>SuccessfulExit</key>

    364              <false/>

    365          </dict>

    366          <key>Label</key>

    367          <string>com.contentwatch.ghoti.Daemon</string>

    368          <key>ProgramArguments</key>

    369          <array>

    370              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwdaemon</string>

    371              <string>--start-daemon</string>

    372          </array>

    373          <key>UserName</key>

    374          <string>root</string>

    375          <key>WorkingDirectory</key>

    376          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    377      </dict>

    378      </plist>

    379 

    380  Contents of /Library/LaunchDaemons/com.contentwatch.ghoti.LaunchProxy.plist

    381      -    mod date: Oct  6 10:28:13 2015

    382      -    size (B): 655

    383      -    checksum: 636692118

    384 

    385      <?xml version="1.0" encoding="UTF-8"?>

    386      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    387      <plist version="1.0">

    388      <dict>

    389          <key>KeepAlive</key>

    390          <dict>

    391              <key>SuccessfulExit</key>

    392              <false/>

    393          </dict>

    394          <key>Label</key>

    395          <string>com.contentwatch.ghoti.LaunchProxy</string>

    396          <key>ProgramArguments</key>

    397          <array>

    398              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwlaunchproxy</string>

    399              <string>--start-launch-proxy</string>

    400          </array>

    401          <key>UserName</key>

    402          <string>root</string>

    403          <key>WorkingDirectory</key>

    404          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    405      </dict>

    406      </plist>

    407 

    408  Contents of /Library/LaunchDaemons/com.contentwatch.ghoti.Updater.WaitForIPC.plist

    409      -    mod date: Oct  6 10:28:12 2015

    410      -    size (B): 782

    411      -    checksum: 2148360260

    412 

    413      <?xml version="1.0" encoding="UTF-8"?>

    414      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    415      <plist version="1.0">

    416      <dict>

    417          <key>KeepAlive</key>

    418          <dict>

    419              <key>PathState</key>

    420              <dict>

    421                  <key>/Library/Application Support/ContentWatch/restartUpdater_waitForIPC</key>

    422                  <true/>

    423              </dict>

    424          </dict>

    425          <key>Label</key>

    426          <string>com.contentwatch.ghoti.Updater.WaitForIPC</string>

    427          <key>ProgramArguments</key>

    428          <array>

    429              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwupdater</string>

    430              <string>--start-update</string>

    431              <string>--wait-for-ipc</string>

    432          </array>

    433          <key>UserName</key>

    434          <string>root</string>

    435          <key>WorkingDirectory</key>

    436          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    437      </dict>

    438 

    439      ...and 1 more line(s)

    440 

    441  Contents of /Library/LaunchDaemons/com.contentwatch.ghoti.Updater.plist

    442      -    mod date: Oct  6 10:28:12 2015

    443      -    size (B): 726

    444      -    checksum: 2279253186

    445 

    446      <?xml version="1.0" encoding="UTF-8"?>

    447      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    448      <plist version="1.0">

    449      <dict>

    450          <key>KeepAlive</key>

    451          <dict>

    452              <key>PathState</key>

    453              <dict>

    454                  <key>/Library/Application Support/ContentWatch/restartUpdater</key>

    455                  <true/>

    456              </dict>

    457          </dict>

    458          <key>Label</key>

    459          <string>com.contentwatch.ghoti.Updater</string>

    460          <key>ProgramArguments</key>

    461          <array>

    462              <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS/cwupdater</string>

    463              <string>--start-update</string>

    464          </array>

    465          <key>UserName</key>

    466          <string>root</string>

    467          <key>WorkingDirectory</key>

    468          <string>/Applications/Net Nanny/Net Nanny.app/Contents/MacOS</string>

    469      </dict>

    470      </plist>

    471 

    472  Contents of /System/Library/LaunchAgents/com.apple.SafariPlugInUpdateNotifier.plist

    473      -    mod date: Apr 25 14:50:01 2016

    474      -    size (B): 779

    475      -    checksum: 941105980

    476 

    477      <?xml version="1.0" encoding="UTF-8"?>

    478      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    479      <plist version="1.0">

    480      <dict>

    481          <key>EnablePressuredExit</key>

    482          <true/>

    483          <key>Label</key>

    484          <string>com.apple.SafariPlugInUpdateNotifier</string>

    485          <key>Program</key>

    486          <string>/usr/libexec/SafariPlugInUpdateNotifier</string>

    487          <key>LaunchEvents</key>

    488          <dict>

    489              <key>com.apple.fsevents.matching</key>

    490              <dict>

    491                  <key>UserFlashPlugInModified</key>

    492                  <dict>

    493                      <key>Path</key>

    494                      <string>~/Library/Internet Plug-Ins/Flash Player.plugin</string>

    495                  </dict>

    496                  <key>SystemFlashPlugInModified</key>

    497                  <dict>

    498                      <key>Path</key>

    499                      <string>/Library/Internet Plug-Ins/Flash Player.plugin</string>

    500                  </dict>

    501              </dict>

    502 

    503      ...and 3 more line(s)

    504 

    505  Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist

    506      -    mod date: Aug  7 15:01:01 2015

    507      -    size (B): 554

    508      -    checksum: 3012644940

    509 

    510      <?xml version="1.0" encoding="UTF-8"?>

    511      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    512      <plist version="1.0">

    513      <dict>

    514          <key>Disabled</key>

    515          <true/>

    516          <key>Label</key>

    517          <string>org.apache.httpd</string>

    518          <key>EnvironmentVariables</key>

    519          <dict>

    520              <key>XPC_SERVICES_UNAVAILABLE</key>

    521              <string>1</string>

    522          </dict>

    523          <key>ProgramArguments</key>

    524          <array>

    525              <string>/usr/sbin/httpd-wrapper</string>

    526              <string>-D</string>

    527              <string>FOREGROUND</string>

    528          </array>

    529          <key>OnDemand</key>

    530          <false/>

    531      </dict>

    532      </plist>

    533 

    534  Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist

    535      -    mod date: Oct 13 11:01:21 2014

    536      -    size (B): 603

    537      -    checksum: 394026997

    538 

    539      <?xml version="1.0" encoding="UTF-8"?>

    540      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    541      <plist version="1.0">

    542      <dict>

    543          <key>Label</key>

    544          <string>com.adobe.ARM.UUID</string>

    545          <key>ProgramArguments</key>

    546          <array>

    547              <string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

    548              <string>semi-auto</string>

    549          </array>

    550          <key>RunAtLoad</key>

    551          <true/>

    552          <key>StartInterval</key>

    553          <integer>12600</integer>

    554      </dict>

    555      </plist>

    556 

    557  Contents of Library/LaunchAgents/com.apple.FolderActions.folders.plist

    558      -    mod date: Jun 18 23:06:18 2014

    559      -    size (B): 517

    560      -    checksum: 1189540302

    561 

    562      <?xml version="1.0" encoding="UTF-8"?>

    563      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    564      <plist version="1.0">

    565      <dict>

    566          <key>Label</key>

    567          <string>com.apple.FolderActions.folders</string>

    568          <key>Program</key>

    569          <string>/usr/bin/osascript</string>

    570          <key>ProgramArguments</key>

    571          <array>

    572              <string>osascript</string>

    573              <string>-e</string>

    574              <string>tell application "Folder Actions Dispatcher" to tick</string>

    575          </array>

    576          <key>WatchPaths</key>

    577          <array/>

    578      </dict>

    579      </plist>

    580 

    581  User login items

    582 

    583      iTunesHelper

    584      -    /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

    585      Covenant Eyes

    586      -    missing value

    587      Dropbox

    588      -    /Applications/Dropbox.app

    589      AdobeResourceSynchronizer

    590      -    missing value

    591 

    592  Safari extensions

    593 

    594      Covenant Eyes

    595      -    com.covenanteyes.safari-extension

    596 

    597  Firefox extensions

    598 

    599      Firefox Hello Beta

    600 

    601  iCloud services

    602 

    603      MOBILE_DOCUMENTS

    604      PHOTO_STREAM

    605      CONTACTS

    606      CALENDAR

    607      REMINDERS

    608      BOOKMARKS

    609      NOTES

    610      FIND_MY_MAC

    611 

    612  iCloud errors

    613 

    614      cloudd    1

    615 

    616  Continuity errors

    617 

    618      lsuseractivityd    4

    619 

    620  Restrictive permissions: 188

    621 

    622  Lockfiles: 13

    623 

    624  Global prefs (user)

    625 

    626      AppleEnableMenuBarTransparency = 1

    627 

    628  Extensions

    629 

    630      /Library/Extensions/NARCPacketInterceptor.kext

    631      -    com.contentwatch.ghoti.NARCPacketInterceptor

    632      -    ContentWatch, Inc. (P2GD6L35JL)

    633      /Library/Extensions/hp_Inkjet9_io_enabler.kext

    634      -    com.hp.print.hpio.Inkjet9.kext

    635      -    Hewlett Packard (6HB5Y2QTA3)

    636      /Library/Extensions/hp_fax_io.kext

    637      -    com.hp.kext.hp-fax-io

    638      -    Hewlett Packard (6HB5Y2QTA3)

    639      /System/Library/Extensions/JMicronATA.kext

    640      -    com.jmicron.JMicronATA

    641      /System/Library/Extensions/acsock.kext

    642      -    com.cisco.kext.acsock

    643 

    644  Applications

    645 

    646      /Applications/Fuze.app

    647      -    com.fuzebox.fuzemeetingmac

    648      -    CallWave

    649      /Applications/MyPublisher.app

    650      -    com.mypublisher.mypublisher

    651      -    MyPublisher, Inc (AJ5DA336WV)

    652      /Applications/Net Nanny/Net Nanny.app

    653      -    com.contentwatch.ghoti.cp.desktop.home.standalone.NN

    654      -    ContentWatch, Inc. (P2GD6L35JL)

    655      /Applications/Net Nanny/Uninstall Net Nanny.app

    656      -    com.contentwatch.ghoti.cp.desktop.home.standalone.NN

    657      -    ContentWatch, Inc. (P2GD6L35JL)

    658      /Applications/UserTesting Recorder.app

    659      -    com.usertesting.recorder

    660      -    UserTesting Inc. (EFXWHV7R94)

    661      /Applications/iBackupBot.app

    662      -    com.icopybot.ibackupbot

    663      -    Shane XU

    664 

    665  PrefPane

    666 

    667      /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.pref Pane

    668      -    com.oracle.java.JavaControlPanel

    669      /Library/PreferencePanes/Flash Player.prefPane

    670      -    com.adobe.flashplayerpreferences

    671 

    672  Bundles

    673 

    674      /Library/Internet Plug-Ins/AdobePDFViewer.plugin

    675      -    com.adobe.acrobat.pdfviewer

    676      -    Adobe Systems, Inc.

    677      /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

    678      -    com.adobe.acrobat.pdfviewerNPAPI

    679      -    Adobe Systems, Inc.

    680      /Library/Internet Plug-Ins/Flash Player.plugin

    681      -    com.macromedia.Flash Player.plugin

    682      -    Adobe Systems, Inc.

    683      /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

    684      -    net.telestream.wmv.plugin

    685      -    Telestream Inc.

    686      /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

    687      -    com.oracle.java.JavaAppletPlugin

    688      /Library/Internet Plug-Ins/Quartz Composer.webplugin

    689      -    com.apple.QuartzComposer.webplugin

    690      -    Software Signing

    691      /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

    692      -    com.microsoft.sharepoint.browserplugin

    693      /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

    694      -    com.microsoft.sharepoint.webkitplugin

    695      /Library/Internet Plug-Ins/Silverlight.plugin

    696      -    com.microsoft.SilverlightPlugin

    697      /Library/Internet Plug-Ins/googletalkbrowserplugin.plugin

    698      -    com.google.googletalkbrowserplugin

    699      -    Google Inc.

    700      /Library/Internet Plug-Ins/o1dbrowserplugin.plugin

    701      -    com.google.o1dbrowserplugin

    702      -    Google Inc.

    703      /Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle

    704      -    com.skype.skypeabdialer

    705      /Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle

    706      -    com.skype.skypeabsms

    707      /Users/USER/Library/Application Support/Google/Chrome/PepperFlash/21.0.0.213/PepperFlashPlayer.plugin

    708      -    com.macromedia.PepperFlashPlayer.pepper

    709      -    Adobe Systems, Inc.

    710      /Users/USER/Library/Application Support/Google/Chrome/WidevineCDM/1.4.8.885/_platform_specific/mac_x64/widevine cdmadapter.plugin

    711      -    NA

    712      /Users/USER/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin

    713      -    com.Google.GoogleEarthPlugin.plugin

    714      -    Google Inc.

    715      /Users/USER/Library/Widgets/HP Ink Widget.wdgt

    716      -    com.hp.widget.inkwidget

Previous Page 2 of 3 last Next