John3k

Q: Hangs at what i'm doing, Kernel panics, followed by a blinking question mark?

This keeps happening every day, and it bugs me SO much.

 

 

My MacBook Air, 6,1, keeps hanging, and then when I leave it for a while, it shows a blinking question mark.

 

Restarting helps, untill it hangs again.

 

What happens when I restart? Well, it shows a kernel panic, and then I just press any key, and go on with whatever I was doing.

 

 

Here's the latest hang crash report; see if anything can help about this:

 

Tue Oct  6 19:38:37 2015

 

 

*** Panic Report ***

panic(cpu 0 caller 0xffffff8009dd6a9a): Kernel trap at 0xffffff7f8c0c7f9c, type 14=page fault, registers:

CR0: 0x000000008001003b, CR2: 0xffffff807ff0b080, CR3: 0x00000001532f101e, CR4: 0x00000000001627e0

RAX: 0xffffff807ff0af80, RBX: 0xffffff801dd6a000, RCX: 0xffffff7f8c191310, RDX: 0x0000000000000001

RSP: 0xffffff80117bba50, RBP: 0xffffff80117bba70, RSI: 0xffffff8017da5200, RDI: 0xffffff8016e2f400

R8:  0xffffff80153c5800, R9:  0x0000000000000001, R10: 0xffffff800f74e580, R11: 0x0000000000000001

R12: 0x000000000000001d, R13: 0x0000000000050001, R14: 0xffffff8017da5200, R15: 0xffffff8017da5200

RFL: 0x0000000000010286, RIP: 0xffffff7f8c0c7f9c, CS:  0x0000000000000008, SS:  0x0000000000000000

Fault CR2: 0xffffff807ff0b080, Error code: 0x0000000000000000, Fault CPU: 0x0, PL: 0

 

 

Backtrace (CPU 0), Frame : Return Address

0xffffff80117bb6e0 : 0xffffff8009ce5357

0xffffff80117bb760 : 0xffffff8009dd6a9a

0xffffff80117bb940 : 0xffffff8009df4093

0xffffff80117bb960 : 0xffffff7f8c0c7f9c

0xffffff80117bba70 : 0xffffff7f8c0cc57b

0xffffff80117bbaa0 : 0xffffff7f8c0ce4b7

0xffffff80117bbac0 : 0xffffff7f8c0cd1cc

0xffffff80117bbae0 : 0xffffff7f8c0cd272

0xffffff80117bbb10 : 0xffffff800a2dba1c

0xffffff80117bbb40 : 0xffffff8009d9a61b

0xffffff80117bbb80 : 0xffffff8009ce9b18

0xffffff80117bbbb0 : 0xffffff8009ccd448

0xffffff80117bbbf0 : 0xffffff8009ce9ec6

0xffffff80117bbc20 : 0xffffff8009cd5acc

0xffffff80117bbca0 : 0xffffff8009cd851c

0xffffff80117bbcf0 : 0xffffff8009d08ff0

0xffffff80117bbd30 : 0xffffff800a19e964

0xffffff80117bbda0 : 0xffffff800a1b6a9d

0xffffff80117bbe20 : 0xffffff800a1b6f77

0xffffff80117bbe60 : 0xffffff8009cdfe3d

0xffffff80117bbea0 : 0xffffff8009dd72de

0xffffff80117bbec0 : 0xffffff8009df405f

      Kernel Extensions in backtrace:

         com.apple.iokit.IOAcceleratorFamily2(203.7.1)[5178DF8C-1F96-3D87-8BD4-46B996C41 84A]@0xffffff7f8c0b8000->0xffffff7f8c123fff

            dependency: com.apple.iokit.IOPCIFamily(2.9)[668E3DEE-F98E-3456-92D6-F4FEEA355A72]@0xffffff 7f8a53a000

            dependency: com.apple.iokit.IOGraphicsFamily(2.4.1)[48AC8EA9-BD3C-3FDC-908D-09850215AA32]@0 xffffff7f8af91000

 

 

BSD process name corresponding to current thread: WindowServer

 

 

Mac OS version:

15A284

 

 

Kernel version:

Darwin Kernel Version 15.0.0: Wed Aug 26 16:57:32 PDT 2015; root:xnu-3247.1.106~1/RELEASE_X86_64

Kernel UUID: 37BC582F-8BF4-3F65-AFBB-ECF792060C68

Kernel slide:     0x0000000009a00000

Kernel text base: 0xffffff8009c00000

__HIB  text base: 0xffffff8009b00000

System model name: MacBookAir6,1 (Mac-35C1E88140C3E6CF)

 

 

System uptime in nanoseconds: 21240246347457

last loaded kext at 7980073979964: com.apple.driver.usb.IOUSBHostHIDDevice 1.0.1 (addr 0xffffff7f8c79f000, size 40960)

last unloaded kext at 8043958459089: com.apple.driver.usb.AppleUSBHostCompositeDevice 1.0.1 (addr 0xffffff7f8c796000, size 28672)

loaded kexts:

com.techsmith.TACC 1.0.3

com.apple.driver.AppleMikeyHIDDriver 124

com.apple.filesystems.smbfs 3.0.0

com.apple.driver.AudioAUUC 1.70

com.apple.driver.AGPM 110.20.19

com.apple.driver.ApplePlatformEnabler 2.5.1d0

com.apple.driver.X86PlatformShim 1.0.0

com.apple.driver.pmtelemetry 1

com.apple.iokit.IOUserEthernet 1.0.1

com.apple.iokit.IOBluetoothSerialManager 4.4.0f4

com.apple.Dont_Steal_Mac_OS_X 7.0.0

com.apple.driver.AppleHV 1

com.apple.filesystems.autofs 3.0

com.apple.driver.AppleUpstreamUserClient 3.6.1

com.apple.driver.AppleHDA 272.50

com.apple.driver.AppleOSXWatchdog 1

com.apple.driver.AppleIntelHD5000Graphics 10.0.8

com.apple.driver.AppleLPC 3.1

com.apple.driver.AppleThunderboltIP 3.0.8

com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.4.0f4

com.apple.driver.AppleIntelFramebufferAzul 10.0.8

com.apple.driver.AppleSMCLMU 208

com.apple.driver.AppleCameraInterface 5.41.0

com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0

com.apple.driver.AppleBacklight 170.8.1

com.apple.driver.AppleMCCSControl 1.2.13

com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1

com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0

com.apple.BootCache 37

com.apple.driver.AppleTopCaseHIDEventDriver 81.2

com.apple.iokit.IOAHCIBlockStorage 2.8.0

com.apple.driver.AppleAHCIPort 3.1.5

com.apple.driver.AirPort.Brcm4360 1000.13.1a3

com.apple.driver.AppleSmartBatteryManager 161.0.0

com.apple.driver.AppleACPIButtons 4.0

com.apple.driver.AppleRTC 2.0

com.apple.driver.AppleHPET 1.8

com.apple.driver.AppleSMBIOS 2.1

com.apple.driver.AppleACPIEC 4.0

com.apple.driver.AppleAPIC 1.7

com.apple.nke.applicationfirewall 163

com.apple.security.quarantine 3

com.apple.security.TMSafetyNet 8

com.apple.driver.CoreCaptureResponder 1

com.apple.kext.triggers 1.0

com.apple.driver.DspFuncLib 272.50

com.apple.kext.OSvKernDSPLib 525

com.apple.iokit.IOSurface 108.0.1

com.apple.iokit.IOBluetoothHostControllerUSBTransport 4.4.0f4

com.apple.iokit.IOBluetoothFamily 4.4.0f4

com.apple.AppleGraphicsDeviceControl 3.11.31

com.apple.iokit.IOAcceleratorFamily2 203.7.1

com.apple.driver.AppleHDAController 272.50

com.apple.iokit.IOHDAFamily 272.50

com.apple.iokit.IOAudioFamily 203.8

com.apple.vecLib.kext 1.2.0

com.apple.iokit.IOSerialFamily 11

com.apple.driver.X86PlatformPlugin 1.0.0

com.apple.driver.IOPlatformPluginFamily 6.0.0d7

com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0

com.apple.driver.AppleBacklightExpert 1.1.0

com.apple.iokit.IONDRVSupport 2.4.1

com.apple.driver.AppleSMC 3.1.9

com.apple.driver.AppleSMBusController 1.0.14d1

com.apple.iokit.IOGraphicsFamily 2.4.1

com.apple.iokit.IOSCSIArchitectureModelFamily 3.7.7

com.apple.driver.usb.AppleUSBHub 1.0.1

com.apple.driver.CoreStorage 517

com.apple.driver.AppleMultitouchDriver 304.9

com.apple.driver.AppleHIDTransport 5

com.apple.driver.AppleHIDKeyboard 181

com.apple.driver.AppleHSSPIHIDDriver 41.6

com.apple.iokit.IOAHCIFamily 2.8.0

com.apple.driver.AppleThunderboltDPInAdapter 4.1.2

com.apple.driver.AppleThunderboltDPAdapterFamily 4.1.2

com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.2

com.apple.driver.AppleThunderboltNHI 4.0.1

com.apple.iokit.IOThunderboltFamily 5.0.6

com.apple.iokit.IO80211Family 1100.23

com.apple.driver.mDNSOffloadUserClient 1.0.1b8

com.apple.iokit.IONetworkingFamily 3.2

com.apple.driver.corecapture 1.0.4

com.apple.driver.AppleHSSPISupport 41.6

com.apple.driver.AppleIntelLpssSpiController 2.0.57

com.apple.driver.usb.AppleUSBXHCIPCI 1.0.1

com.apple.driver.usb.AppleUSBXHCI 1.0.1

com.apple.driver.AppleIntelLpssGspi 2.0.57

com.apple.driver.AppleIntelLpssDmac 2.0.57

com.apple.iokit.IOUSBFamily 900.4.1

com.apple.iokit.IOUSBHostFamily 1.0.1

com.apple.driver.AppleUSBHostMergeProperties 1.0.1

com.apple.driver.AppleEFINVRAM 2.0

com.apple.driver.AppleEFIRuntime 2.0

com.apple.iokit.IOHIDFamily 2.0.0

com.apple.iokit.IOSMBusFamily 1.1

com.apple.security.sandbox 300.0

com.apple.kext.AppleMatch 1.0.0d1

com.apple.driver.AppleKeyStore 2

com.apple.driver.AppleMobileFileIntegrity 1.0.5

com.apple.driver.AppleCredentialManager 1.0

com.apple.driver.DiskImages 414

com.apple.iokit.IOStorageFamily 2.1

com.apple.iokit.IOReportFamily 31

com.apple.driver.AppleFDEKeyStore 28.30

com.apple.driver.AppleACPIPlatform 4.0

com.apple.iokit.IOPCIFamily 2.9

com.apple.iokit.IOACPIFamily 1.4

com.apple.kec.Libm 1

com.apple.kec.pthread 1

com.apple.kec.corecrypto 1.0

Model: MacBookAir6,1, BootROM MBA61.0099.B19, 2 processors, Intel Core i5, 1.4 GHz, 4 GB, SMC 2.12f143

Graphics: Intel HD Graphics 5000, Intel HD Graphics 5000, Built-In

Memory Module: BANK 0/DIMM0, 2 GB, DDR3, 1600 MHz, 0x02FE, 0x45424A3230554638454455302D474E2D4620

Memory Module: BANK 1/DIMM0, 2 GB, DDR3, 1600 MHz, 0x02FE, 0x45424A3230554638454455302D474E2D4620

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x117), Broadcom BCM43xx 1.0 (7.21.94.25.1a3)

Bluetooth: Version 4.4.0f4 16320, 3 services, 18 devices, 1 incoming serial ports

Network Service: Wi-Fi, AirPort, en0

Serial ATA Device: APPLE SSD TS0128F, 121.33 GB

USB Device: USB 3.0 Bus

USB Device: BRCM20702 Hub

USB Device: Bluetooth USB Host Controller

Thunderbolt Bus: MacBook Air, Apple Inc., 23.6

 

 

Any help will be appreciated.

 

Thanks!

 

 

 

 

-John

MacBook Air, OS X El Capitan (10.11)

Posted on Oct 6, 2015 5:51 PM

Close

Q: Hangs at what i'm doing, Kernel panics, followed by a blinking question mark?

  • All replies
  • Helpful answers

Page 1 Next
  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Oct 7, 2015 8:21 PM in response to John3k
    Level 10 (208,000 points)
    Applications
    Oct 7, 2015 8:21 PM in response to John3k

    Uninstall "Snagit" or "Camtasia" and see whether the panics stop.

    Any third-party software that doesn't install from the App Store or by drag-and-drop into the Applications folder, and uninstall by drag-and-drop to the Trash, is a system modification.

    Whenever you remove system modifications, they must be removed completely, and the only way to do that is to use the uninstallation tool, if any, provided by the developers, or to follow their instructions. If the software has been incompletely removed, you may have to re-download or even reinstall it in order to finish the job.

    I never install system modifications myself, and except as stated in this comment, I don't know how to uninstall them. You'll have to do your own research to find that information.

    Here are some general guidelines to get you started. Suppose you want to remove something called “BrickMyMac” (a hypothetical example.) First, consult the product's Help menu, if there is one, for instructions. Finding none there, look on the developer's website, say www.brickmymac.com. (That may not be the actual name of the site; if necessary, search the Web for the product name.) If you don’t find anything on the website or in your search, contact the developer. While you're waiting for a response, download BrickMyMac.dmg and open it. There may be an application in there such as “Uninstall BrickMyMac.” If not, open “BrickMyMac.pkg” and look for an Uninstall button. The uninstaller might also be accessed by clicking the Customize button, if there is one.

    Back up all data before making any changes.

    You will generally have to restart the computer in order to complete an uninstallation. Until you do that, there may be no effect, or unpredictable effects.

    If you can’t remove software in any other way, you’ll have to erase and install OS X. Never install any third-party software unless you're sure you know how to uninstall it; otherwise you may create problems that are very hard to solve.

    Trying to remove complex system modifications by hunting for files by name often will not work and may make the problem worse. The same goes for "utilities" such as "AppCleaner" and the like that purport to remove software.

  • by John3k,

    John3k John3k Oct 7, 2015 8:21 PM in response to Linc Davis
    Level 1 (0 points)
    Oct 7, 2015 8:21 PM in response to Linc Davis

    Software removed! I thought I got rid of Camtasia...

     

    I'll give it some time, and use my Mac, and see if this works!

     

     

    Thanks!

  • by John3k,

    John3k John3k Oct 8, 2015 9:42 PM in response to John3k
    Level 1 (0 points)
    Oct 8, 2015 9:42 PM in response to John3k

    Yay! No hangs/crashes!

     

     

    Thank you so much!

     

     

  • by John3k,

    John3k John3k Oct 9, 2015 9:50 PM in response to John3k
    Level 1 (0 points)
    Oct 9, 2015 9:50 PM in response to John3k

    UPDATE:

    No luck..


    So, it kernel paniced AND showed a blinking question mark when i left it idling.

    Here's the error report. (once again)

     

     

    Fri Oct  9 23:44:32 2015

     

     

    *** Panic Report ***

    panic(cpu 3 caller 0xffffff800379ea74): launchd exited (signal 9, exit status 0 CS_KILLED)

     

     

    uuid info:

    0x7fff61d0c000 uuid = <df977301-4a63-32ed-9939-1ee3122d18d4>

    0x100b8c000 uuid = <13d08717-b23a-38be-85a6-085b051f8322>

     

     

    Thread 4 crashed

     

     

    RAX: 0x0000000000000000, RBX: 0x00007fff61d4b5f8, RCX: 0x0000000100b8ca00, RDX: 0x0000000100bd3790

    RSP: 0x0000700000080750, RBP: 0x00007000000807d0, RSI: 0x00000000000001b1, RDI: 0x00007fff61d4b5f8

    R8:  0x00007fff96ab4119, R9:  0x0000700000080b40, R10: 0x00000000000d2400, R11: 0x0000000100bcb170

    R12: 0x0000000000000000, R13: 0x0000000000000000, R14: 0x0000000000000000, R15: 0x0000000100bd1839

    RFL: 0x0000000000010246, RIP: 0x00007fff61d262e0, CS:  0x000000000000002b, SS:  0x0000000000000023

     

     

    Thread 0: 0xffffff800eaee000

      0x00007fff8dbf6e15

      0x0000000000000000

     

     

    Thread 1: 0xffffff800eb59b60

      0x00007fff8dc057b5

      0x0000000000000000

     

     

    Thread 2: 0xffffff800eb596d0

       Could not read LR from frame at 0x0000700000199d48

     

     

    Thread 3: 0xffffff800fdb6b60

      0x00007fff8dc01675

      0x00007fff8dbf5acb

      0x00007fff8dbf6248

      0x00007fff8dbfc6c9

      0x00007fff8dbf4d9b

      0x00007fff8dbf4b48

      0x00007fff82b8a4f2

      0x00007fff82b88375

      0x0000000000000000

     

     

    Thread 4: 0xffffff80108d4490

      0x00007fff61d10063

      0x00007fff96ab4262

      0x0000000100bcb170

      0x0000000100bb8c72

      0x00007fff8dbf1453

      0x00007fff8dc01675

      0x00007fff8dbf5acb

      0x00007fff8dbf6248

      0x00007fff8dbfc6c9

      0x00007fff8dbf4d9b

      0x00007fff8dbf4b48

      0x00007fff82b8a4f2

      0x00007fff82b88375

      0x0000000000000000

     

     

    Thread 5: 0xffffff8014acf920

      0x00007fff877ea5a0

      0x0000000100bb646d

      0x00007fff8dc09324

      0x00007fff8dbf1453

      0x00007fff8dbf6083

      0x00007fff8dbfc6c9

      0x00007fff8dbf4d9b

      0x00007fff8dbf4b48

      0x00007fff82b8a4f2

      0x00007fff82b88375

      0x0000000000000000

     

     

    Mac OS version: 15A284

    Kernel version: Darwin Kernel Version 15.0.0: Wed Aug 26 16:57:32 PDT 2015; root:xnu-3247.1.106~1/RELEASE_X86_64

    Kernel UUID: (blank)

    System model name: MacBookAir6,1 (Mac-35C1E88140C3E6CF)

  • by Linc Davis,

    Linc Davis Linc Davis Oct 10, 2015 1:32 PM in response to John3k
    Level 10 (208,000 points)
    Applications
    Oct 10, 2015 1:32 PM in response to John3k

    That's not a panic report, or if it is, it's corrupt. Is there another one?

  • by John3k,

    John3k John3k Oct 10, 2015 6:54 PM in response to Linc Davis
    Level 1 (0 points)
    Oct 10, 2015 6:54 PM in response to Linc Davis

    Nope, nothing else.

  • by John3k,

    John3k John3k Oct 10, 2015 6:57 PM in response to John3k
    Level 1 (0 points)
    Oct 10, 2015 6:57 PM in response to John3k

    I could be sure that it was a different crash; I could move my mouse.

     

    But I may be wrong, you never know...

  • by Linc Davis,

    Linc Davis Linc Davis Oct 10, 2015 7:06 PM in response to John3k
    Level 10 (208,000 points)
    Applications
    Oct 10, 2015 7:06 PM in response to John3k

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

    The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

    Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

    There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

    3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

    You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

    In this case, however, there are ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the requisite skill can verify what it does.

    You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

    Another indication that the test is safe can be found in this thread, and this one, for example, where the comment in which I suggested it was recommended by one of the Apple Community Specialists, as explained here.

    Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

    4. Here's a general summary of what you need to do, if you choose to proceed:

    ☞ Copy a particular line of text to the Clipboard.

    ☞ Paste into the window of another application.

    ☞ Wait for the test to run. It usually takes a few minutes.

    ☞ Paste the results, which will have been copied automatically, back into a reply on this page.

    These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

    5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is intermittently slow, run the test during a slowdown.

    You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual before running it. If you can only test in safe mode, do that.

    6. If you have more than one user, and only one user is affected by the problem,, and the affected user is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

    7. Load this linked web page (on the website "Pastebin.") The title of the page is "Diagnostic Test." Below the title is a text box headed by three small icons. The one on the right represents a clipboard. Click that icon to select the text, then copy it to the Clipboard on your computer by pressing the key combination command-C.

    If the text doesn't highlight when you click the icon, select it by triple-clicking anywhere inside the box. Don't select the whole page, just the text in the box.

    8. Launch the built-in Terminal application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad and start typing the name.

    Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

    9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

    exec bash

    and press return. Then paste the script again.

    10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

    If the test is taking much longer than usual to run because the computer is very slow, you might be prompted for your password a second time. The authorization that you grant by entering it expires automatically after five minutes.

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

    11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

    [Process started]
            Part 1 of 8 done at … sec
            …
            Part 8 of 8 done at … sec
            The test results are on the Clipboard.
            Please close this window.
    [Process completed]

    The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

    Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step. You'll have incomplete results, but still something. If you close the Terminal window while the test is still running, the partial results won't be saved and you'll have to start over.

    12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been saved to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

    At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

    13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the software that runs this website. Please post the test results on Pastebin, then post a link here to the page you created.

    14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you're told to do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

    ______________________________________________________________

    Copyright © 2014, 2015 by Linc Davis. As the sole author of this work (including the referenced "Diagnostic Test"), I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

  • by John3k,

    John3k John3k Oct 10, 2015 7:58 PM in response to Linc Davis
    Level 1 (0 points)
    Oct 10, 2015 7:58 PM in response to Linc Davis

    Every time I try to paste it in, I get an error.

     

    Here's a pastebin link instead.

     

    http://pastebin.com/VyLjxZ7r

  • by Linc Davis,

    Linc Davis Linc Davis Oct 10, 2015 8:44 PM in response to John3k
    Level 10 (208,000 points)
    Applications
    Oct 10, 2015 8:44 PM in response to John3k

    A

    You haven't completely removed "Camtasia." Please see what I wrote earlier about removing software.

    B

    You installed a variant of the "VSearch" trojan. Remove it as follows.

    This malware has many variants. Anyone else finding this comment should not expect it to be applicable.

    Back up all data before proceeding.

    Triple-click anywhere in the line below on this page to select it:

    /Library/LaunchAgents/com.umbilicated.agent.plist

    Right-click or control-click the line and select

              Services Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

    Repeat with each of these lines:

    /Library/LaunchDaemons/com.umbilicated.daemon.plist
    /Library/LaunchDaemons/com.umbilicated.helper.plist

    Restart the computer and empty the Trash. Then delete the following items in the same way:

    /Library/Application Support/Umbilicated
    /System/Library/Frameworks/Umbilicated.framework

    The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it. I don't recommend that you install the genuine "MPlayerX," because it's hosted on the rogue "SourceForge" website and is bundled with other malware.

    This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

    In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere  should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

    Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

              Install system data files and security updates (OS X 10.10 or later)

    or

              Download updates automatically (OS X 10.9 or earlier)

    if it's not already checked.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

    C

    Remove "BitDefender Antivirus" by following the instructions on this page. I can't vouch for the effectiveness of those instructions. If they don't work, refer to the developer for more information.

    Back up all data before making any changes. Never install any "anti-virus" or "anti-malware" software again.

    D

    "Memory Clean" and similar applications are at best worthless and should not be used.

    E

    You installed Adobe applications that were modified by copying them to a volume formatted for Windows. Using pirated or modified commercial software, especially if it was downloaded from a torrent, is the most dangerous thing you can do with a computer, and no "anti-virus" will protect you from the consequences.

    F

    In the sidebar of a Finder window, or on the Desktop, select the icon of the startup volume ("Macintosh HD," unless you gave it a different name.) Open it. Inside, there is a folder named "lost+found". It contains corrupt files that are wasting a lot of storage space. Back up all data, then drag the folder to the Trash and empty. You may be prompted for your administrator password.

  • by John3k,

    John3k John3k Oct 11, 2015 5:29 PM in response to Linc Davis
    Level 1 (0 points)
    Oct 11, 2015 5:29 PM in response to Linc Davis

    I don't know if I completely removed Camtasia, but I hope I did!

     

    Also, I legitimately installed all of those Adobe apps. Not sure why it's formatted for Windows.

     

    Everything else is removed, including the VSearch trojan.

     

    I'll give it a spin once again.

  • by John3k,

    John3k John3k Oct 11, 2015 10:26 PM in response to John3k
    Level 1 (0 points)
    Oct 11, 2015 10:26 PM in response to John3k

    Nope, no luck...

     

    I'll try another diagnostic, it might be Camtasia that's killing me.

  • by John3k,

    John3k John3k Oct 11, 2015 11:24 PM in response to John3k
    Level 1 (0 points)
    Oct 11, 2015 11:24 PM in response to John3k

    Ok, another pastebin.

     

    http://pastebin.com/eahbK0Y0

  • by Linc Davis,

    Linc Davis Linc Davis Oct 12, 2015 6:50 AM in response to John3k
    Level 10 (208,000 points)
    Applications
    Oct 12, 2015 6:50 AM in response to John3k

    "Camtasia" is still there. You must be trying to remove it by hunting for files by name, which, as I wrote eariler, doesn't work.

    Back up all data to at least two different storage devices, if you haven't already done so. One backup is not enough to be safe. The backups can be made with Time Machine or with Disk Utility. Preferably both.

    Erase and install OS X. This operation will destroy all data on the startup volume, so you had be better be sure of the backups. If you upgraded from an older version of OS X, you'll need the Apple ID and password that you used, so make a note of those before you begin.

    When you restart, you'll be prompted to go through the initial setup process. That’s when you transfer the data from a backup.

    Select only users in the Setup Assistant dialog—not Applications, Computer & Network Settings, or Other files and folders. Don't transfer the Guest account, if it was enabled.

    After that, check the App Store for software updates.

    If the problem is resolved after the clean installation, reinstall third-party software selectively. I can only suggest general guidelines. Self-contained applications that install into the Applications folder by drag-and-drop or download from the App Store are usually safe. Anything that comes packaged as an installer or that prompts for an administrator password is suspect, and you must test thoroughly after reinstalling each such item to make sure you haven't restored the problem.

    I strongly recommend that you never reinstall any "security" products or "utilities," nor any software that changes the user interface, or the behavior of built-in applications, such as Safari, in an unsupported way, nor any unlicensed commercial software. If you do any of that, the problem is likely to recur.

    Any system modifications that you do choose to install must be kept up to date.

    Before installing any software, ask yourself the question: "Am I sure I know how to uninstall this without having to wipe the volume again?" If the answer is "no," you could be creating a future problem that will be very hard to solve. Never install any third-party software unless you know how to uninstall it.

Page 1 Next