Q: com.apple.java.InstallOnDemand.plist - Invalid signature!
-
Oct 29, 2015 1:34 PMby etresoft,Hello Paul,
When you are posting an EtreCheck report, you should always post the whole thing. There may be other hints in the report that may indicate what is going wrong. Any particular red entry may or may not have any meaning. Often, it is the items in green that are the ones you need to worry about.
I can't really say why that particular task is failing the signature check. EtreCheck includes a list of known Apple signature failures. However, that task is not on that list of known failures. I am running the same operating system and it does not have an invalid signature on my machine. When I check it using the Terminal, it returns an expected, valid result. If you want to try this yourself, you can launch Terminal and enter the following command (all on one line):
codesign -vv -R="anchor apple generic" "/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components"
It should say:
/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components: valid on disk
/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components: satisfies its Designated Requirement
/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components: explicit requirement satisfied
Is there a specific problem that makes you want to investigate? If you describe the problem and post the entire EtreCheck report then someone might be able to help. There is something wrong with that file. I don't know if it is anything you need to be worried about.
-
Oct 29, 2015 4:06 PMby Paul Hugel,the response to your command
Pauls-MacBook-Air:~ paul$ codesign -vv -R="anchor apple generic" "/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components"
/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components: resource envelope is obsolete (custom omit rules)
-
Oct 29, 2015 4:17 PMby Paul Hugel,EtreCheck version: 2.6.1 (221)
Report generated 10/29/15, 1:13 PM
Runtime 1:16
Download EtreCheck from http://etresoft.com/etrecheck
Click the [Click for support] links for help with non-Apple products.
Click the [Click for details] links for more information about that line.
Hardware Information: (What does this mean?)
MacBook Air
[Click for Technical Specifications]
MacBook Air - model: MacBookAir6,2
1 1.7 GHz Intel Core i7 CPU: 2-core
8 GB RAM Not upgradeable
BANK 0/DIMM0
4 GB DDR3 1600 MHz ok
BANK 1/DIMM0
4 GB DDR3 1600 MHz ok
Bluetooth: Good - Handoff/Airdrop2 supported
Wireless: en0: 802.11 a/b/g/n/ac
Battery: Health = Normal - Cycle count = 77 - SN = removed
Video Information: (What does this mean?)
Intel HD Graphics 5000
Color LCD 1440 x 900
System Software: (What does this mean?)
OS X El Capitan 10.11.1 (15B42) - Time since boot: less than an hour
Disk Information: (What does this mean?)
APPLE SSD SM0512F disk0 : (500.28 GB) (Solid State - TRIM: Yes)
EFI (disk0s1) <not mounted> : 210 MB
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
eDrive (disk0s4) <not mounted> : 12.00 GB
MacintoshSSD (disk1) / : 486.92 GB (159.45 GB free)
Core Storage: disk0s2 487.29 GB Online
USB Information: (What does this mean?)
VIA Labs, Inc. USB3.0 Hub 1 TB
LaCie Rugged USB3 THB 1 TB
EFI (disk2s1) <not mounted> : 210 MB
PGHLaCie (disk2s2) /Volumes/PGHLaCie : 999.86 GB (389.79 GB free)
VIA Labs, Inc. USB3.0 Hub
Apple Inc. BRCM20702 Hub
Apple Inc. Bluetooth USB Host Controller
VIA Labs, Inc. USB2.0 Hub
VIA Labs, Inc. USB2.0 Hub
American Power Conversion J25B AV UPS FW:873.P2 .D USB FW:P2
Thunderbolt Information: (What does this mean?)
Apple Inc. thunderbolt_bus
Configuration files: (What does this mean?)
/etc/hosts - Count: 7
Gatekeeper: (What does this mean?)
Mac App Store and identified developers
Kernel Extensions: (What does this mean?)
/Library/Application Support/Roxio
[not loaded] com.roxio.TDIXController (2.0) [Click for support]
/Library/Application Support/VirtualBox
[loaded] org.virtualbox.kext.VBoxDrv (5.0.6) [Click for support]
[loaded] org.virtualbox.kext.VBoxNetAdp (5.0.6) [Click for support]
[loaded] org.virtualbox.kext.VBoxNetFlt (5.0.6) [Click for support]
[loaded] org.virtualbox.kext.VBoxUSB (5.0.6) [Click for support]
/Library/Application Support/Viscosity
[not loaded] com.viscosityvpn.Viscosity.tap (1.0) [Click for support]
[not loaded] com.viscosityvpn.Viscosity.tun (1.0) [Click for support]
/Library/Extensions
[loaded] at.obdev.nke.LittleSnitch (4354 - SDK 10.8) [Click for support]
[loaded] com.globaldelight.driver.BoomDevice (1.4 - SDK 10.10) [Click for support]
[loaded] com.logmein.hamachi (1.0.0 - SDK 10.9) [Click for support]
[not loaded] foo.tun (1.0) [Click for support]
/System/Library/Extensions
[not loaded] com.aliph.driver.jstub (1.1.2 - SDK 10.7) [Click for support]
[not loaded] com.elgato.driver.DontMatchAfaTech (1.1) [Click for support]
[not loaded] com.elgato.driver.DontMatchCinergy450 (1.1) [Click for support]
[not loaded] com.elgato.driver.DontMatchCinergyXS (1.1) [Click for support]
[not loaded] com.elgato.driver.DontMatchEmpia (1.1) [Click for support]
[not loaded] com.elgato.driver.DontMatchVoyager (1.1) [Click for support]
[loaded] com.hzsystems.terminus.driver (4) [Click for support]
[loaded] com.logmein.driver.LogMeInSoundDriver (1.0.3 - SDK 10.5) [Click for support]
[not loaded] com.makemkv.kext.daspi (1.5) [Click for support]
[not loaded] com.roxio.BluRaySupport (1.1.6) [Click for support]
[not loaded] com.wdc.driver.1394_64HP (1.0.1 - SDK 10.6) [Click for support]
[not loaded] com.wdc.driver.USB-64HP (1.0.1) [Click for support]
[not loaded] net.telestream.driver.TelestreamAudio (1.1.0 - SDK 10.8) [Click for support]
[not loaded] org.dungeon.driver.SATSMARTDriver (0.8 - SDK 10.6) [Click for support]
System Launch Agents: (What does this mean?)
[loaded] com.apple.java.InstallOnDemand.plist - Invalid signature!
Launch Agents: (What does this mean?)
[running] at.obdev.LittleSnitchUIAgent.plist [Click for support]
[loaded] com.adobe.AAM.Updater-1.0.plist [Click for support]
[running] com.bjango.istatmenusagent.plist [Click for support]
[running] com.bjango.istatmenusnotifications.plist [Click for support]
[running] com.bjango.istatmenusstatus.plist [Click for support]
[running] com.canon.MFManager.plist [Click for support]
[loaded] com.divx.dms.agent.plist [Click for support]
[loaded] com.divx.update.agent.plist [Click for support]
[loaded] com.google.keystone.agent.plist [Click for support]
[running] com.logmein.hamachimb.plist [Click for support]
[loaded] com.logmein.logmeingui.plist [Click for support]
[loaded] com.logmein.logmeinguiagent.plist [Click for support]
[loaded] com.logmein.logmeinguiagentatlogin.plist [Click for support]
[running] com.micromat.TechToolProAgent.plist [Click for support]
[loaded] com.oracle.java.Java-Updater.plist [Click for support]
[loaded] com.paragon.updater.plist [Click for support]
[loaded] com.teamviewer.teamviewer.plist [Click for support]
[loaded] com.teamviewer.teamviewer_desktop.plist [Click for support]
[running] com.wyse.MacCompanion.plist [Click for support]
[running] org.gpgtools.Libmacgpg.xpc.plist [Click for support]
[loaded] org.gpgtools.gpgmail.enable-bundles.plist [Click for support]
[loaded] org.gpgtools.gpgmail.patch-uuid-user.plist [Click for support]
[loaded] org.gpgtools.gpgmail.updater.plist [Click for support]
[loaded] org.gpgtools.macgpg2.fix.plist [Click for support]
[running] org.gpgtools.macgpg2.shutdown-gpg-agent.plist [Click for support]
[loaded] org.gpgtools.macgpg2.updater.plist [Click for support]
[loaded] org.macosforge.xquartz.startx.plist [Click for support]
Launch Daemons: (What does this mean?)
[running] at.obdev.littlesnitchd.plist [Click for support]
[loaded] com.adobe.SwitchBoard.plist [Click for support]
[loaded] com.adobe.agsservice.plist [Click for support]
[loaded] com.ambrosiasw.ambrosiaaudiosupporthelper.daemon.plist [Click for support]
[running] com.bjango.istatmenusdaemon.plist [Click for support]
[running] com.elgato.EyeConnect.plist [Click for support]
[loaded] com.google.keystone.daemon.plist [Click for support]
[running] com.logmein.hamachi.plist [Click for support]
[loaded] com.logmein.logmeinblanker.plist [Click for support]
[loaded] com.logmein.logmeinserver.plist [Click for support]
[loaded] com.logmein.raupdate.plist [Click for support]
[running] com.micromat.TechToolProDaemon.plist [Click for support]
[loaded] com.microsoft.office.licensing.helper.plist [Click for support]
[loaded] com.microsoft.office.licensingV2.helper.plist [Click for support]
[loaded] com.oracle.java.Helper-Tool.plist [Click for support]
[loaded] com.paragon.ntfs12.refresh.plist [Click for support]
[loaded] com.rogueamoeba.instanton-agent.plist [Click for support]
[loaded] com.sparklabs.ViscosityHelper.plist [Click for support]
[loaded] com.teamviewer.teamviewer_service.plist [Click for support]
[running] com.wyse.PocketCloud.plist [Click for support]
[loaded] org.gpgtools.gpgmail.patch-uuid.plist [Click for support]
[loaded] org.macosforge.xquartz.privileged_startx.plist [Click for support]
[loaded] org.virtualbox.startup.plist [Click for support]
User Launch Agents: (What does this mean?)
[loaded] com.adobe.AAM.Updater-1.0.plist [Click for support]
[loaded] com.adobe.ARM.[...].plist [Click for support]
[loaded] com.valvesoftware.steamclean.plist [Click for support]
[loaded] org.virtualbox.vboxwebsrv.plist [Click for support]
User Login Items: (What does this mean?)
iTunesHelper Application (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
Knock Application (/Applications/Knock.app)
SpeechSynthesisServer Application (/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks /SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app)
Awaken Application (/Applications/Awaken.app)
WDDriveUtilityHelper Application (/Applications/WD Drive Utilities.app/Contents/WDDriveUtilityHelper.app)
Audio Hijack 3 Schedule Helper Application Hidden (/Library/Application Support/Audio Hijack/Audio Hijack 3 Schedule Helper.app)
Dropbox Application (/Applications/Dropbox.app)
SMARTReporter Application (/Applications/SMARTReporter.app)
AwakenHelper Application Hidden (/Applications/Utilities/AwakenHelper.app)
ElCCengine Application (~/Library/Preferences/ElCCEngine.app)
MEGAsync Application (/Applications/MEGAsync.app)
Other Apps: (What does this mean?)
[running] 2BUA8C4S2C.com.agilebits.onepassword-osx-helper
[running] com.apple.xpc.launchd.oneshot.0x10000002.Little Snitch Network Monitor
[running] com.apple.xpc.launchd.oneshot.0x10000003.Growl
[running] com.apple.xpc.launchd.oneshot.0x10000004.Boom
[running] com.apple.xpc.launchd.oneshot.0x10000005.HardwareGrowler
[running] com.corecode.SMARTReporter.101792
[running] com.embraceware.awaken.30752
[running] com.embraceware.awakenhelper.124192
[running] com.etresoft.EtreCheck.59872
[running] com.getdropbox.dropbox.57312
[running] com.globaldelight.BoomDaemon
[loaded] com.growl.GrowlLauncher
[loaded] com.growl.HardwareGrowlerLauncher
[running] com.jibapps.TrashMeHelper
[running] com.knock.mac.73312
[running] com.logmein.hamachi.75232
[running] com.northernsw.nswCCEngine.132192
[running] com.rogueamoeba.audiohijack3.schedulehelper.131872
[running] com.westerndigital.WDDriveUtilityHelper.173152
[running] mega.mac.78432
Internet Plug-ins: (What does this mean?)
o1dbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]
OVSHelper: Version: 1.1 [Click for support]
Default Browser: Version: 601 - SDK 10.11
AdobeExManDetect: Version: AdobeExManDetect 1.1.0.0 - SDK 10.7 [Click for support]
AdobeAAMDetect: Version: AdobeAAMDetect 1.0.0.0 - SDK 10.6 [Click for support]
LogMeIn: Version: 1.0.961 - SDK 10.7 [Click for support]
DivX Web Player: Version: 3.4.0.6 - SDK 10.10 [Click for support]
Silverlight: Version: 5.1.40728.0 - SDK 10.6 [Click for support]
QuickTime Plugin: Version: 7.7.3
LogMeInSafari32: Version: 1.0.961 - SDK 10.7 [Click for support]
googletalkbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]
SharePointBrowserPlugin: Version: 14.5.7 - SDK 10.6 [Click for support]
JavaAppletPlugin: Version: Java 8 Update 65 build 17 Check version
User internet Plug-ins: (What does this mean?)
npDNSSECValidatorPlugin: Version: DNSSECValidatorPlugin_x86_64 2.1.0 - SDK 10.9 [Click for support]
BSVersion: Version: 1.0.0.7 - SDK 10.7 [Click for support]
WebEx64: Version: 1.0 - SDK 10.6 [Click for support]
Google Earth Web Plug-in: Version: 7.1 [Click for support]
npTLSAValidatorPlugin: Version: TLSAValidatorPlugin_x86_64 2.1.0 - SDK 10.9 [Click for support]
CitrixOnlineWebDeploymentPlugin: Version: 1.0.105 [Click for support]
npNASAEyes: Version: NASAEyes_x86_64 1.0.0.0 - SDK 10.6 [Click for support]
BSContact: Version: 8.206 - SDK 10.7 [Click for support]
Safari Extensions: (What does this mean?)
1Password
StartPage HTTPS
uBlock
iMedia Converter Deluxe
Open in Internet Explorer
3rd Party Preference Panes: (What does this mean?)
FUSE for OS X (OSXFUSE) [Click for support]
GPGPreferences [Click for support]
Java [Click for support]
Paragon ExtFS for Mac ® OS X [Click for support]
Paragon NTFS for Mac ® OS X [Click for support]
TechTool Protection [Click for support]
Time Machine: (What does this mean?)
Skip System Files: NO
Mobile backups: ON
Auto backup: YES
Volumes being backed up:
PGHLaCie: Disk size: 999.86 GB Disk used: 610.07 GB
MacintoshSSD: Disk size: 486.92 GB Disk used: 327.47 GB
Destinations:
Time Machine [Network]
Total size: 2.00 TB
Total number of backups: 58
Oldest backup: 7/3/15, 4:40 AM
Last backup: 10/29/15, 10:42 AM
Size of backup disk: Too small
Backup size 2.00 TB < (Disk used 937.54 GB X 3)
Top Processes by CPU: (What does this mean?)
7% WindowServer
4% LogMeIn Hamachi
3% coreaudiod
1% fontd
1% Little Snitch Agent
Top Processes by Memory: (What does this mean?)
836 MB com.apple.WebKit.WebContent(8)
743 MB kernel_task
164 MB Safari
123 MB Mail
106 MB WindowServer
Virtual Memory Information: (What does this mean?)
1.57 GB Free RAM
6.43 GB Used RAM (3.47 GB Cached)
0 B Swap Used
Diagnostics Information: (What does this mean?)
Oct 29, 2015, 12:45:55 PM Self test - passed
-
Oct 29, 2015 5:16 PMby etresoft,Hello again Paul,
I'm afraid I don't have a good answer for you. You have a fair bit of advanced software, including stuff from "MEGA". You have the same OS version that I do. But your Java installer fails its signature check. Either it is invalid or your security subsystem is invalid. I added this signature checking explicitly for situations like this. I don't know if your system has been hacked or if it is some harmless issue. You could try repeating that command with additional information. Run this command:
codesign -vvvv -R="anchor apple generic" "/System/Library/Java/Support/CoreDeploy.bundle/Contents/Download Java Components.app/Contents/MacOS/Download Java Components"
EtreCheck was not designed to detect malware. It has some very basic adware checked but relies on MalwareBytes to actually remove things. But all of those digital signatures are there for the explicit reason to verify their validity. I wanted to exercise that ability. Actually verifying security issues like this happens all to rarely. Xcode was recently hacked and used to populate the App Store with malware. Apple famously neglected to verify secure website certificates for years with the "goto fail" bug. I don't know the cause. I just know your Java installer failed the check. In theory, El Capitan's System Integrity Protection should protect you but maybe you had turned that off at some point. I don't know.
You seem to be an advanced user. You can try running checksums against this machine and another running the same OS version. As a last resort, ensure you have a good backup and reinstall the OS. You don't need to erase the disk. You should be able to just run the installer again. Hopefully that will correct it.
