Google Docs Margin Mystery and Mystery Safari Extension

Question

Level 1

14 points

Google Docs Margin Mystery and Mystery Safari Extension

Hello All!

This is my first post. Please bear with a rookie.

I have been experiencing the same problem that many have here but are without an answer: A new document on Docs where the characters run clear off the page (I tried to include a screenshot but "there was an issue loading my image"). Also there are other issues such as the cursor remaining in the same place no matter the amount of characters typed and so on.

Research of various forums mentioned Safari extensions as a possible problem. I loaded the "Keeper Password" extension, however I do not know what the below extension is. But when I disable it, the problems with Docs completely disappear.

What is that extension labeled as "1" and is it harmful? Should I uninstall it? I believe I read that it may be security related.

Please advise. Thanks!

MacBook Pro (Mid 2015)

OSX Yosemite 10.10.5 (Petrified to DL El Capitan)

Safari 9.0.3 (Just upgraded today, made no difference to my problem)

MacBook Pro with Retina display, OS X Yosemite (10.10.5), Safari 9.0.3

Posted on Jan 20, 2016 8:58 PM

Reply

Answer 1

Eric Root

Level 10

684,039 points

Jan 21, 2016 6:58 AM in response to Moriah7474

I would uninstall it or at least leave it disabled since it is interfering with the browser. If you didn't install the extension, it might possibly (I stress might) be some form of malware.

Reply

Answer 2

Linc Davis

Level 10

209,547 points

Jan 21, 2016 10:39 AM in response to Moriah7474

Please remove "WebSense" by following the instructions on this page. If you have a different version, the procedure may be different. If the software was incompletely removed, you may have to reinstall it to complete the process.

Back up all data before making any changes. Never install any "anti-virus" or "anti-malware" product again.

Reply

Answer 3

Moriah7474 Author

Level 1

14 points

Feb 13, 2016 2:34 PM in response to Linc Davis

The WebSense page you referenced at every point mentions "enter the endpoint anti-tampering password that you set in the portal" as if I installed this software, which I have not. Therefore, I have no such password.

Also, it also mentions "Go to System Preferences > Other, and click the icon for the endpoint software." There is no such thing in the "Other" section.

I have followed your advice hereRe: What is Safari extension called "1" and it still re-installs itself.

I understand that I may have to "re"-install it to completely remove it, but I am leery of installing something I never installed in the first place.

Reply

Answer 4

Linc Davis

Level 10

209,547 points

Feb 14, 2016 3:12 PM in response to Moriah7474

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.8 ("Mountain Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, please back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone who understands the code can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website many times over a period of years. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy the text of a particular web page (not this one) to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is intermittently slow, run the test during a slowdown.

You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual before running it. If you can only test in safe mode, do that.

6. If you have more than one user, and only one user is affected by the problem,, and the affected user is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") Press the key combination command-A to select all the text, then copy it to the Clipboard by pressing command-C.

8. Launch the built-in Terminal application in any one of the following ways:

☞ Enter the first few letters of its name ("Terminal") into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If the test is taking much longer than usual to run because the computer is very slow, you might be prompted for your password a second time. The authorization that you grant by entering it expires automatically after five minutes.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

Test started

Part 1 of 4 done at: … sec
…
Part 4 of 4 done at: … sec

The test results are on the Clipboard.

Please close this window.

The intervals between parts won't be exactly equal, but they give a rough indication of progress.

Wait for the final message "Please close this window" to appear—again, usually within a few minutes. If you don't see that message within about 30 minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step. You'll have incomplete results, but still something.

In order to get results, the test must either be allowed to complete or else manually stopped as above. If you close the Terminal window while the test is still running, the partial results won't be saved.

11. When the test is complete, or if you stopped it manually, quit Terminal. The results will have been saved to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "close this window" message. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the software that runs this website. Please post the test results on Pastebin, then post a link here to the page you created.

If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

13. When you're done with the test, it's gone. There is nothing to uninstall or clean up.

14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

15. The linked UNIX shell script bears a notice of copyright. Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 5

Moriah7474 Author

Level 1

14 points

Feb 22, 2016 8:16 PM in response to Linc Davis

1 Start time: 21:59:16 02/22/16

2

3 Revision: 1527

4

5 Model Identifier: MacBookPro11,4

6 Boot ROM Version: MBP114.0172.B06

7 System Version: OS X 10.10.5 (14F1605)

8 Kernel Version: Darwin 14.5.0

9 Time since boot: 23:30

10

11 USB

12

13 G-DRIVE USB (HGST)

14 USB Receiver (Logitech Inc.)

15

16 Bluetooth

17

18 ITB382

19

20 FileVault 2

21

22 FileVault is On.

23

24 I/O latency (ms/s)

25

26 Total: 465

27 Google Drive: 465

28

29 Memory (MB)

30

31 kernel_task (UID 0): 1318

32

33 System caches/logs

34

35 2.4 GiB: /System/Library/Caches/com.apple.coresymbolicationd/data

36

37 Diagnostic reports

38

39 2016-01-23 com.apple.photomoments crash

40 2016-01-24 iTunes crash*

41 2016-01-26 AdobeReader crash*

42 2016-01-26 com.apple.photomoments crash

43 2016-01-27 AdobeReader crash*

44 2016-01-27 Pages crash*

45 2016-01-30 FinderSyncAPIExtension crash

46 2016-01-31 Clock mini crash*

47 2016-01-31 com.apple.photomoments crash

48 2016-02-01 iTunes crash*

49 2016-02-02 AdobeReader crash*

50 2016-02-05 FinderSyncAPIExtension crash

51 2016-02-08 AdobeReader crash*

52 2016-02-08 Clock mini crash*

53 2016-02-08 com.apple.photomoments crash x2

54 2016-02-09 com.apple.photomoments crash

55 2016-02-10 AdobeReader crash*

56 2016-02-13 Finder crash*

57 2016-02-13 com.apple.photomoments crash

58 2016-02-15 FinderSyncAPIExtension crash

59 2016-02-16 Clock mini crash*

60 2016-02-16 com.apple.photomoments crash

61 2016-02-17 AdobeReader crash*

62 2016-02-21 com.apple.photomoments crash

63 2016-02-22 Clock mini crash*

64 * Code injection

65

66 HID errors: 2

67

68 Kernel log

69

70 Feb 16 22:25:10 TCON: Link or Aux (1) (0x00000000)

71 Feb 16 22:25:10 TCON: Aux ready at HW

72 Feb 17 20:10:15 proc 678: load code signature error 4 for file "RdrCEF Helper"

73 Feb 17 20:10:15 proc 679: load code signature error 4 for file "RdrCEF Helper"

74 Feb 17 20:10:17 proc 682: load code signature error 4 for file "RdrCEF Helper"

75 Feb 17 23:20:42 proc 932: load code signature error 4 for file "RdrCEF Helper"

76 Feb 17 23:23:17 proc 959: load code signature error 4 for file "RdrCEF Helper"

77 Feb 17 23:23:40 proc 966: load code signature error 4 for file "RdrCEF Helper"

78 Feb 17 23:36:50 ARPT: 18817.790840: MacAuthEvent en0 Auth result for: 20:0c:c8:19:c8:e5 Auth timed out

79 Feb 17 23:36:53 ARPT: 18820.855195: directed SSID scan fail

80 Feb 21 20:33:36 Limiting closed port RST response from 334 to 250 packets per second

81 Feb 21 21:58:36 proc 1604: load code signature error 4 for file "RdrCEF Helper"

82 Feb 21 22:28:59 TCON: Link or Aux (1) (0x00000000)

83 Feb 21 22:28:59 TCON: Aux ready at HW

84 Feb 21 22:29:10 proc 322: load code signature error 4 for file "RdrCEF Helper"

85 Feb 21 22:29:10 proc 324: load code signature error 4 for file "RdrCEF Helper"

86 Feb 22 21:23:00 proc 756: load code signature error 4 for file "RdrCEF Helper"

87

88 System log

89

90 Feb 22 20:54:23 launchservicesd: Application App:"loginwindow" asn:0x0-1001 pid:89 refs=7 @ 0x7fd9d5301670 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0x5c05c pid=709 "ScreenSaverEngine"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue

91 Feb 22 20:54:23 launchservicesd: Application App:"loginwindow" asn:0x0-1001 pid:89 refs=8 @ 0x7fd9d5301670 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0x5c05c pid=709 "ScreenSaverEngine"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue

92 Feb 22 21:04:21 launchservicesd: Application App:"Safari" asn:0x0-5005 pid:202 refs=8 @ 0x7fd9d3508dd0 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0x1001 pid=89 "loginwindow"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue

93 Feb 22 21:09:30 loginwindow: ERROR | -[LWBuiltInScreenLockAuthLion closeAuthAndReset:] | Attempted to remove an observer when not observing

94 Feb 22 21:11:11 Pages: CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server

95 Feb 22 21:11:11 Pages: CoreText CopyFontsForRequest received mig IPC error (FFFFFFFFFFFFFECC) from font server

96 Feb 22 21:12:08 corestoragehelperd: ==== EFILoginCopyUserGraphics name:(null) userPictureData:yes

97 Feb 22 21:12:11 WindowServer: WSGetSurfaceInWindow : Invalid surface 965492297 for window 160

98 Feb 22 21:12:11 WindowServer: WSGetSurfaceInWindow : Invalid surface 965492297 for window 160

99 Feb 22 21:12:11 WindowServer: WSGetSurfaceInWindow : Invalid surface 965492297 for window 160

100 Feb 22 21:23:00 amfid: /Applications/Adobe Acrobat Reader DC.app/Contents/Frameworks/RdrCEF Helper.app/Contents/MacOS/RdrCEF Helper signature not valid: 0xfffefa2a

101 Feb 22 21:32:44 fseventsd: requested timestamp is prior to the earliest log file. setting event-id to zero

102 Feb 22 21:34:05 WindowServer: window db is already attached to window da

103 Feb 22 21:34:06 WindowServer: window db is already attached to window da

104 Feb 22 21:34:06 WindowServer: window db is already attached to window da

105 Feb 22 21:35:17 WindowServer: _CGXGetWindowOrderingGroup: Operation on a window 0xdb requiring rights 0x5 by caller System Preferences

106 Feb 22 21:35:32 WindowServer: window e4 is already attached to window da

107 Feb 22 21:35:32 WindowServer: window e4 is already attached to window da

108 Feb 22 21:35:32 WindowServer: window e4 is already attached to window da

109 Feb 22 21:35:40 WindowServer: _CGXGetWindowOrderingGroup: Operation on a window 0xe4 requiring rights 0x5 by caller System Preferences

110 Feb 22 21:37:32 com.apple.backupd: Waiting for index to be ready (100)

111 Feb 22 21:42:59 launchservicesd: Application App:"loginwindow" asn:0x0-1001 pid:89 refs=7 @ 0x7fd9d5301670 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0x79079 pid=828 "ScreenSaverEngine"", "LSApplication:0x0-0x72072 pid=785 "com.apple.prefs.backup.remoteservice"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue

112 Feb 22 21:42:59 launchservicesd: Application App:"loginwindow" asn:0x0-1001 pid:89 refs=8 @ 0x7fd9d5301670 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0x79079 pid=828 "ScreenSaverEngine"", "LSApplication:0x0-0x72072 pid=785 "com.apple.prefs.backup.remoteservice"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue

113 Feb 22 21:43:04 loginwindow: ERROR | -[LWBuiltInScreenLockAuthLion closeAuthAndReset:] | Attempted to remove an observer when not observing

114 Feb 22 21:46:33 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

115

116 System services loaded

117

118 com.adobe.ARMDC.Communicator

119 com.adobe.ARMDC.SMJobBlessHelper

120 com.adobe.fpsaud

121 com.apple.watchdogd

122 com.l1inc.service

123 com.sec.faxdb

124

125 Login services loaded

126

127 com.ATI.LaunchAgent

128 com.ATI.LaunchProcessor

129 com.ATI.Launcher

130 com.adobe.ARMDCHelper.UUID

131 - status: 110

132 com.apple.icbaccountsd

133 - status: 71

134 com.google.keystone.user.agent

135

136 Contents of /Library/LaunchAgents/com.ATI.LaunchAgent.plist

137 - mod date: Oct 31 01:14:52 2014

138 - size (B): 564

139 - checksum: 1848451904

140

141 <?xml version="1.0" encoding="UTF-8"?>

142 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

143 <plist version="1.0">

144 <dict>

145 <key>KeepAlive</key>

146 <dict>

147 <key>SuccessfulExit</key>

148 <false/>

149 </dict>

150 <key>Label</key>

151 <string>com.ATI.LaunchAgent</string>

152 <key>RunAtLoad</key>

153 <true/>

154 <key>ProgramArguments</key>

155 <array>

156 <string>/Applications/LaunchAgent.exe</string>

157 </array>

158 <key>StandardErrorPath</key>

159 <string>/dev/null</string>

160 <key>StandardOutPath</key>

161 <string>/dev/null</string>

162 </dict>

163 </plist>

164

165 Contents of /Library/LaunchAgents/com.ATI.LaunchProcessor.plist

166 - mod date: Sep 4 11:49:02 2015

167 - size (B): 579

168 - checksum: 3532083386

169

170 <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/> </dict><key>Label</key><string>com.ATI.LaunchProcessor</string><key>RunAtLoad</k ey><true/><key>ProgramArguments</key><array><string>/cores/kefqr/Launcher.exe</s tring><string>1</string></array><key>UserName</key><string>root</string><key>Sta ndardErrorPath</key><string>/dev/null</string><key>StandardOutPath</key><string> /dev/null</string></dict></plist>

171

172 Contents of /Library/LaunchAgents/com.ATI.Launcher.plist

173 - mod date: Sep 4 11:49:02 2015

174 - size (B): 572

175 - checksum: 2684388975

176

177 <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/> </dict><key>Label</key><string>com.ATI.Launcher</string><key>RunAtLoad</key><tru e/><key>ProgramArguments</key><array><string>/cores/kefqr/Launcher.exe</string>< string>0</string></array><key>UserName</key><string>root</string><key>StandardEr rorPath</key><string>/dev/null</string><key>StandardOutPath</key><string>/dev/nu ll</string></dict></plist>

178

179 Contents of /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist

180 - mod date: Oct 16 05:32:28 2015

181 - size (B): 577

182 - checksum: 2197523146

183

184 <?xml version="1.0" encoding="UTF-8"?>

185 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

186 <plist version="1.0">

187 <dict>

188 <key>Label</key>

189 <string>com.adobe.ARMDCHelper.UUID</string>

190 <key>ProgramArguments</key>

191 <array>

192 <string>/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper</string>

193 </array>

194 <key>RunAtLoad</key>

195 <true/>

196 <key>StartInterval</key>

197 <integer>12600</integer>

198 </dict>

199 </plist>

200

201 Contents of /Library/LaunchDaemons/com.l1inc.igolfsyncapp_service.plist

202 - mod date: Jun 5 08:29:37 2015

203 - size (B): 591

204 - checksum: 3485369171

205

206 <?xml version="1.0" encoding="UTF-8"?>

207 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

208 <plist version="1.0">

209 <dict>

210 <key>Disabled</key>

211 <false/>

212 <key>KeepAlive</key>

213 <true/>

214 <key>Label</key>

215 <string>com.l1inc.service</string>

216 <key>ProcessType</key>

217 <string>Background</string>

218 <key>Program</key>

219 <string>/Applications/iGolf Sync App.app/Contents/MacOS/iGolfSyncApp_Service</string>

220 <key>RunAtLoad</key>

221 <true/>

222 <key>WorkingDirectory</key>

223 <string>/Applications/iGolf Sync App.app/Contents/MacOS</string>

224 </dict>

225 </plist>

226

227 Contents of /Library/LaunchDaemons/com.sec.faxdb.plist

228 - mod date: Nov 1 20:31:48 2015

229 - size (B): 834

230 - checksum: 3944748029

231

232 <?xml version="1.0" encoding="UTF-8"?>

233 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

234 <plist version="1.0">

235 <dict>

236 <key>GroupName</key>

237 <string>wheel</string>

238 <key>Label</key>

239 <string>com.sec.faxdb</string>

240 <key>OnDemand</key>

241 <false/>

242 <key>ProgramArguments</key>

243 <array>

244 <string>/Library/Printers/Samsung/Fax/FaxDB/faxdbd</string>

245 </array>

246 <key>RunAtLoad</key>

247 <true/>

248 <key>ServiceDescription</key>

249 <string>Samsung Fax DB</string>

250 <key>UserName</key>

251 <string>root</string>

252 <key>ThrottleInterval</key>

253 <integer>300</integer>

254 <key>StandardOutPath</key>

255 <string>/Library/Logs/Samsung/MacFax/FaxDB.log</string>

256 <key>StandardErrorPath</key>

257

258 ...and 5 more line(s)

259

260 Contents of /System/Library/LaunchAgents/com.apple.SafariPlugInUpdateNotifier.plist

261 - mod date: Dec 21 01:57:59 2015

262 - size (B): 779

263 - checksum: 941105980

264

265 <?xml version="1.0" encoding="UTF-8"?>

266 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

267 <plist version="1.0">

268 <dict>

269 <key>EnablePressuredExit</key>

270 <true/>

271 <key>Label</key>

272 <string>com.apple.SafariPlugInUpdateNotifier</string>

273 <key>Program</key>

274 <string>/usr/libexec/SafariPlugInUpdateNotifier</string>

275 <key>LaunchEvents</key>

276 <dict>

277 <key>com.apple.fsevents.matching</key>

278 <dict>

279 <key>UserFlashPlugInModified</key>

280 <dict>

281 <key>Path</key>

282 <string>~/Library/Internet Plug-Ins/Flash Player.plugin</string>

283 </dict>

284 <key>SystemFlashPlugInModified</key>

285 <dict>

286 <key>Path</key>

287 <string>/Library/Internet Plug-Ins/Flash Player.plugin</string>

288 </dict>

289 </dict>

290

291 ...and 3 more line(s)

292

293 Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist

294 - mod date: Jul 28 22:01:25 2015

295 - size (B): 554

296 - checksum: 3012644940

297

298 <?xml version="1.0" encoding="UTF-8"?>

299 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

300 <plist version="1.0">

301 <dict>

302 <key>Disabled</key>

303 <true/>

304 <key>Label</key>

305 <string>org.apache.httpd</string>

306 <key>EnvironmentVariables</key>

307 <dict>

308 <key>XPC_SERVICES_UNAVAILABLE</key>

309 <string>1</string>

310 </dict>

311 <key>ProgramArguments</key>

312 <array>

313 <string>/usr/sbin/httpd-wrapper</string>

314 <string>-D</string>

315 <string>FOREGROUND</string>

316 </array>

317 <key>OnDemand</key>

318 <false/>

319 </dict>

320 </plist>

321

322 Contents of Library/LaunchAgents/com.apple.FolderActions.folders.plist

323 - mod date: Aug 12 19:28:18 2015

324 - size (B): 517

325 - checksum: 1189540302

326

327 <?xml version="1.0" encoding="UTF-8"?>

328 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

329 <plist version="1.0">

330 <dict>

331 <key>Label</key>

332 <string>com.apple.FolderActions.folders</string>

333 <key>Program</key>

334 <string>/usr/bin/osascript</string>

335 <key>ProgramArguments</key>

336 <array>

337 <string>osascript</string>

338 <string>-e</string>

339 <string>tell application "Folder Actions Dispatcher" to tick</string>

340 </array>

341 <key>WatchPaths</key>

342 <array/>

343 </dict>

344 </plist>

345

346 Contents of Library/LaunchAgents/com.google.keystone.agent.plist

347 - mod date: Dec 14 14:21:37 2015

348 - size (B): 807

349 - checksum: 856649145

350

351 <?xml version="1.0" encoding="UTF-8"?>

352 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

353 <plist version="1.0">

354 <dict>

355 <key>Label</key>

356 <string>com.google.keystone.user.agent</string>

357 <key>LimitLoadToSessionType</key>

358 <string>Aqua</string>

359 <key>ProgramArguments</key>

360 <array>

361 <string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

362 <string>-runMode</string>

363 <string>ifneeded</string>

364 </array>

365 <key>RunAtLoad</key>

366 <true/>

367 <key>StartInterval</key>

368 <integer>3623</integer>

369 <key>StandardErrorPath</key>

370 <string>/dev/null</string>

371 <key>StandardOutPath</key>

372 <string>/dev/null</string>

373 </dict>

374 </plist>

375

376 User login items

377

378 iTunesHelper

379 - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

380 Google Drive

381 - /Applications/Google Drive.app

382 Android File Transfer Agent

383 - /Users/USER/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app

384 Solar Service

385 - /Users/USER/Library/Application Support/Logitech/SolarService/Solar Service.app

386

387 Safari extensions

388

389 - com.ati.Security

390 Keeper® Password Manager & Digital Vault

391 - com.keepersecurity.safari.KeeperExtension

392

393 iCloud services

394

395 CONTACTS

396 CALENDAR

397 REMINDERS

398 BOOKMARKS

399

400 iCloud errors

401

402 comapple.CloudPhotosConfiguration 1

403 cloudd 1

404

405 Continuity errors

406

407 sharingd 2

408 lsuseractivityd 2

409

410 Restrictive permissions: 20

411

412 Accessibility

413

414 Cursor Magnification: On

415 Keyboard Zoom: On

416

417 PrefPane

418

419 /Library/PreferencePanes/Flash Player.prefPane

420 - com.adobe.flashplayerpreferences

421

422 Bundles

423

424 /Library/Internet Plug-Ins/AdobePDFViewer.plugin

425 - com.adobe.acrobat.pdfviewer

426 - Adobe Systems, Inc.

427 /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

428 - com.adobe.acrobat.pdfviewerNPAPI

429 - Adobe Systems, Inc.

430 /Library/Internet Plug-Ins/Flash Player.plugin

431 - com.macromedia.Flash Player.plugin

432 - Adobe Systems, Inc.

433 /Library/Internet Plug-Ins/WebSecurity.plugin

434 - com.ATI.WebSecurity

435 /cores/kefqr/WebSecurity.plugin

436 - com.ATI.WebSecurity

437

438 App extensions

439

440 com.google.GoogleDrive.FinderSyncAPIExtension

441

442 Signatures

443

444 /System/Library/Frameworks/CoreTelephony.framework: bundle format unrecognized, invalid, or unsuitable

445 /System/Library/PrivateFrameworks/GPUSupport.framework: bundle format unrecognized, invalid, or unsuitable

446

447 Installations

448

449 Adobe Acrobat Reader DC (15.010.20056): 2/13/16, 5:04 PM

450 Adobe Flash Player: 2/9/16, 10:31 PM

451 Clock mini: 1/30/16, 4:24 PM

452 Kindle: 1/27/16, 8:05 PM

453 Adobe Flash Player: 1/20/16, 5:35 PM

454

455 Elapsed time (sec): 295

Reply

Answer 6

Linc Davis

Level 10

209,547 points

Feb 23, 2016 9:33 PM in response to Moriah7474

Websense is installed. If you didn't install it, who did?

Reply

Answer 7

Moriah7474 Author

Level 1

14 points

Mar 25, 2016 8:00 PM in response to Linc Davis

I have no idea. How do I get rid of it without access to the needed passwords?

Reply

Answer 8

Eric Root

Level 10

684,039 points

Mar 26, 2016 9:47 AM in response to Moriah7474

websense uninstall - mac

Reply

Answer 9

Moriah7474 Author

Level 1

14 points

Mar 26, 2016 1:29 PM in response to Eric Root

Linc Davis gave a similar link. However, as I stated above "The WebSense page you referenced at every point mentions "enter the endpoint anti-tampering password that you set in the portal" as if I installed this software, which I have not. Therefore, I have no such password."

Reply